topic Re: What frequency to CWS in Firewall and Security Management

What frequency to CWS

r31N3r — Wed, 15 Mar 2023 12:57:55 GMT

Hello,

Can me anyone tell what is the correct frequency a cluster-(ip) should connect to http://cws.checkpoint.com/Malware/malware/6.0? or http://cws.checkpoint.com/AntiVirus/antivirus/2.0? ? In our environment , AV and Antibot enabled, it seems to be a streaming connection. Is this O.K.?

Thank you for your replies in advance

Reiner

Re: What frequency to CWS

the_rock — Wed, 15 Mar 2023 14:23:36 GMT

Might be worth TAC case to confirm this...excellent question by the way @r31N3r

Re: What frequency to CWS

G_W_Albrecht — Wed, 15 Mar 2023 14:55:45 GMT

What do you mean by frequency ? How often per week / day you connect and update ? This can be selected according to your prefered interval. sk83520 - How to verify that Security Gateway and/or Security Management Server can access Check Point servers?

Re: What frequency to CWS

G_W_Albrecht — Wed, 15 Mar 2023 14:56:59 GMT

Confirm what ? He did not present any answer that can be confirmed, but only a question still not answered by anyone 😉

I would go for 12h.

Re: What frequency to CWS

the_rock — Wed, 15 Mar 2023 15:01:24 GMT

Confirm answer to his question 😇

Re: What frequency to CWS

r31N3r — Wed, 15 Mar 2023 15:15:19 GMT

We set in the SmartDashboard "Traditional Anti-Virus" 120min and "Proxy1".

On "Proxy 2", set in Global Properties or in Custer Object, the log for cws.checkpoint.com is running like there's no tomorrow. All states IPS/AV Signature on for the cluster are "green".

Re: What frequency to CWS

_Val_ — Wed, 15 Mar 2023 16:01:36 GMT

This is normal, AV/AB/IPS are in constant communication with the ThreatCloud.

Re: What frequency to CWS

PhoneBoy — Wed, 15 Mar 2023 18:35:19 GMT

If AV/AB are enabled, calls to those URLs and others listed in sk83520 are to be expected relative to the traffic the gateway is seeing.
It's expected behavior.