topic Re: http traffic from gateway c2resolver.ctmail.com in Firewall and Security Management

http traffic from gateway c2resolver.ctmail.com

nflnetwork29 — Wed, 12 Apr 2023 18:56:36 GMT

Hello, i am just wondering why my 1600 (SMB) gateways are sending traffic to the following.

http

c2resolver.ctmail.com (216.163.176.35)

https

ec2-52-206-73-42.compute-1.amazonaws.com (52.206.73.42)

Also, if the traffic is legit why are these networks not included in the updateable object "Checkpoint Services" ?

Thanks,

Re: http traffic from gateway c2resolver.ctmail.com

Chris_Atkinson — Wed, 12 Apr 2023 22:42:29 GMT

Which blades are enabled on this gateway, is Anti-spam amongst them?

Re: http traffic from gateway c2resolver.ctmail.com

nflnetwork29 — Wed, 12 Apr 2023 22:45:28 GMT

Hi Chris,

To be honest these ones I'm talking about are just being used for routing purposed in hub & spoke topology.

Re: http traffic from gateway c2resolver.ctmail.com

Chris_Atkinson — Wed, 12 Apr 2023 23:12:56 GMT

What firmware version is the gateway currently deployed with?

For reference Dorit has previously posted about the status of our partnership with Cyren/Commtouch here:

https://community.checkpoint.com/t5/Off-Topic/Cyren-marketing/td-p/173070#M178

Re: http traffic from gateway c2resolver.ctmail.com

nflnetwork29 — Wed, 12 Apr 2023 23:04:40 GMT

Latest for quantum spark.

R81.10.05

Re: http traffic from gateway c2resolver.ctmail.com

Chris_Atkinson — Fri, 14 Apr 2023 00:56:40 GMT

Noted. If Anti-spam is not required and the traffic persists (to Cyren) once it is disabled, please take it with TAC for investigation.

Re: http traffic from gateway c2resolver.ctmail.com

nflnetwork29 — Thu, 13 Apr 2023 17:38:59 GMT

i disabled anti-spam blade but the gateway is still trying to send out http traffic to various ip's. (presumably checkpoint service IP's)

Why are they IP's not included in the updateable object? Is my updateable object out of date? How often does it update?

Re: http traffic from gateway c2resolver.ctmail.com

PhoneBoy — Fri, 14 Apr 2023 00:44:32 GMT

They should be getting updated...once an hour, I believe.
You should be able to see the contents with something like: dynamic_objects -uo_show
If the the updatable object for our services isn't accurate, I recommend a TAC case: https://help.checkpoint.com