topic Re: connections to file-rep.iaas.checkpoint.com:443 in Endpoint

connections to file-rep.iaas.checkpoint.com:443

Wolfgang — Thu, 19 Dec 2024 09:31:46 GMT

After deploying Harmony Endpoint in an environment with internet access only with proxy we are facing CPU utilization problems on the proxy environment.

From the proxy logs we see the system is flooded with connections to "file-rep.iaas.checkpoint.com" from all clients all the times. We are using a supernode in the environment but these connections are always seen via the proxy. Around 80% of all internet traffic is regarding this connections. sk116590 states this connections are for ThreatEmulationBlade

Any chance to stop this or get working not via the proxy but the supernode?

Re: connections to file-rep.iaas.checkpoint.com:443

Chris_Atkinson — Thu, 19 Dec 2024 09:35:47 GMT

Are you implying the super node also doesn't rely on the proxy for its Internet access?

Re: connections to file-rep.iaas.checkpoint.com:443

Wolfgang — Thu, 19 Dec 2024 09:55:01 GMT

Yes, the supernode has connectivity to the Cloud without the proxy. All these connections we can see on the proxy are only from the clients with installed EndPoint software.

Re: connections to file-rep.iaas.checkpoint.com:443

PhoneBoy — Thu, 19 Dec 2024 18:24:39 GMT

Based on https://support.checkpoint.com/results/sk/sk171703 this is expected behavior.
Specifically: Currently, Super Node serves as an Anti-Malware signature proxy.

Re: connections to file-rep.iaas.checkpoint.com:443

RS_Daniel — Thu, 19 Dec 2024 22:09:31 GMT

Hello,

We faced the same issue. These connections overloaded our proxy. I understand it is a normal behavior, according to TAC, Under the hood Anti-Malware E2 is part of Threat Emulation blade and cannot function independently. Therefore Threat Emulation as blade is installed, no matter how it is called Threat Emulation or File reputation.
. We found some options:

Reduce the number of connections that agents do to those URL's. It needs to disable some fetures which reduces security. (File reputation, custom IoC, create exclusions for browsers cache folders)
Use semi isolated enviaroments Super Node, all file-rep connections will go to Super Node. It does not work with authenticated proxy.
Send these connections to a different proxy configuring Client Settings > General > Authenticated Proxy. Again, it does not work with authenticated proxy! It should be fixed on E88.70.

Just a tip. Make sure that all CheckPoint URL's are allowed on your proxy for endpoints. We found a couple endpoints without permissions to file-rep URL, and they went crazy, sent hundreds of attempts until we allowed the connection.

Regards

Re: connections to file-rep.iaas.checkpoint.com:443

Wolfgang — Fri, 20 Dec 2024 07:11:35 GMT

Thanks @RS_Daniel sounds good, we are not alone.

Your second point is very interesting. We are using the Super Node, but all connections to file-rep...... are going through the normal proxy. It would be very helpful gettng these connection rid from the normal proxy. We don't use our proxy with authentication.

Re: connections to file-rep.iaas.checkpoint.com:443

RS_Daniel — Fri, 20 Dec 2024 12:54:25 GMT

Hello,

That option only worked after we enabled Semi Isolated mode on our tenant. A checkpoint team helped us enabling this feature on the server, and only then we were able to follow and enabled Semi Isolated super node configuration steps. Also i would try it with E88.50 or higher.

You can check this training video shared by Bar Yassure:

Learn more about this new capability:

Technical Training (Passcode: 1Zmjq!ZA)

Regards

Re: connections to file-rep.iaas.checkpoint.com:443

Wolfgang — Mon, 23 Dec 2024 13:57:18 GMT

@RS_Daniel as an information ... We could reduce the CPU utilization on the proxy significant by not logging the known URL. We have 500 clients and not logging these URL reduces CPU utilization form 80% => 10% (4 cores active).

######## small ACL for squid-proxy #############

acl nolog dstdomain \
file-rep.iaas.checkpoint.com

access_log none nolog

######## small ACL for squid-proxy #############

Re: connections to file-rep.iaas.checkpoint.com:443

RS_Daniel — Fri, 27 Dec 2024 18:49:29 GMT

Good tip, thanks! will test it.