https://community.checkpoint.com/t5/General-Topics/GoDaddy-CRL-Issues/m-p/72103#M14626 <P data-unlink="true">Running R80.30, and looking at my Logs to make sure rules are working correctly. I sorted by destination = my WAN IP for last 7 days.</P> <P data-unlink="true">In the Top Sources, I saw that a ton (33%) are from one IP:&nbsp; 72.167.18.237. They are all drops due to&nbsp;First packet isn't SYN. TCP Flags RST.</P> <P data-unlink="true">72.167.18.237 resolves to&nbsp;p3plpkivs-v01.any.prod.phx3.secureserver.net</P> <P data-unlink="true">After some more research, that IP also resolves to&nbsp;<SPAN>crl.godaddy.com</SPAN></P> <P data-unlink="true">Looked at my Logs for destination =&nbsp;72.167.18.237 and several times every minute, my Firewall (source = my WAN IP) is contacting 72.167.18.237 on http via Implied Rule 0.</P> <P data-unlink="true">I do have HTTPS Inspection enabled.</P> <P data-unlink="true">Is my Firewall trying to check the GoDaddy CRL and failing?</P> Sun, 12 Jan 2020 03:38:18 GMT ESwisher 2020-01-12T03:38:18Z https://community.checkpoint.com/t5/General-Topics/GoDaddy-CRL-Issues/m-p/72103#M14626 <P data-unlink="true">Running R80.30, and looking at my Logs to make sure rules are working correctly. I sorted by destination = my WAN IP for last 7 days.</P> <P data-unlink="true">In the Top Sources, I saw that a ton (33%) are from one IP:&nbsp; 72.167.18.237. They are all drops due to&nbsp;First packet isn't SYN. TCP Flags RST.</P> <P data-unlink="true">72.167.18.237 resolves to&nbsp;p3plpkivs-v01.any.prod.phx3.secureserver.net</P> <P data-unlink="true">After some more research, that IP also resolves to&nbsp;<SPAN>crl.godaddy.com</SPAN></P> <P data-unlink="true">Looked at my Logs for destination =&nbsp;72.167.18.237 and several times every minute, my Firewall (source = my WAN IP) is contacting 72.167.18.237 on http via Implied Rule 0.</P> <P data-unlink="true">I do have HTTPS Inspection enabled.</P> <P data-unlink="true">Is my Firewall trying to check the GoDaddy CRL and failing?</P> Sun, 12 Jan 2020 03:38:18 GMT https://community.checkpoint.com/t5/General-Topics/GoDaddy-CRL-Issues/m-p/72103#M14626 ESwisher 2020-01-12T03:38:18Z https://community.checkpoint.com/t5/General-Topics/GoDaddy-CRL-Issues/m-p/72104#M14627 Hello,<BR />It may be a good idea to do a packet capture with tcpdump or the tool of your preference in order to see what is happening under the hood: Is the initial handshake finished? Is it failing at the TLS Handshake? How much time does the responses take? Are there tons of retransmissions from one side?<BR /><BR />Hope it helps Sun, 12 Jan 2020 05:23:51 GMT https://community.checkpoint.com/t5/General-Topics/GoDaddy-CRL-Issues/m-p/72104#M14627 FedericoMeiners 2020-01-12T05:23:51Z