topic Re: Firewalls traffic to Internet in General Topics

Firewalls traffic to Internet

fjulianom — Wed, 08 Mar 2023 07:01:40 GMT

Hi mates,

I have a cluster of firewalls and I see the active firewall access Internet continuosly mostly by HTTP:

What is this traffic for? I am thinking to block the Internet access to the firewalls.

Regards,

Julián

Re: Firewalls traffic to Internet

Sorin_Gogean — Wed, 08 Mar 2023 07:18:52 GMT

Depending on what services you have activated on your appliances, that is normal for the GWs to go out to Internet for different things.

Updatable Objects, IPS updates, Antivirus updates, license checks, etc. , etc. , etc. ...

If you look into the logs with the URL view, you will see the URL that is addressed and if you have HTTPS Inspection blade enabled, you'll see the HTTPS ones too...

Enjoy,

PS: forgot to mention, but if you set the GW as a proxy, then all Internet traffic from clients will show as initiated from the appliance.... just an ideea

Re: Firewalls traffic to Internet

fjulianom — Wed, 08 Mar 2023 07:29:07 GMT

Hi Sorin,

OK, thanks. How can I go to the URL view? I want to check what URLs are addressed and not only the IPs, sorry but I am a newbie in Check Point.

Regards,

Julián

Re: Firewalls traffic to Internet

_Val_ — Wed, 08 Mar 2023 08:31:07 GMT

All URLs by feature are listed in sk83520

Re: Firewalls traffic to Internet

nooni — Wed, 08 Mar 2023 09:47:40 GMT

If you run HTTPS Inspect, then this can be OSCP traffic which runs over http unencrypted by design.

Re: Firewalls traffic to Internet

fjulianom — Wed, 08 Mar 2023 15:42:46 GMT

I don't think I should run HTTPS inspection, the protocol used is mostly HTTP.

Regards,

Julián