topic Re: Connectivity to the URL resources for push notifications Mobile Access in SASE and Remote Access

Connectivity to the URL resources for push notifications Mobile Access

DmitriyDubovik — Mon, 22 Jan 2024 10:07:41 GMT

Good morning.

We are currently setting up push notifications for Capsule Workspace.

The documentation says that for proper notification work we must have network access from the mobile access gateway to the following resources:

To use push notifications, the Security Gateway must have connectivity to these URLs on ports 443 and 80:

https://push.checkpoint.com (209.87.211.173 and 217.68.8.71)
http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl
http://crl.verisign.com/pca3-g5.crl

Plus we, like it says in documentation, we use additional command to check a status of push notification and see this:

There is information about connectivity to the additional URL: http://crl.entrust.net/levell1k.crl , that doesn t appear in the documentation file. For some reason it showing like doesn t connect, but it cannot be connected because it doesn t even resolve from dns, like http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl

1. What is puropse for this four URL addresses ( especially CRL ones)?

2. Is it necessary to make network access to all of them, given that at least 2 of them do not resolve?

Re: Connectivity to the URL resources for push notifications Mobile Access

PhoneBoy — Wed, 24 Jan 2024 23:45:24 GMT

In order to verify a TLS certificate is valid, you need access to the Certificate Revocation List.
That generally assumes the gateway has Internet access.

What version/JHF is the gateway here?
I assume we wouldn't try to use CRL addresses that don't exist...unless this is an old gateway version.

Re: Connectivity to the URL resources for push notifications Mobile Access

kamilazat — Thu, 25 Jan 2024 06:54:46 GMT

What version/JHF is the gateway here?
I assume we wouldn't try to use CRL addresses that don't exist...unless this is an old gateway version.

Do different gateway versions have different CRL sources?

Re: Connectivity to the URL resources for push notifications Mobile Access

DmitriyDubovik — Thu, 25 Jan 2024 07:57:13 GMT

81.20 take 41

We have a sitution that the everything is perfect except of this CRL portals, that don t even resolve.

Pushes don t work at all

Re: Connectivity to the URL resources for push notifications Mobile Access

DmitriyDubovik — Thu, 25 Jan 2024 08:05:13 GMT

You can try by yourself to connect to this URLs and find out that not of them are alive in nowtime

Re: Connectivity to the URL resources for push notifications Mobile Access

PhoneBoy — Sun, 28 Jan 2024 02:58:45 GMT

Sounds like a bug and you should consult with TAC: https://help.checkpoint.com