Connection was allowed because background classification mode was set - Anti-Bot

[#1]

Hello,

Lately we have been receiving numerous logs, associated with the Anti-Bot blade, with the message "Connection was allowed because background classification mode was set. See sk74120 for more information."
This would be normal if the configuration for Threat Prevention Engine Settings -> General -> Check Point Online Web Service had the Background option selected, but that is not the case, despite having configured the Hold option these messages continue to appear. Should I be worried? What can I do?

[#2]

Hello,

Lately we have been receiving numerous logs, associated with the Anti-Bot blade, with the message "Connection was allowed because background classification mode was set. See sk74120 for more information."
This would be normal if the configuration for Threat Prevention Engine Settings -> General -> Check Point Online Web Service had the Background option selected, but that is not the case, despite having configured the Hold option these messages continue to appear. Should I be worried? What can I do?

[#3]

Hello,

Lately we have been receiving numerous logs, associated with the Anti-Bot blade, with the message "Connection was allowed because background classification mode was set. See sk74120 for more information."
This would be normal if the configuration for Threat Prevention Engine Settings -> General -> Check Point Online Web Service had the Background option selected, but that is not the case, despite having configured the Hold option these messages continue to appear. Should I be worried? What can I do?

[the_rock]

If its DNS, that will be relevant.

[the_rock]

If its DNS, that will be relevant.

[cjfsoares]

Hello,

Thank you for your answers.
It's DNS traffic.

[cjfsoares]

Hello,

Thank you for your answers.
It's DNS traffic.

[TurgutKaplanogl]

Ok, you can fix with this sk;

https://support.checkpoint.com/results/sk/sk92224

[TurgutKaplanogl]

Ok, you can fix with this sk;

https://support.checkpoint.com/results/sk/sk92224

[cjfsoares]

Tried out the SK. Now got messages like the one attached.

[cjfsoares]

Tried out the SK. Now got messages like the one attached.

[TurgutKaplanogl]

I think your first problem are solved and DNS protection is working with hold mode. At this point you need to check your connectivity  with this sk;

https://support.checkpoint.com/results/sk/sk74040

[TurgutKaplanogl]

I think your first problem are solved and DNS protection is working with hold mode. At this point you need to check your connectivity  with this sk;

https://support.checkpoint.com/results/sk/sk74040

[the_rock]

Can you send output of fw stat -b AMW command please? 

Andy

[the_rock]

Can you send output of fw stat -b AMW command please? 

Andy

[cjfsoares]

Here's the output

[cjfsoares]

Here's the output