Hi all, I also receive a high deal of alerts regarding connections to cws.checkpoint.com:80
But, looking up the DNS resolve these days I noticed it changed the response from our DNS (and public DNS). As it resolve to Akamai services (chained to multiple CNAMEs responses), I believe CP deploy some load balance for this service (and maybe like the TE Cloud, the DNS lookup response depends of the geographic location originating the request).
Maybe CP can code some Application Control signature or similar (Dynamic Object? Updatable Object?) to manage the multiple and different DNS response (which may vary from customer to customer), because deployed in this way we don't have any way to enforce and prioritize this traffic, which is essential to Application Control, URL Filtering, Anti-Bot and Anti-Virus blades.
Below I leave the RAD stats for URL Filtering, take a look on the RAD Down column:
|Day||Date||Time||Rad Up Time||Found in LDB||Sent to Site||Round Trip (ms)||Err: No Response||Err: Application Level||Err: DNS Error||Err: Internal Server Error (500)||Err: Service Unavailable (503)||Err: Other Error Code||Err: Other||Hit Count||Miss Count||Error Count||Cache Size (bytes)||Max Cache Size (bytes)||Cache Total Host Records||Max Cache Total Host Records||Avg Family Size||Max Family Size||Expired Requests||Expired Requests With Response||Rad Down||Service Down|
I monitored the RAD status (cpstat -f RAD_status urlf) and is not down during the issue.
I don't have any proxy between the gateway and our ISP router, so I believe the HTTP headers are left intact during the request.