Firewalls traffic to Internet

[fjulianom]

Hi mates,

I have a cluster of firewalls and I see the active firewall access Internet continuosly mostly by HTTP:

What is this traffic for? I am thinking to block the Internet access to the firewalls.

Regards,

Julián

[Sorin_Gogean · Accepted solution]

Depending on what services you have activated on your appliances, that is normal for the GWs to go out to Internet for different things.

Updatable Objects, IPS updates, Antivirus updates, license checks, etc. , etc. , etc. ...

If you look into the logs with the URL view, you will see the URL that is addressed and if you have HTTPS Inspection blade enabled, you'll see the HTTPS ones too...

Enjoy,

PS: forgot to mention, but if you set the GW as a proxy, then all Internet traffic from clients will show as initiated from the appliance.... just an ideea

[fjulianom]

Hi Sorin,

OK, thanks. How can I go to the URL view? I want to check what URLs are addressed and not only the IPs, sorry but I am a newbie in Check Point.

Regards,

Julián

[_Val_]

All URLs by feature are listed in sk83520

[svori · Accepted solution]

If you run HTTPS Inspect, then this can be OSCP traffic which runs over http unencrypted by design.

[fjulianom]

I don't think I should run HTTPS inspection, the protocol used is mostly HTTP.

Regards,

Julián