Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
fjulianom
Advisor
Jump to solution

Firewalls traffic to Internet

Hi mates,

 

I have a cluster of firewalls and I see the active firewall access Internet continuosly mostly by HTTP:

 

inet2.PNGinet1.png

What is this traffic for? I am thinking to block the Internet access to the firewalls.

 

Regards,

Julián

0 Kudos
2 Solutions

Accepted Solutions
Sorin_Gogean
Advisor

Depending on what services you have activated on your appliances, that is normal for the GWs to go out to Internet for different things.

Updatable Objects, IPS updates, Antivirus updates, license checks, etc. , etc. , etc. ...

If you look into the logs with the URL view, you will see the URL that is addressed and if you have HTTPS Inspection blade enabled, you'll see the HTTPS ones too...

 

Enjoy,

PS: forgot to mention, but if you set the GW as a proxy, then all Internet traffic from clients will show as initiated from the appliance.... just an ideea

View solution in original post

svori
Contributor
Contributor

If you run HTTPS Inspect, then this can be OSCP traffic which runs over http unencrypted by design.

View solution in original post

5 Replies
Sorin_Gogean
Advisor

Depending on what services you have activated on your appliances, that is normal for the GWs to go out to Internet for different things.

Updatable Objects, IPS updates, Antivirus updates, license checks, etc. , etc. , etc. ...

If you look into the logs with the URL view, you will see the URL that is addressed and if you have HTTPS Inspection blade enabled, you'll see the HTTPS ones too...

 

Enjoy,

PS: forgot to mention, but if you set the GW as a proxy, then all Internet traffic from clients will show as initiated from the appliance.... just an ideea

fjulianom
Advisor

Hi Sorin,

 

OK, thanks. How can I go to the URL view? I want to check what URLs are addressed and not only the IPs, sorry but I am a newbie in Check Point.

 

Regards,

Julián

0 Kudos
_Val_
Admin
Admin

All URLs by feature are listed in sk83520

0 Kudos
svori
Contributor
Contributor

If you run HTTPS Inspect, then this can be OSCP traffic which runs over http unencrypted by design.

fjulianom
Advisor

I don't think I should run HTTPS inspection, the protocol used is mostly HTTP.

 

Regards,

Julián

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events