Connectivity to the URL resources for push notifications Mobile Access

[DmitriyDubovik]

Good morning.

We are currently setting up push notifications for Capsule Workspace.

The documentation says that for proper notification work  we must have network access from the mobile access gateway to the following resources:

Click to Expand

To use push notifications, the Security Gateway must have connectivity to these URLs on ports 443 and 80:

• https://push.checkpoint.com (209.87.211.173 and 217.68.8.71)
• http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl
• http://crl.verisign.com/pca3-g5.crl

Plus we, like it says in documentation, we use additional command to check a status of push notification and see this:

There is information about connectivity to the additional URL: http://crl.entrust.net/levell1k.crl , that doesn t appear in the documentation file. For some reason it showing like doesn t connect, but it cannot be connected because it doesn t even resolve from dns, like http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl

1. What is puropse for this four URL addresses ( especially CRL ones)? 

2. Is it necessary to make network access to all of them, given that at least 2 of them do not resolve?

[PhoneBoy]

In order to verify a TLS certificate is valid, you need access to the Certificate Revocation List.
That generally assumes the gateway has Internet access.

What version/JHF is the gateway here?
I assume we wouldn't try to use CRL addresses that don't exist...unless this is an old gateway version.

[kamilazat]

---

What version/JHF is the gateway here?
I assume we wouldn't try to use CRL addresses that don't exist...unless this is an old gateway version.

---

Do different gateway versions have different CRL sources?

[DmitriyDubovik]

81.20 take 41 

We have a sitution that the everything is perfect except of this CRL portals, that don t even resolve.

Pushes don t work at all

[PhoneBoy]

Sounds like a bug and you should consult with TAC: https://help.checkpoint.com

[DmitriyDubovik]

You can try by yourself to connect to this URLs and find out that not of them are alive in nowtime