Check Point Online Web Service Response Time

[usukhbayar_g]

Hello,

Currently, the Website Categorization mode is set to Background Mode, and I am planning to switch it to Hold Mode. Before making this change, I would like to measure the response time between the Security Gateway and the Check Point Online Web Service to assess the potential impact.

I understand that the Security Gateway maintains a cache and only queries the Online Web Service when a URL is not found locally. However, I want to ensure that the response time is within acceptable limits before implementing this change.

Could you advise on the best method to accurately measure this response time?

Best regards

[the_rock]

Hold Mode: In this mode, if a website's category isn't found in the local cache, the user's request is paused until the Check Point Online Web Service completes the categorization. This ensures that only categorized content is accessed but may introduce delays, especially if the service's response time is prolonged.

https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R8...

Factors affecting the response time of the Check Point Online Web Service include network latency, current server load, and the efficiency of the service itself. To optimize performance, it's advisable to use the default Background Mode, which allows user requests to proceed while categorization occurs concurrently. Additionally, ensuring that the local cache is adequately sized and maintained can reduce the frequency of external queries, thereby improving overall response times.

If users experience significant delays or performance issues, reviewing these settings and monitoring network conditions can help identify and mitigate potential bottlenecks.

Andy

[usukhbayar_g]

Thanks for fast response😀
Reason I want to change this is, as shown in below picture, prevent those DNS requests. If you suggesting not to change it, is there some alternative method to block this connections?

[the_rock · Accepted solution]

I am suggesting to CHANGE it 🙂

I always found it works better with hold setting, specially if you use ssl inspection. Btw, background option is better to keep for threat prevention.

Andy

[usukhbayar_g]

Thank you

Is there any way to check response time between Security Gateway and Online Web Service? I pinged address (assumed cws.checkpoint.com used for this).

[the_rock]

tracepath cws.checkpoint.com

tracepath updates.checkpoint.com

Just do it from expert mode.

Andy

[the_rock]

Example from my R82 lab, though it probably looks a bit different considering I was connected to 3rd party SASE provider.

Andy

[Expert@R82:0]# tracepath cws.checkpoint.com
1?: [LOCALHOST] pmtu 1500
1: 172.16.10.1 (172.16.10.1) 2.079ms
2: unassigned-209.3.46.173.net.blink.ca (173.46.3.209) 1.674ms
3: unallocated-static.rogers.com (72.142.86.37) 1.766ms
4: 209.148.225.138 (209.148.225.138) 2.382ms
5: 209.148.225.142 (209.148.225.142) 2.585ms
6: 24.156.145.130 (24.156.145.130) 3.543ms
7: 9044-cgw01.wlfdle.rmgt.net.rogers.com (209.148.230.45) 3.281ms
8: 9402-cgw01.bloor.rmgt.net.rogers.com (209.148.235.233) 4.100ms
9: 69.63.248.57 (69.63.248.57) 10.008ms
10: 209.148.230.134 (209.148.230.134) 20.874ms
11: no reply
12: ae35.r02.border101.ewr04.fab.netarch.akamai.com (23.203.154.47) 25.456ms
13: no reply
14: no reply
15: no reply
16: a23-209-72-17.deploy.static.akamaitechnologies.com (23.209.72.17) asymm 17 20.077ms reached
Resume: pmtu 1500 hops 16 back 17

[usukhbayar_g]

I got continious no reply message with tracepath command (don't know why xD). Instead I used traceroute.

[the_rock]

No sweat, just do below...either regular ping, or you can do many options with ping. I just used default packet size, 4096 bytes.

Andy

[Expert@R82:0]# ping -s 4096 updates.checkpoint.com
PING e17340.dscd.akamaiedge.net (23.199.50.18) 4096(4124) bytes of data.
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=1 ttl=48 time=20.2 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=2 ttl=48 time=18.8 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=3 ttl=48 time=18.9 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=4 ttl=48 time=19.0 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=5 ttl=48 time=18.9 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=6 ttl=48 time=18.8 ms
4104 bytes from a23-199-50-18.deploy.static.akamaitechnologies.com (23.199.50.18): icmp_seq=7 ttl=48 time=18.9 ms
^C
--- e17340.dscd.akamaiedge.net ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6005ms
rtt min/avg/max/mdev = 18.821/19.109/20.205/0.485 ms
[Expert@R82:0]#

[usukhbayar_g]

Got it, you mentioned background option is better to keep for threat prevention. Can you describe it little more?

[the_rock]

I believe its in threat prevention admin guide. I will check in lab tomorrow.

[the_rock]

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ThreatPrevention_AdminGuide/...

Page 350