http traffic from gateway c2resolver.ctmail.com

[nflnetwork29]

Hello, i am just wondering why my 1600 (SMB) gateways are sending traffic to the following. 

http

c2resolver.ctmail.com (216.163.176.35)

https 

ec2-52-206-73-42.compute-1.amazonaws.com (52.206.73.42)

Also, if the traffic is legit why are these networks not included in the updateable object "Checkpoint Services" ?

Thanks, 

[Chris_Atkinson]

Which blades are enabled on this gateway, is Anti-spam amongst them?

[nflnetwork29]

Hi Chris, 

To be honest these ones I'm talking about are just being used for routing purposed in hub & spoke topology. 

[Chris_Atkinson]

What firmware version is the gateway currently deployed with?

For reference Dorit has previously posted about the status of our partnership with Cyren/Commtouch here:

https://community.checkpoint.com/t5/Off-Topic/Cyren-marketing/td-p/173070#M178

[nflnetwork29]

Latest for quantum spark. 

R81.10.05

[Chris_Atkinson]

Noted. If Anti-spam is not required and the traffic persists (to Cyren) once it is disabled, please take it with TAC for investigation. 

[nflnetwork29]

i disabled anti-spam blade but the gateway is still trying to send out http traffic to various ip's. (presumably checkpoint service IP's) 

Why are they IP's not included in the updateable object? Is my updateable object out of date? How  often does it update?

[PhoneBoy]

They should be getting updated...once an hour, I believe.
You should be able to see the contents with something like: dynamic_objects -uo_show 
If the the updatable object for our services isn't accurate, I recommend a TAC case: https://help.checkpoint.com