> Source: [sk113084](https://support.checkpoint.com/results/sk/sk113084)

# sk113084 - HTTP traffic outage every 24 hours on VSX Gateway / VSX Cluster with enabled Anti-Virus and Anti-Bot blades

| Property | Value |
|----------|-------|
| Solution ID | sk113084 |
| Date Created | 2016-08-30 |
| Last Modified | 2018-05-21 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * HTTP traffic outage every 24 hours on VSX Gateway / VSX Cluster.  

  HTTPS traffic is not affected.

* Debug of RAD daemon (per [sk92743](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92743)) during the issue shows:  

  `rad_kernel_api_check_service_status: service is down`

* Manual restart of RAD daemon (`rad_admin stop;rad_admin start`) during the issue does not help.

* The following workarounds in SmartDashboard resolve the issue for 24 hours only:

  * Workaround #1:

    1. Go to "`Threat Prevention`" tab - in the left tree, expand "`Advanced`" - click on "`Engine Settings`"
    2. In the "`Check Point Online Web Service`" section, *clear* the box "`Block connections when the web service is unavailable`"
    3. Install policy
    4. In the "`Check Point Online Web Service`" section, *check* the box "`Block connections when the web service is unavailable`"
    5. Install policy
  * Workaround #2:

    1. Open VSX Gateway / VSX Cluster object properties
    2. Disable the Anti-Virus blade and Anti-Bot blade
    3. Install policy
    4. Open VSX Gateway / VSX Cluster object properties
    5. Enable the Anti-Virus blade and Anti-Bot blade
    6. Install policy
* Issue occurs only under the following conditions:

  1. VSX Gateway / VSX Cluster member (context of VS0) does not have direct Internet access.
  2. "`Threat Prevention`" tab - "`Advanced`" - "`Engine Settings` - section "`Check Point Online Web Service`":  
     * The box "`Block connections when the web service is unavailable`" is checked
     * Resource classification mode is set to "`Hold`" (issue does not occur in "`Background`" mode)

## Cause

RAD daemon is used to communicate with Check Point cloud and it runs only in the context of VSX Gateway / VSX Cluster member itself - context of VS0.

In some VSX internal topologies, all traffic from VSX Gateway / VSX Cluster member itself (context of VS0) to the Internet goes only through some Virtual System (other than VS0).

*For example, consider the following traffic flow*:

1. User browses to a site through VS1
2. The site is not in found in cache, so VS1 initiates a request to RAD daemon (that runs only in the context of VS0)
3. RAD daemon (in the context of VS0) sends a request to `cws.checkpoint.com`
4. The request to `cws.checkpoint.com` goes through VS1 (as all traffic originated on VS0)
5. VS1 sees the outbound traffic and tries to enforce Anti-Virus / Anti-Bot policy on it  
   (for VS1, traffic to `cws.checkpoint.com` is just another HTTP request as any traffic created by the any client).

When Anti-Virus / Anti-Bot blade works in "Prevent" mode, Steps 2-4 are in a loop until RAD daemon reports timeout and all requests to `cws.checkpoint.com` end up with failure.

When Anti-Virus / Anti-Bot blade works in "Detect" mode, Step 5 goes without interruption.

Since `cws.checkpoint.com` is stored in malware cache for 24 hours, all traffic to `cws.checkpoint.com` (Step 5) goes uninterrupted until `cws.checkpoint.com` clears out from the cache. At that point, RAD daemon does not have HTTP access anymore due to the loop created by VS0-VS1, and it ends dropped by VS1.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content