> Source: [sk116590](https://support.checkpoint.com/results/sk/sk116590) # sk116590 - Endpoint Security Cloud Client Connectivity Requirements | Property | Value | |----------|-------| | Solution ID | sk116590 | | Date Created | 2017-03-28 | | Last Modified | 2026-10-02 | | Technical Level | General | | Products | Endpoint Security | | Versions | Cloud | ## Solution ### Introduction Endpoint Security requires access to the Internet (either directly, or via configured proxy). The table below lists the relevant connectivity requirements for each blade, as well as how to test it in order to verify the connectivity. **Notes:** * Authenticated proxies which require username and password are not supported. * The [CheckConnectivity.exe](https://support.checkpoint.com/results/download/137956) tool helps to determine that all the online services which are required by the Endpoint client are accessible. Note that the tool won't run on machines with Endpoint client already installed. On machines with Endpoint client installed, run the tool from *C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\Endpoint Common\\bin\\CheckConnectivity.exe*. ### Windows Client URLs Show / Hide this section
{#Infrastructure}{#Infrastructure}{#Infrastructure}{#Infrastructure}{#Infrastructure}{#Infrastructure} |-------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------| | **#** | **Hostname** | **Protocol** | **Used For (Version)** | **Verifying Connectivity (Run command listed below. You will get a response if connectivity is OK)** | | General ||||| | 1 | \*.epmgmt.checkpoint.com See comment 1 below | https | * Client-Server communication * Load Balancing and Failover Routing purposes * Exporting log to SIEM solutions * Patch management feature in clients * During HEP upgrades Source of files * Server Profiles Feature * Forensic reports upload * Updates for endpoint * Application Control | | | 2 | dl3.checkpoint.com See comment 2 below | http https | SBA Signature updates | `curl_cli [--proxy ] -v -k dl3.checkpoint.com` | | 3 | gwevents.checkpoint.com | https | Statistics collection | `curl_cli [--proxy ] -v -k gwevents.checkpoint.com` | | 4 | ftp-proxy.checkpoint.com | https | Uploading CPInfo | | | 5 | updates.checkpoint.com | https | SBA Signature updates | `curl_cli [--proxy ] -v -k updates.checkpoint.com` | | 6 | sc1.checkpoint.com | http https | * Retrieve URL for bot detection server * Retrieve Firefox Browser Extension and Browser Extension feature flags | `curl_cli [--proxy ] -v -k` | | 7 | \*.iaas.checkpoint.com See comment 3 below | https | * File reputation service (Horizon IOC) * URL reputation service (Horizon IOC) * Malware service (Horizon IOC) * Interaction with Threat Emulation cloud | | | 8 | cloudinfra-gw.portal.checkpoint.com | https | * JWT generation for Threat Hunting * DLP * JWT generation for Zero Phishing * JWT generation for DLP * JWT generation for EDR | | | Anti-Bot and URL Filtering ||||| | 9 | cws.checkpoint.com | https | Anti-Bot URL reputation | curl -v http://cws.checkpoint.com/Malware/SystemStatus/type/short | | 10 | secureupdates.checkpoint.com | http | Signatures database updates | `curl_cli [--proxy ] -v -k` | | Anti-Malware E2 (US-DHS and EU compliant) ||||| | 11 | s.sophosxl.net | dns | Live Protection | | | Anti-Ransomware, Behavioral Guard and Forensics ||||| | 12 | Show / Hide this section > All regions: > * us-east4-chkp-gcp-rnd-threat-hunt-box.cloudfunctions.net > * datatube-prod.azurewebsites.net > * \*.datatube.checkpoint.com > ASIASOUTHEAST > * datatubev2prodsoutheasta.blob.core.windows.net > * datatubeprodsoutheastasi.blob.core.windows.net > * ci-gw.sg.portal.checkpoint.com > AUSTRALIAEAST > * datatubev2prodaustraliae.blob.core.windows.net > * datatubeprodaustraliaeas.blob.core.windows.net > * ci-gw.ap.portal.checkpoint.com > CANADACENTRAL > * datatubev2prodcanadacent.blob.core.windows.net > * datatubeprodcanadacentra.blob.core.windows.net > * ci-gw.ca.portal.checkpoint.com > EUROPEWEST > * dtwesteuropeprod1.blob.core.windows.net > * dtwesteuropeprod2.blob.core.windows.net > * dtwesteuropeprod3.blob.core.windows.net > * datatubeprodwesteurope.blob.core.windows.net > * ci-gw.portal.checkpoint.com > INDIACENTRAL > * datatubev2prodcentralind.blob.core.windows.net > * datatubeprodcentralindia.blob.core.windows.net > * ci-gw.in.portal.checkpoint.com > UAENORTH > * uae-prod-gcp-contractprovider-351428083181.me-central1.run.app > * dtuaenorthprod.blob.core.windows.net > * ci-gw.ae.portal.checkpoint.com > UKWEST > * datatubev2produkwest.blob.core.windows.net > * datatubeprodukwest.blob.core.windows.net > * ci-gw.uk.portal.checkpoint.com > USEAST > * dteastus2prod1.blob.core.windows.net > * dteastus2prod2.blob.core.windows.net > * dteastus2prod3.blob.core.windows.net > * datatubeprodeastus2.blob.core.windows.net > * ci-gw-us.portal.checkpoint.com See comment 4 below | https | Threat Hunting data upload | | | Threat Emulation ||||| | 13 | rep.checkpoint.com | https | ThreatCloud File Reputation service | | | Browser Extension ||||| | 14 | web-rep.checkpoint.com | https | Zero Phishing | | | 15 | [microsoftedge.microsoft.com](https://microsoftedge.microsoft.com/) [edge.microsoft.com](https://edge.microsoft.com/) | https | Microsoft Store | | | 16 | [clients2.googleusercontent.com](https://clients2.googleusercontent.com/) [clients2.google.com](https://clients2.google.com/) | https | Google services | |
### macOS Client URLs Show / Hide this section {#Infrastructure}{#Infrastructure}{#Infrastructure}{#Infrastructure}{#Infrastructure} |-------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **#** | **Hostname** | **Protocol** | **Used For (Version)** | **Verifying Connectivity (Run command listed below. You will get a response if connectivity is OK)** | | General ||||| | 1 | \*.epmgmt.checkpoint.com See comment 1 below | https | * Client-Server communication * Load Balancing and Failover Routing purposes * Offline reputation updates * Forensic reports upload * Anti-Malware engine and signature updates * Uploading CPInfo | | | 2 | gwevents.checkpoint.com | https | Statistics collection | `curl_cli [--proxy ] -v -k gwevents.checkpoint.com` | | 3 | rep.checkpoint.com | https | ThreatCloud File Reputation service | | | 4 | \*.iaas.checkpoint.com See comment 3 below | https | * File reputation service (Horizon IOC) * URL reputation service (Horizon IOC) * Malware service (Horizon IOC) * Interaction with Threat Emulation cloud | | | 5 | cloudinfra-gw.portal.checkpoint.com | https | * JWT generation for Threat Hunting * DLP * JWT generation for Zero Phishing * JWT generation for DLP * JWT generation for EDR | | | Anti-Bot and URL Filtering ||||| | 6 | cws.checkpoint.com | https | Anti-Bot URL reputation | curl -v http://cws.checkpoint.com/Malware/SystemStatus/type/short | | Anti-Malware ||||| | 7 | s.sophosxl.net | dns | Live Protection | nslookup -q=txt 3.1o19sr00npoo0416p3749589rq30n2n4n910n472s0231rrsq9no4453920p4po.ssrp3r741pr36393648s2r746nq062qqps480p3s0634o321o3onp9535o1nqrn.r51n42qo929pns005o3pp76q6qpnr344r79q7rpns970o957.q485ps774n160o80qpp046p53on3np2s7q787or4.i.01.s.sophosxl.net | | Anti-Ransomware and Forensics ||||| | 8 | Show / Hide this section > All regions: > * us-east4-chkp-gcp-rnd-threat-hunt-box.cloudfunctions.net > * datatube-prod.azurewebsites.net > * \*.datatube.checkpoint.com > ASIASOUTHEAST > * datatubev2prodsoutheasta.blob.core.windows.net > * datatubeprodsoutheastasi.blob.core.windows.net > * ci-gw.sg.portal.checkpoint.com > AUSTRALIAEAST > * datatubev2prodaustraliae.blob.core.windows.net > * datatubeprodaustraliaeas.blob.core.windows.net > * ci-gw.ap.portal.checkpoint.com > CANADACENTRAL > * datatubev2prodcanadacent.blob.core.windows.net > * datatubeprodcanadacentra.blob.core.windows.net > * ci-gw.ca.portal.checkpoint.com > EUROPEWEST > * dtwesteuropeprod1.blob.core.windows.net > * dtwesteuropeprod2.blob.core.windows.net > * dtwesteuropeprod3.blob.core.windows.net > * datatubeprodwesteurope.blob.core.windows.net > * ci-gw.portal.checkpoint.com > INDIACENTRAL > * datatubev2prodcentralind.blob.core.windows.net > * datatubeprodcentralindia.blob.core.windows.net > * ci-gw.in.portal.checkpoint.com > UAENORTH > * uae-prod-gcp-contractprovider-351428083181.me-central1.run.app > * dtuaenorthprod.blob.core.windows.net > * ci-gw.ae.portal.checkpoint.com > UKWEST > * datatubev2produkwest.blob.core.windows.net > * datatubeprodukwest.blob.core.windows.net > * ci-gw.uk.portal.checkpoint.com > USEAST > * dteastus2prod1.blob.core.windows.net > * dteastus2prod2.blob.core.windows.net > * dteastus2prod3.blob.core.windows.net > * datatubeprodeastus2.blob.core.windows.net > * ci-gw-us.portal.checkpoint.com See comment 4 below | https | Threat Hunting data upload | | | Browser Extension ||||| | 9 | sc1.checkpoint.com | https | Retrieve Firefox Browser Extension and Browser Extension feature flags | `curl_cli [--proxy ] -v -k` | | 10 | web-rep.checkpoint.com | https | Zero Phishing | | | 11 | [microsoftedge.microsoft.com](https://microsoftedge.microsoft.com/) [edge.microsoft.com](https://edge.microsoft.com/) | https | Microsoft Store | | | 12 | [clients2.googleusercontent.com](https://clients2.googleusercontent.com/) [clients2.google.com](https://clients2.google.com/) | https | Google services | |
### Linux Client URLs Show / Hide this section |-------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------| | **#** | **Hostname** | **Protocol** | **Used For (Version)** | **Verifying Connectivity (Run command listed below. You will get a response if connectivity is OK)** | | 1 | \*.epmgmt.checkpoint.com See comment 1 below | https | * Client-Server communication * Load Balancing and Failover Routing purposes * Exporting log to SIEM solutions * During HEP upgrades Source of files | | | 2 | \*.iaas.checkpoint.com | https | Threat Hunting authorization | | | 3 | gwevents.checkpoint.com | https | Statistics collection | `curl_cli [--proxy ] -v -k gwevents.checkpoint.com` | | 4 | rep.checkpoint.com | https | ThreatCloud File Reputation service | | | 5 | secureupdates.checkpoint.com | http | * Packages download * Signatures database updates | `curl_cli [--proxy ] -v -k` | | 6 | teadv.checkpoint.com | https | Anti-Malware engine and signature updates | `curl_cli -v -k http://teadv.checkpoint.com/epupdates/86.50/0190/v1.xml` | | 7 | Show / Hide this section > All regions: > * us-east4-chkp-gcp-rnd-threat-hunt-box.cloudfunctions.net > * datatube-prod.azurewebsites.net > * \*.datatube.checkpoint.com > ASIASOUTHEAST > * datatubev2prodsoutheasta.blob.core.windows.net > * datatubeprodsoutheastasi.blob.core.windows.net > * ci-gw.sg.portal.checkpoint.com > AUSTRALIAEAST > * datatubev2prodaustraliae.blob.core.windows.net > * datatubeprodaustraliaeas.blob.core.windows.net > * ci-gw.ap.portal.checkpoint.com > CANADACENTRAL > * datatubev2prodcanadacent.blob.core.windows.net > * datatubeprodcanadacentra.blob.core.windows.net > * ci-gw.ca.portal.checkpoint.com > EUROPEWEST > * dtwesteuropeprod1.blob.core.windows.net > * dtwesteuropeprod2.blob.core.windows.net > * dtwesteuropeprod3.blob.core.windows.net > * datatubeprodwesteurope.blob.core.windows.net > * ci-gw.portal.checkpoint.com > INDIACENTRAL > * datatubev2prodcentralind.blob.core.windows.net > * datatubeprodcentralindia.blob.core.windows.net > * ci-gw.in.portal.checkpoint.com > UAENORTH > * uae-prod-gcp-contractprovider-351428083181.me-central1.run.app > * dtuaenorthprod.blob.core.windows.net > * ci-gw.ae.portal.checkpoint.com > UKWEST > * datatubev2produkwest.blob.core.windows.net > * datatubeprodukwest.blob.core.windows.net > * ci-gw.uk.portal.checkpoint.com > USEAST > * dteastus2prod1.blob.core.windows.net > * dteastus2prod2.blob.core.windows.net > * dteastus2prod3.blob.core.windows.net > * datatubeprodeastus2.blob.core.windows.net > * ci-gw-us.portal.checkpoint.com See comment 4 below | https | Threat Hunting data upload | | | 8 | cloudinfra-gw.portal.checkpoint.com | https | JWT generation for Threat Hunting | |
### Comments Show / Hide this section 1. \*.epmgmt.checkpoint.com: * \.epmgmt.checkpoint.com For example: HEPDemo-d9e265f1-hap2.epmgmt.checkpoint.com * \ For example: HEPDemo-d9e265f1-hap21 * During HEP upgrades Source of files: endpoint-cdn.epmgmt.checkpoint.com * Server Profiles Feature: ep-repo.epmgmt.checkpoint.com * Forensic reports upload: sba-data-collection.iaas.checkpoint.com * Updates for endpoint: teadv.checkpoint.com * Application Control: teadv.checkpoint.com * US-DHS and EU compliant Anti-Malware engine and signature updates: teadv.checkpoint.com (this URL is specifically required, in addition to \*.epmgmt.checkpoint.com, for Windows versions below E88.50) * Offline reputation updates: updates.checkpoint.com * Uploading CPInfo: * ftp-proxy.checkpoint.com * services.checkpoint.com * https://cpinfo-uploaded-files-us-prod.s3.amazonaws.com 2. In China use: dl3.checkpoint.com.cn 3. \*.iaas.checkpoint.com: * File reputation service (Horizon IOC): file-rep.iaas.checkpoint.com * URL reputation service (Horizon IOC): url-rep.iaas.checkpoint.com * Malware service (Horizon IOC): threatcloud.iaas.checkpoint.com * Interaction with Threat Emulation cloud: te.iaas.checkpoint.com 4. For DT1 use: europe-west1-datatube-240519.cloudfunctions.net 5. For LogExporter use the following inbound rules: * Ap-south-1: * 13.237.215.109 * 3.25.28.241 * 3.105.14.157 * ap-south-1.allowed-ips.checkpoint.com: * 15.206.182.35 * 35.154.171.21 * Ap-southeast-2: * 13.237.215.109 * 3.25.28.241 * 3.105.14.157 * ap-southeast-2.allowed-ips.checkpoint.com: * 52.64.37.249 * 3.105.139.243 * 3.105.14.157 * Eu-west-1: * 34.248.94.75 * 54.220.66.248 * 54.228.200.90 * eu-west-1.allowed-ips.checkpoint.com: * 46.51.203.128 * 52.210.248.134 * 54.220.66.248 * Eu-west-2: * 34.248.94.75 * 54.220.66.248 * 54.228.200.90 * eu-west-2.allowed-ips.checkpoint.com: * 18.168.7.234 * 18.171.117.185 * Me-central-1: * 34.248.94.75 * 54.220.66.248 * 54.228.200.90 * me-central-1.allowed-ips.checkpoint.com: * 40.172.21.113 * 51.112.130.15 * Us-east-1: * 3.225.217.140 * 52.205.49.189 * 50.17.39.153 * us-east-1.allowed-ips.checkpoint.com: * 18.205.54.240 * 50.17.39.153 * 3.224.33.252 6. Other URLs: * FedRAMP: s3-fips-r-w.us-east-1.amazonaws.com

References * [Endpoint Security product page](https://www.checkpoint.com/harmony/advanced-endpoint-protection/) * [sk108695 - Check Point SandBlast Agent for Browsers](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108695) * [sk83520 - How to verify that Security Gateway and/or Security Management Server can access Check Point servers?](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk83520) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content