> Source: [sk20004](https://support.checkpoint.com/results/sk/sk20004)

# sk20004 - "Reverse DNS request failed. See Secure Knowledge entry sk20004." reject log in SmartView Tracker for HTTP connection

| Property | Value |
|----------|-------|
| Solution ID | sk20004 |
| Date Created | 2003-05-20 |
| Last Modified | 2017-03-22 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- Connection to an HTTP web site is blocked with "Access denied" message in web browser and with the following reject log in SmartView Tracker:

```

Resource: http://X.X.X.X
Reason: 
	Web security: Reverse DNS request failed.
	See Secure Knowledge entry sk20004.
```

## Cause

When using a URI Resource or URL Filtering, the Security Gateway must find out the URL of every web site in order to match it against its URI / URL Filtering rule base.

When connecting to a certain web site by its IP address, the Security Gateway performs Reverse DNS in order to find the web site's URL.

If the Reverse DNS failed (e.g., there was no reply), the Security Gateway drops the connections as it cannot match it to the rulebase  
(for example, querying for URL *www.hotmail.com* returns IP 207.68.171.233, while querying for the same IP 207.68.171.233 returns URL *ld.cb.msn.com*).

## Solution

**Note:** URI resource objects are considered a legacy feature. It is strongly recommended to use [Application Control](https://www.checkpoint.com/products/application-control-software-blade/) and [URL Filtering](https://www.checkpoint.com/products/url-filtering-software-blade/) blades.

Action plan:

1. Add a Domain entry of the problematic web site to the relevant DNS server (that is configured on the Security Gateway), so that the Reverse DNS will return the expected URL.

2. Enable the global property ***http_match_with_host_header***:

   **Note:** Enabling this property allows the HTTP Security Server on the Security Gateway to examine the HTTP header in order to determine the domain name. However, some web sites return an IP address in the HTTP header instead of a domain name. Since the HTTP Security Server is unable to determine the domain name to compare against the filter, the request is dropped. To resolve this behavior, configure a manual host entry for these web sites on the Security Gateway / each cluster member (in the */etc/hosts* file).
   1. Collect complete backup of Security Management Server / Domain Management Server.

   2. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.).

      Verify by running the "*cpstat mg* " command on Security Management Server / in the context of *each* Domain Management Server.
   3. Connect with [GuiDBedit Tool](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk13009) to Security Management Server / Domain Management Server.

   4. In the upper left pane, go to ***Table*** - ***Global Properties*** - ***properties***.

   5. In the upper right pane, select the ***firewall_properties***.

   6. Press CTRL+F (or go to ***Search*** menu - ***Find*** ) - paste ***http_match_with_host_header*** - click on ***Find Next***.

   7. In the lower pane, right-click on the ***http_match_with_host_header*** - select ***Edit...*** - select "***true*** " - click on ***OK***.

      *Example* :  
      [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk20004/GuiDBedit_Tool.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk20004/GuiDBedit_Tool.png "Click the image to see it in full size in a new tab/window")
   8. Save the changes: go to ***File*** menu - click on ***Save All***.

   9. Close the GuiDBedit Tool.

   10. Connect with SmartDashboard to Security Management Server / Domain Management Server.

   11. Install the policy onto the relevant Security Gateway / Cluster object.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content