When URL category is not found in the kernel cache, what action will GW do?

The CheckPoint Security Gateway employs a multi-layered caching architecture for URL Filtering to optimize performance. The initial, fastest lookup occurs in the kernel cache. If a URL's category is not found in the kernel (a cache miss), the request is passed up to the user-space daemon responsible for Application Control and URL Filtering, which is the Resource Advisor Daemon (RAD). The RAD process then forwards a query to the CheckPoint cloud service to retrieve the correct categorization. Once obtained, the result is used for the policy decision and is also populated into the caches to accelerate future lookups for the same URL.

B. Cache updates are dynamic and occur in near real-time upon a cache miss, not just during the next policy installation, which would be far too slow.
C. RAD is a user-space process. The kernel handles fast-path processing and cache lookups; it does not directly communicate with the cloud but instead passes requests to user-space daemons.
D. While CMI (Content Management Interface) is part of the overall Content Awareness architecture, the RAD daemon is the specific component that handles the cloud lookup for URL categorization.

1. Check Point Support Center, SK92224 - ATRG: Application Control and URL Filtering (URLF): This article identifies the rad process as the "main process for Application Control & URL Filtering" and describes its function in communicating with Check Point servers for updates and categorization.

2. Check Point Support Center, SK64281 - How to debug the 'rad' daemon: This document explicitly states, "The RAD (Resource Advisor) is the main user-mode process of the Application Control and URL Filtering blades." This confirms RAD operates in user space, not kernel space.

3. Check Point R81.10 Security Gateway Architecture Overview, Page 12, "User Space Daemons": This document outlines the architecture where kernel modules handle fast-path operations and pass exceptions or complex tasks (like a cache miss requiring a cloud lookup) to specific user-space daemons. The rad daemon is listed as the handler for Application Control & URL Filtering.