Recent Posts

This is not a feature we have in the current mainstream product. That said, it is something we've provided through customer-specific patches (built against specific code release/hotfix levels). I recommend engaging with your Check Point SE for further details. 

Instead of adding all those urls/IP lists Microsoft issues, just use the predefined Application to allow Office365.

how did you attach the license to the gateway? Did you use the VSEC licensing Util?

Thank you again, that's right, I did not look at which routes are going to the control interface and it's logical that anti-spoofing thinks it's wrong.

We are going to move the rulebase decision to a later point in the connection when we are able to send the SNI and then cache would be including “verified” SNI. This should allow us to work with SNI in a secure manner. 

It depends on the version you're running and your exact configuration.   In R77.30, for instance, the traffic would have to pass a firewall rule before App Control even applies. As such, you'd see two different entries in the logs.   In R80.10, it depends on what your rulebase looks like and how you're using layers in your policy, but you…

The "Services" column is hidden in the R77.30 App Control rulebase but can be shown by right-clicking on the section headings in the rule and selecting Service. Now you can restrict the ports for any App Control rule, if you desire.

Please note that the Public EA is intended for lab use.  Using it in production is not recommended as there may not be official support to get up to GA code.