topic Re: How to configure external dynamic lists in Checkpoint in Firewall and Security Management

How to configure external dynamic lists in Checkpoint

Prime — Wed, 08 Jul 2020 11:03:29 GMT

need to configure external dynamic lists in Checkpoint

Re: How to configure external dynamic lists in Checkpoint

_Val_ — Wed, 08 Jul 2020 12:12:19 GMT

Please elaborate, it is unclear what you are trying to achieve.

Re: How to configure external dynamic lists in Checkpoint

Prime — Wed, 08 Jul 2020 12:26:11 GMT

Currently we are using the Palo Alto firewall for dynamic list however as per Palo Alto there is no way to extend the limit of 50000 IPs in the Palo Alto Firewall so the alternative is to block on the core Checkpoint firewall.
These are public IPs that will be blocked.

Version-R80.10 HOTFIX_R80_10_JUMBO_HF Take: 151

Re: How to configure external dynamic lists in Checkpoint

_Val_ — Wed, 08 Jul 2020 12:34:39 GMT

Ok, that's clear enough. So you have a list of IP addresses, and you want to block them on your FWs.

You can use the notion of a dynamic object, explained here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=skI1915

Dynamic object is basically an empty logical box that can be used in the rules and should be filled with IP addresses on the GW side. Mind, you will need to script the population of the dynamic object in use with GW side scripting.

Another option is to use MGMT API and fill in a certain group on the management side, but every time the list is changed, you will have to re-push policy on GWs.

Re: How to configure external dynamic lists in Checkpoint

Prime — Tue, 14 Jul 2020 08:49:22 GMT

In the link you provided it says that “A Dynamic Object is a "logical" object that will be resolved to an IP address differently on each Security Gateway using the dynamic_objects command. A rule that uses this Dynamic Object will then be enforced on each Security Gateway on different objects.”

I think there is some misunderstanding in the requirement.

Re: How to configure external dynamic lists in Checkpoint

Ruan_Kotze — Tue, 14 Jul 2020 08:58:07 GMT

Have a look at sk132193 - it describes how to subscribe a gateway to a Custom Intelligence Feed. Sounds like that might be a better match for your requirements?

Thanks,
Ruan

Re: How to configure external dynamic lists in Checkpoint

_Val_ — Tue, 14 Jul 2020 09:06:38 GMT

It does not have to be resolved to _different_ IPs on _different_ GWs. It is up to you to decide how you populate your Dynamic Object

Re: How to configure external dynamic lists in Checkpoint

_Val_ — Tue, 14 Jul 2020 09:48:52 GMT

That is also an option

Re: How to configure external dynamic lists in Checkpoint

Prime — Wed, 15 Jul 2020 09:14:27 GMT

The below article also mentions blocking of IP addresses on Checkpoint and is for the OS version we have. Please check.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154

Re: How to configure external dynamic lists in Checkpoint

_Val_ — Wed, 15 Jul 2020 10:00:37 GMT

Not exactly sure what you expect me to check here.

Re: How to configure external dynamic lists in Checkpoint

PhoneBoy — Sat, 18 Jul 2020 23:27:06 GMT

There are several ways to do this with some assembly required.
This older thread is still applicable and discusses several options: https://community.checkpoint.com/t5/Policy-Management/list-of-different-IP-addresses-to-be-blocked/m-p/24022

In R81, we should also have custom Updatable Objects that can be fed from your own JSON file.

Re: How to configure external dynamic lists in Checkpoint

Emil_T — Thu, 19 Jun 2025 00:10:55 GMT

This SK no longer exists