topic Re: Sandblast appliance installation in Firewall and Security Management

Sandblast appliance installation

Sagar_Manandhar — Mon, 04 Sep 2017 05:27:34 GMT

Hi,

I am trying to install Check_Point_R77.30_3000_5000_15000_23000_Sandblast_Appliances.iso clean install for the testing purpose. For this i am using the VM so what the requirement of the VM. Is there any limitations? Currently i am using the checkpoint 4400 series firewall at edge and need to integrate sandblast to the firewall.

Another question is that whether it is possible to send the traffic to the checkpoint sandblast appliance using different vendor firewall like cisco, fortinet etc.

Thank you

Sagar Manandhar

Re: Sandblast appliance installation

Nicolas_Daems — Mon, 04 Sep 2017 06:11:34 GMT

Hi,

VM is not supported for Threat Emulation. You need Intel technology to use the sandboxing

As I know it's only supported by Check Point appliances. I don't see any option to forward other type of traffic

Best regards

Re: Sandblast appliance installation

Uri_Lewitus — Tue, 05 Sep 2017 11:38:15 GMT

The list of supported HW is in the file download landing page:

This image can be used for R77.30 Gaia Clean Install using Legacy CLI on the following models:

3100, 3200 Appliances
5100 / 5400 / 5600 / 5800 / 5900 Appliances
15400 / 15600 Appliances
23500 / 23800 Appliances
TE100X / TE250X / TE1000X / TE2000X Sandblast Threat Emulation Appliances

HTH

Re: Sandblast appliance installation

PhoneBoy — Tue, 05 Sep 2017 16:23:35 GMT

Are you trying to install a Threat Emulation appliance? That cannot be installed in a VM, only on specific Check Point hardware as it requires specific Intel hardware.

If you're trying to install a regular gateway that can send files to a threat emulation appliance of ThreatCloud, you can install this in a VM.

However, the actual emulation must take place either in ThreatCloud or on a specific Check Point appliance (which cannot be installed in a VM).

For third parties sending traffic to Check Point for Threat Emulation, it can be done over ICAP, but it requires a patch.

Refer to the following SK: Check Point support for Internet Content Adaptation Protocol (ICAP) server