topic Re: Updateable objects for Check Point Cloud Services in Firewall and Security Management

Updateable objects for Check Point Cloud Services

Norbert_Bohusch — Thu, 06 May 2021 06:30:59 GMT

During two PoCs/implementations in the last month, I implemented Harmony Endpoint with cloud-based management for a customer.

Both times the customer didn't want to allow full access to the internet for his clients (or at least the servers using EPS), so we followed sk116590

In my opinion the infrastructure is there, so please publish the domains from this SK also as an updatable object.

There might be other use cases for URLs a gateway or other Check Point services may need, so a general approach would be nice, for sure.

Re: Updateable objects for Check Point Cloud Services

PhoneBoy — Fri, 07 May 2021 00:13:53 GMT

Believe this is in the works and should be available in the near future.

Re: Updateable objects for Check Point Cloud Services

PhoneBoy — Fri, 28 May 2021 06:05:51 GMT

As of today, this is now available.
Thanks to @Micky_Michaeli and team!
It's not showing in Demo Mode, but it does show on my regular management server:

The list of domains covered by this object is here: https://secureupdates.checkpoint.com/cp_services/V1_0_0/gw/cp_services_uo

Re: Updateable objects for Check Point Cloud Services

Norbert_Bohusch — Fri, 28 May 2021 06:21:01 GMT

Perfect! Thanks 😀

The description could be a bit clearer though.

E.g. for which cloud services the domains of Check Point are included:

- Updates for gateways with NGTX is included? I assume yes

- Updates/Mgmt for Harmony Endpoint is included? I assume yes

- Harmony Connect gateways are not included, as they are with FQDN <company-id>.cgcvpn.checkpoint.cloud

- what else am I missing?

Re: Updateable objects for Check Point Cloud Services

David_C1 — Thu, 03 Jun 2021 16:39:12 GMT

This is great, I remember asking for this two years ago at CPX. However, it would be great if the Check Point Services object were broken down into sub-services, e.g. services/domains needed for endpoints, licensing, IPS updates, etc. We don't need or want to give every device running Check Point software access to every Check Point domain.

Dave