topic Re: SandBlast limitations in Firewall and Security Management

SandBlast limitations

Hllrdm — Tue, 16 Nov 2021 11:44:44 GMT

Hello!

We want to check all files on the file storage using the TE 1000X. Is there any information on how to configure the TE1000X to check all new files on the file share?

We are also interested in the technical details of how the TE1000X works. For example, the well-known 100MB file size limit. Are there any other limitations? And where can we find these limitations documented?

Re: SandBlast limitations

PhoneBoy — Tue, 16 Nov 2021 19:16:46 GMT

The TE1000X does not reach out and scan file shares, or anything else for that matter, it only emulates files sent to it either from another Check Point gateway or received through an API.
It is managed similar to other Check Point gateways.

Re: SandBlast limitations

Hllrdm — Wed, 17 Nov 2021 06:06:33 GMT

Hello!

Here we need to emulate files that are sent or received in the organization through the Security Gateway. Are there any limitations for these files and for the TE1000X itself?

Re: SandBlast limitations

PhoneBoy — Wed, 17 Nov 2021 15:13:15 GMT

It has to be one of the supported types and, yes, the you are limited to 100mb file size.
Note the default is less than that (15mb) and you'll need to configure the limit appropriately.

Re: SandBlast limitations

Hllrdm — Wed, 17 Nov 2021 15:16:47 GMT

Are there any other restrictions besides 100 MB? Could you also clarify where the 100 MB limit is configured?

Re: SandBlast limitations

PhoneBoy — Wed, 17 Nov 2021 15:33:25 GMT

There's a table highlighting difference between local and cloud emulation here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114806&partition=Advanced&product=Threat#Limitations%20and%20current%20design

The exact location to configure the file size limit will depend on the version of code you're running on your management.
For R81.10: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/Topics-TPG/Configuring_Advanced_Threat_Emulation_Settings.htm?Highlight=limit

Re: SandBlast limitations

Hllrdm — Wed, 17 Nov 2021 18:09:30 GMT

So I understand correctly that there are no restrictions and features in SandBlast other than 100MB?

Re: SandBlast limitations

PhoneBoy — Wed, 17 Nov 2021 18:39:13 GMT

Any limitations should be mentioned in the documentation I provided previously.
What precise limitations are you concerned about?

Re: SandBlast limitations

Hllrdm — Wed, 17 Nov 2021 18:51:03 GMT

I'm interested in all the constraints. I don't see all the explicit limitations in the documentation. Can you tell me in which section I should look for restrictions?

Re: SandBlast limitations

PhoneBoy — Wed, 17 Nov 2021 20:00:50 GMT

I don't think there's a specific section of the documentation that says "limitations."
Best to fully read the documentation to understand how the solution is deployed.

Re: SandBlast limitations

Hllrdm — Thu, 18 Nov 2021 04:22:30 GMT

Therefore, I started this topic, since the documentation does not say about the limitations in SandBlast. Even the 100 MB limit is clearly not written. Can you have information from personal experience?

Re: SandBlast limitations

PhoneBoy — Thu, 18 Nov 2021 22:47:29 GMT

Limitations are somewhat "point of view" dependent and I don't think every vendor lists them all.
We do provide our partners some competitive materials that compare our Threat Emulation to other similar solutions, which might give you a better idea.