topic Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall? in Firewall and Security Management

Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

MTS — Wed, 30 Mar 2022 13:33:37 GMT

Hello,

I am trying to enhance the CheckPoint policy security level.

And I am looking for a dynamic list from a great Security Vendor that can be applied to a Firewall policy to protect users from malicious IP addresses.

I find that PaloAlto is using an object named External Dynamic Lists, and it also provides

"Palo Alto Networks Known Malicious IP Addresses"

"Palo Alto Networks High-Risk IP Addresses"

as objects to allow IT admin to apply them to a Firewall policy for blocking/blacklist purposes.

I wonder if CheckPoint also provides the same great objects there.

Thank you!

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

Juan_ — Wed, 30 Mar 2022 13:42:41 GMT

Not sure if checkpoint provides it's own list, but what you can configure are intelligence feeds through the threat prevention feature Threat Indicators

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

delToro1 — Wed, 30 Mar 2022 17:15:13 GMT

Hello, you can import IOCs list from SmartConsole or CLI. I found a whitepaper in this community and maybe may be util for you.

https://community.checkpoint.com/t5/General-Topics/White-Paper-Importing-Custom-IOC-s-in-SmartConsole-R80-20/m-p/53323/thread-id/10628

https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/ips-av-ab/1377/1/Integrating%20Custom%20IOC%20Feeds.pdf

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

Martin_Raska — Thu, 31 Mar 2022 09:45:21 GMT

Under application control just use categories as Critical and High risk, Spam, Spyware & Malicious and you don't need to deal with IP blacklist.

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

G_W_Albrecht — Thu, 31 Mar 2022 09:51:51 GMT

Much more, but in a different way: IP addresses are usually evaluated by TP in ThreatCloud (much better than a list); Dynamic / Updateable Objects can use customer-created IP lists, see Can we create custom updatable objects in R80.20

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

Tal_Paz-Fridman — Thu, 31 Mar 2022 11:53:00 GMT

R81.20 - currently in EA - might have what you're asking for:

https://community.checkpoint.com/t5/Product-Announcements/R81-20-EA-Program-Production/ba-p/135926

Enhancing the gold standard in Security Management: Quantum R81.20 lets you leverage the new Management API to integrate security from the ground up and efficiently manage access policies with support for dynamic policy objects taken from external sources.

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

Iain_K — Fri, 17 May 2024 02:02:29 GMT

Yes. External Network Feeds. https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm?TocPath=_____17

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

the_rock — Fri, 17 May 2024 02:04:20 GMT

You got it! Best part is, no need to have AV or AB blades enabled to use network feeds.

I made post about it.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Network-feed/m-p/212407#M40317

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

Duane_Toler — Fri, 17 May 2024 15:28:00 GMT

R81+ now includes a "Generic Data Center" that you populate with a JSON file of IPs/networks. You can update this object via management API and Ansible.

https://support.checkpoint.com/results/sk/sk167210

Management API: https://sc1.checkpoint.com/documents/latest/APIs/#cli/add-data-center-object~v1.7%20

Ansible: cp_mgmt_add_data_center_object module

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

the_rock — Sat, 18 May 2024 01:28:12 GMT

Great suggestion.

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

NetworkNerd16 — Thu, 26 Sep 2024 13:20:52 GMT

What are the replies to this? I want to know too. This is the screen I see

Re: Is there anything like PaloAlto's "External Dynamic Lists" on CheckPoint's Firewall?

_Val_ — Thu, 26 Sep 2024 14:14:36 GMT

Your screenshot does not seem to be related to this discussion. Reach out to me directly via a PM, please