topic Malicious IP Blocking in Firewall and Security Management

Malicious IP Blocking

kweiwing_neng — Tue, 30 Aug 2022 09:19:17 GMT

Dear Expert,

Would like to to enquire if there is a solution to push a policy where it will automatically update the list of malicious IPs to be blocked.

Have read the following article: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154

But it does not instruct on if there is a way to automatically update the list of malicious IP addresses.

Many thanks.

Best Regards,

Re: Malicious IP Blocking

_Val_ — Tue, 30 Aug 2022 09:36:50 GMT

The mentioned SK is old, and we have a better way of doing the same, through a custom IOC feed feature. Please look into sk132193. As part of the functionality, you can control how often the feed is pulled/pushed.

Re: Malicious IP Blocking

PhoneBoy — Tue, 30 Aug 2022 12:42:03 GMT

Depending on version of code, you have a few options for creating a list of IPs to block that you can update at will:

1. ioc_feeds (uses AV and/or AB blade)

2. Updating either a Threat Prevention or Access Policy via API (requires policy push).

3. Generic Datacenter object (R81+) — access policy

4. Network feed object (R81.20+) — access policy

Re: Malicious IP Blocking

Sergei_Shir — Sun, 11 Sep 2022 11:07:32 GMT

sk103154 - How to block traffic coming from known malicious IP addresses was updated by R&D and QA teams.

This SK applies to:

R80.30, R80.40 versions, without Anti-Virus or Anti-Bot
R77.x, R80.10, and R80.20 versions, with and without Anti-Virus or Anti-Bot