topic Question in regards to sk167210 in Firewall and Security Management

Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 17:44:17 GMT

Hey guys,

I hope someone might be able to tell me how to fix this, or if not, at least point me in right direction or what to even look for : - )

I followed sk167210 and all is fine, BUT what fails is what I try to create a rule with generic data center I created. I used below link and it does show connected, its from here:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Chassis_AdminGuide/Topics-Chassis-AG/IP-Block-Feature.htm

https://secureupdates.checkpoint.com/IP-list/TOR.txt

But when I try add it to the rule itself, below is what I get:

Any idea why? Also, to add, I cant find single log about it, haha.

Any help is always greatly appreciated 🙂

Btw, found only single community post on this with no responses and cant find much on support site about it either.

Cheers,

Andy

Re: Question in regards to sk167210

Tal_Paz-Fridman — Tue, 28 Feb 2023 18:08:44 GMT

Hi,

The best practice is to use the Custom Intelligence Feed (IoC Feed) - either from SmartConsole or CLI.

Refer to sk132193 - What is the "Custom Intelligence Feeds" feature?

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193

How it looks in R81.20 with the ability to test the feed:

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 18:05:30 GMT

Thanks @Tal_Paz-Fridman . Here is my question though...considering it shows "connected" in data center object, should it not work to import it in the rule?

Andy

Re: Question in regards to sk167210

Tal_Paz-Fridman — Tue, 28 Feb 2023 18:16:48 GMT

I think the Generic Data Center file should be in .json format.

I can check it with owners. If this is correct I'll request to add a validation for this.

Regarding the message (check log file), I'll also ask to have it improved.

Thanks

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 18:18:29 GMT

K, I think I see what you are saying. Yea, if thats the case, its odd, as I did not get any warning when I put in txt file link. Question @Tal_Paz-Fridman ...do you think there is json version of that txt link?

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 18:24:54 GMT

Btw, how did you get to that screen for testing feed connection? I have R81.20 lab

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 18:29:37 GMT

K, never mind, got it, yes, works on mine as well, so the only question is if there is json version of that txt link? If so, I think that would probably solve this.

Re: Question in regards to sk167210

PhoneBoy — Tue, 28 Feb 2023 19:20:21 GMT

That file is not in a format consumable by the Generic Data Center object, which would be JSON.
See: https://support.checkpoint.com/results/sk/sk167210

The Network Feed option in R81.20 should be able to parse this file directly.

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 19:29:58 GMT

Thanks @PhoneBoy . So just wondering, is there equivalent JSON format for the txt link I posted? If that exissts, it would most likely work...btw, any idea where I can find that option for networkf eed in R81.20? Have the smart console open, so can test it quick. Also, say if mgmt is R81.20 and lets say gateways on R81 base, would that still work?

Re: Question in regards to sk167210

PhoneBoy — Tue, 28 Feb 2023 19:37:21 GMT

The Network Feed option requires R81.20 all around.
Meanwhile, you can use this took to convert IP-TOR into a JSON file: https://community.checkpoint.com/t5/Scripts/tor2json-bash-script-to-download-TOR-file-and-save-it-in/m-p/131829#M877

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 19:49:46 GMT

Hm, cant seem to find script there, k, may have to check later.

Re: Question in regards to sk167210

the_rock — Tue, 28 Feb 2023 20:46:57 GMT

K, did conversion, shows connected in data center object, but still cant import it, exact same error. This is all R81.20

Re: Question in regards to sk167210

Sorin_Gogean — Wed, 01 Mar 2023 06:56:28 GMT

Hello @the_rock ,

Like we talked in other occasions, we're using Generic DataCenter Objects, and for that we've adapted the script from (https://github.com/HGrigorov/checkpoint) and we added some extra functions on it.

That script collects IP's from those 6 lists and builds a JSON that contains all that data (I've attached the JSON for reference so you can have a look).

# Text for <name> field in JSON file

NAME[1]="TOR_Exit_Nodes"

NAME[2]="TOR_IPBlacklist_Nodes"

NAME[3]="OpenDBL_TOR_Exit_Nodes"

NAME[4]="OpenDBL_TALOS_Nodes"

NAME[5]="OpenDBL_EmergThreats_Nodes"

NAME[6]="OpenDL_Bruteforce_Nodes"

# Download URL

#TOR_URL="https://check.torproject.org/torbulkexitlist"

TOR_URL[1]="https://secureupdates.checkpoint.com/IP-list/TOR.txt"

TOR_URL[2]="https://secureupdates.checkpoint.com/IP-list/IP-blacklist.txt"

TOR_URL[3]="http://www.opendbl.net/lists/tor-exit.list"

TOR_URL[4]="http://www.opendbl.net/lists/talos.list"

TOR_URL[5]="http://www.opendbl.net/lists/etknown.list"

TOR_URL[6]="http://www.opendbl.net/lists/bruteforce.list"

If you have questions, let me know.

Thank you,

PS: Indeed I could have used IoC Feeds, but I wanted a graphical solution, that would be easier to use . I'll go back and have a look 😊 .

(I remember why I didn't use IoC, because it's used only by AntiBot blades, and we wanted to use in Firewall rules...)

Maybe in the next version upgrade (as we're with R81) we will move to R81.20 and start using Network Feed .

Re: Question in regards to sk167210

_Val_ — Wed, 01 Mar 2023 08:14:44 GMT

The format for Generic Datacenter Object has to be json, not txt. I am pretty sure it is the reason of your issue. If you want to use plain txt files, use custom feeds. where the list is properly parsed, as @Tal_Paz-Fridman already mentioned.

The TOR list is not in json format

Re: Question in regards to sk167210

G_W_Albrecht — Wed, 01 Mar 2023 08:28:27 GMT

Convert it as shown here: https://community.checkpoint.com/t5/Scripts/tor2json-bash-script-to-download-TOR-file-and-save-it-in/m-p/131829#M877

Re: Question in regards to sk167210

G_W_Albrecht — Wed, 01 Mar 2023 09:00:24 GMT

I even did the conversion for you...

Re: Question in regards to sk167210

the_rock — Wed, 01 Mar 2023 10:44:37 GMT

Thanks so much, will try later! Would you mind send the process how you did it, just curious? I followed the same yesterday, but still failed, so clearly I did it wrong.

Re: Question in regards to sk167210

the_rock — Wed, 01 Mar 2023 11:02:25 GMT

Thanks Val, yes, thats correct.

Re: Question in regards to sk167210

the_rock — Wed, 01 Mar 2023 13:48:43 GMT

Hey Guenther,

I just had teams meeting with @Sorin_Gogean and he showed me exactly how this worked, I learned a lot actually. He confirmed that because there is an issue with parsing ipv6 addresses, file you gave could not be imported. Once we used file he provided (no ipv6, all worked fine).

What Im doing now is enabling ipv6 on both my mgmt and gateway and rebooting, so once thats done, will try file you gave and one I converted yesterday and see if it works and update.

Cheers and thanks again so much @Sorin_Gogean , very grateful for all you showed me 🙌🙌🙌

Andy

Re: Question in regards to sk167210

the_rock — Wed, 01 Mar 2023 14:17:30 GMT

Just to update on this further, even after enabling ipv6 on both mgmt and gateway (R81.20 lab), still cant import generic data center object, so there is definitely something preventing it. As soon as I remove ipv6 addresses as @Sorin_Gogean showed me, works like a charm.

By the way, for anyone trying to do this, if any issues, as Sorin pointed out, please do below search in the logs (not indicated in the sk)

blade:"CloudGuard IaaS"

THANKS SO MUCH @Sorin_Gogean