topic Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY in Firewall and Security Management

BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

K_montalvo — Tue, 15 Feb 2022 20:49:54 GMT

Hello experts,

Kindly guide me if its possible to have like a rule, blade or external connector or any recommended configuration in order to have protection on the Gateway perimeter to block malicious reported IP address range like botnets, hackers etc? This is with the purpose to reduce having to create objects and manually applied to specific existing block rule on the network access layer.

Thanks!

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Chris_Atkinson — Wed, 16 Feb 2022 00:28:43 GMT

ioc_feeds, available natively in R81 SmartConsole - refer sk132193.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TPG/Importing-External-Custom-Intelligence-Feeds-in-SmartConsole.htm

Other options exist depending on your enabled blades and might leverage dynamic / imported objects (sk167210) or the available APIs.

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

the_rock — Wed, 16 Feb 2022 00:21:39 GMT

Hey bro,

What I always do is use below link, get all IPs from the txt file, slap it in .csv file, import in mgmt, create a rule with group object containing the file you import and thats it.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Chassis_AdminGuide/Topics-Chassis-AG/IP-Block-Feature.htm

You can also use below sites to confirm if site might be malicious.

https://www.virustotal.com/gui/home/upload

https://www.urlvoid.com

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Magnus-Holmberg — Tue, 21 Feb 2023 13:50:23 GMT

known bad IP shouldn´t that be filtered within the IPS blade?

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Chris_Atkinson — Tue, 21 Feb 2023 14:30:11 GMT

Anti-bot & Anti-virus have such reputation based protections but if you wish to leverage external or custom feeds you need to use something else.

- ioc_feed

- Network feed objects (R81.20)

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Magnus-Holmberg — Tue, 21 Feb 2023 14:36:23 GMT

Sure but correct me out am wrong.

anti bot us for outgoing.

having a checkpoint provided ip list of bad stuff for incoming would be great, such as know bot network. Ips would be perfect for this.

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Chris_Atkinson — Tue, 21 Feb 2023 14:57:04 GMT

"perfect" is relative, some also might prefer fwaccel dos (SecureXL) level mitigation of such similar lists.

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Magnus-Holmberg — Tue, 21 Feb 2023 15:02:53 GMT

Sure, seen also from check point side as IPS is something you pay for.

I would be more than happy to have this as a regular dynamic object just as O365 to have “suspected IP ranges and DNS”

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

the_rock — Tue, 21 Feb 2023 15:11:07 GMT

so true 🙂

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

PhoneBoy — Tue, 21 Feb 2023 15:20:18 GMT

The “incoming only” block for Anti-Bot was fixed in R81.
Even in R80.40 and earlier, while an outbound packet was allowed, the inbound replies were correctly blocked.

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Magnus-Holmberg — Tue, 21 Feb 2023 19:32:12 GMT

Do you mean that Anti-Bot would block incoming attempts from known “bad” ip addresses to a web server based on these lists it has?

my understanding was been that anti-not was a post infection blade killing the C&C traffic or similar originating from the inside network to destination to C&C “bad ip”

if it dose both then it’s great 🙂
Maybe something I just misunderstood.

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

PhoneBoy — Wed, 22 Feb 2023 01:55:12 GMT

I had it reversed prior to R81: Inbound wasn't blocked, but the outbound reply was.
Either way, in R81 and above, feeds imported via ioc_feeds will be blocked inbound or outbound.
This is documented here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132193&partition=Basic&product=Anti-Virus,

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Magnus-Holmberg — Wed, 22 Feb 2023 02:13:29 GMT

How about anti bot without using custom feeds?

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

PhoneBoy — Wed, 22 Feb 2023 02:17:58 GMT

On ThreatCloud feeds, I don't believe we block inbound (but could be wrong about that).

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

cem82 — Thu, 02 Mar 2023 06:27:14 GMT

To utilise custom feeds do need both AB and AV blades enabled not just one of them in R81.10 anyway

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

shanil420 — Tue, 29 Aug 2023 16:52:24 GMT

Hi the_rock!

can you please let me know how to block multiple IP's on Locally managed R81.10.

Thanks & Regards,

Shanil

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

the_rock — Tue, 29 Aug 2023 16:56:05 GMT

Hey @shanil420 ,

Im not overly familiar with SMB appliances, so dont know if same method would work or not, but Im sure there is a way to import a list that can be blocked. Let me spin up a demo and will check for you,

Andy

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

Tal_Paz-Fridman — Tue, 29 Aug 2023 17:00:14 GMT

Please look at IOC Feeds feature:

sk132193 What is the "Custom Intelligence Feeds" feature?

https://support.checkpoint.com/results/sk/sk132193

Also refer to:
https://community.checkpoint.com/t5/Threat-Prevention/CheckMates-Tips-and-Tricks-IOCs-TAXII-feeds-and-API-automation/td-p/155890

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

shanil420 — Tue, 29 Aug 2023 17:04:17 GMT

Thank you so much for your quick reply. Much appreciate the support 👍

Re: BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

the_rock — Tue, 29 Aug 2023 17:06:13 GMT

I was more thinking of adding generic data center object that can be used with .json file to block the bad known IPs, but I dont believe thats possible on locally managed SMB?

Andy