topic Re: IP Reputation & Custom Intelligence Feeds in Firewall and Security Management

IP Reputation & Custom Intelligence Feeds

62742738 — Thu, 16 Nov 2023 05:43:38 GMT

Which does security gateway look for first? Custom Intelligence Feeds or the IP Reputation?

Because the traffic of a certain IP is getting blocked but it is not included in the custom feeds and the logs show that it is due to IP reputation.

Re: IP Reputation & Custom Intelligence Feeds

_Val_ — Thu, 16 Nov 2023 08:03:55 GMT

The answer is, both at the same time. If an IP appears in either, it will be blocked.

Re: IP Reputation & Custom Intelligence Feeds

62742738 — Thu, 16 Nov 2023 09:00:29 GMT

Do you have any idea as to why an IP keeps getting blocked despite its exclusion from custom feeds and the logs show that it is due to IP reputation?

Re: IP Reputation & Custom Intelligence Feeds

PhoneBoy — Thu, 16 Nov 2023 17:20:11 GMT

If traffic is blocked due to your configured Threat Intelligence feeds, the logs will reflect that.
IP Reputation comes from ThreatCloud and is enforced by AntiBot and/or AntiVirus blades.
You can configure a specific exclusion for this IP address in your Threat Prevention policy.
If you think the relevant IP address is not malicious/bad reputation, please contact TAC to have the situation reviewed: https://help.checkpoint.com

Re: IP Reputation & Custom Intelligence Feeds

62742738 — Fri, 17 Nov 2023 03:01:15 GMT

Alright, got it. Thank you!