topic Re: 406-Not acceptable error while testing external IOC feed in VSX environment in Firewall and Security Management

406-Not acceptable error while testing external IOC feed in VSX environment

mahesh — Fri, 18 Oct 2024 03:27:55 GMT

Getting 406-Not acceptable error while testing external IOC feed in VSX environment. Screenshot attached.

Usually 406 errors means server is unable to accept client's request. Does this mean it is an issue with the server where the feed is hosted ?

We are able to get the ip's when we try the same url in browser and curl connectivity also works fine.

We are using the same feed in Palo Alto firewall and it works fine over there.

Also, I got to know from below sk that vsx gateways are not supported but there is a confusion whether it indicates TOR list or IOC feed.

https://support.checkpoint.com/results/sk/sk103154

Tried custom csv file and able to block the ip's successfully.

Can someone assist here ?

Thanks in advance.

Re: 406-Not acceptable error while testing external IOC feed in VSX environment

PhoneBoy — Fri, 18 Oct 2024 13:53:33 GMT

Version/JHF of gateway and management?
Note that the mechanism used in sk103154 is different from either of the following:

It's not clear from your description which method you're using here.
I do know that testing a Network Feed from a VSX VS will not work, see: https://community.checkpoint.com/t5/General-Topics/Network-Feeds-and-VSX/m-p/212877/highlight/true#M35214
Not sure this applies to Threat Intelligence Feeds or not.

Both should work on VSX, though (absent the "testing" function).

Re: 406-Not acceptable error while testing external IOC feed in VSX environment

the_rock — Fri, 18 Oct 2024 14:43:38 GMT

See if this helps?

Andy

https://community.checkpoint.com/t5/Management/Adding-Threat-Prevention-IOC-s-via-SmartConsole/td-p/125160

Re: 406-Not acceptable error while testing external IOC feed in VSX environment

mahesh — Sat, 19 Oct 2024 05:20:41 GMT

Hello @PhoneBoy,

Thanks for the reply.

We are using R81.10 take 139 Vsx gateway and adding external IOC feed.

As per the community article shared by you, testing the IOC feed in vsx gateways is not supported but we can test the feed in normal gateway and use it in VSX gateways to block the ip's.

I have tested the feed in normal Quantum security gateway which was successful and added the same feed in VSX gateway but unable to block the ip's present in the feed. No logs observed either when we try to ping the ip's.

Instead the ip's are getting blocked by the access rule configured and not using IOC feed.

Hope the requirement is clear.

Thanks.

Re: 406-Not acceptable error while testing external IOC feed in VSX environment

PhoneBoy — Mon, 21 Oct 2024 13:38:38 GMT

Best to consult with TAC here: https://help.checkpoint.com