topic Re: Checkpoint option for DMZ-based update server in Firewall and Security Management

Checkpoint option for DMZ-based update server

Garrett_DirSec — Thu, 23 Jan 2025 21:25:22 GMT

Hello Checkmates --

What are checkpoint options for deployment of dedicated "update server" to be placed on DMZ allowing Security Gateways to receive updates for advanced blade features.

This not a new topic for certain Govt networks and Utility SCADA networks where Internet isolation is best practice.

The keys:

1) advanced features enabled on Checkpoint gateways: IPS, Antibot, AppCtl.

2) checkpoint gateway can't talk outside local network (ie. can't communicate directly with Checkpoint public update servers).

3) granular communication to specific "update server" on DMZ is permissible.

Advise on thoughts. thx

Re: Checkpoint option for DMZ-based update server

Bob_Zimmerman — Thu, 23 Jan 2025 21:38:02 GMT

The term you should ask about is "Private Threat Cloud" or PTC. My environment has some. I strongly recommend against them. They've given us nothing but headaches.

Re: Checkpoint option for DMZ-based update server

Garrett_DirSec — Thu, 23 Jan 2025 21:40:30 GMT

Hello @Bob_Zimmerman -- thanks for the quick reply and insight.

Yes -- I suggest the customer will be excited about solution:

1) not a headache

2) no additional cost

Re: Checkpoint option for DMZ-based update server

Chris_Atkinson — Thu, 23 Jan 2025 22:50:23 GMT

PTC or a Proxy are the solutions that come to mind.

Re: Checkpoint option for DMZ-based update server

PhoneBoy — Fri, 24 Jan 2025 00:45:00 GMT

IPS and App Control have actual signatures that can be downloaded.
Most everything else is a dynamic lookup to ThreatCloud, for which you would need Private ThreatCloud: https://support.checkpoint.com/results/sk/sk149692

Re: Checkpoint option for DMZ-based update server

Bob_Zimmerman — Mon, 10 Mar 2025 18:13:39 GMT

Speaking of headaches and PTCs, the firewalls which use the PTCs have been failing to get updates for a few days. The PTC health report said everything is fine. Turns out the certificates the PTCs present for the name updates.checkpoint.com just expired with no warning, and that isn't checked in the health report.

It's a minor issue, but frustrating. Cost some coworkers a few hours trying to figure out what was going on.