topic Re: AV blade/user check/windows updates in Firewall and Security Management

AV blade/user check/windows updates

the_rock — Sun, 23 Mar 2025 00:17:10 GMT

Hey guys,

Figured would share this, since customer and I had been working with TAC escalation guy for couple weeks and he told us would probably open a task with R&D to see if there is a way to make block page come up every time when specific file types are blocked (in our case msi and exe). Its somewhat inconsistent at this point, since random sites dont show block pages when msi file is blocked and some are even allowed. I will update once we have fully working solution, but in the meantime, figured would share some screenshos that can hopefully help others if you find yourself in similar situation.

Andy

Re: AV blade/user check/windows updates

Lesley — Mon, 24 Mar 2025 21:27:56 GMT

I don't fully understand the issue, but here is what I can see

screenshot 1, I would the recommended bypass object listed in this SK:

https://support.checkpoint.com/results/sk/sk163595

Screenshot 7 rule 1 this rule will not match the traffic becuase it is set to N/A.
Therefore it will not hit the blades. I would recommend to right click it and add the blades you want to exclude(in this case AV)

Re: AV blade/user check/windows updates

the_rock — Mon, 24 Mar 2025 21:30:53 GMT

Hey Lesley,

We had problem where windows updates were not working when msi and exe files were blocked through AV blade.

Andy

Re: AV blade/user check/windows updates

JaAnd — Mon, 24 Mar 2025 22:10:51 GMT

Hi Andy,

maybe you could try to add in DST Updateble Object of recommended by CP HTTPS inspection bypass for Microsoft updates? It seems to be quite accurate in my use cases. Of course it might be sometimes to wide, but MS seems to be unpredictable in some ways 😜 Maybe good old manually defined URLs would do the job?

Re: AV blade/user check/windows updates

the_rock — Mon, 24 Mar 2025 22:17:04 GMT

Hey @JaAnd 🙂

Yes, thats what we did, just added microsoft defender and it worked. Regardless, blocking files and showing block page is absolutely needed and it has to work CONSTANTLY, which sadly, is far from what happens now.

Andy

Re: AV blade/user check/windows updates

the_rock — Mon, 24 Mar 2025 23:24:47 GMT

For what its worth, TAC guy originally had us add akamai, cloudflare and github to bypass, but though that fixed windows updates, it broke few sites for ssl inspection.

Andy