topic Re: Automated IP Blocking in Firewall and Security Management

Automated IP Blocking

Matlu — Fri, 25 Apr 2025 23:32:20 GMT

Hello, Mates.

I have an environment of several VSX Clusters, which are managed from an MDS.

We currently have many Perimeter FWs, and when we have certain IPs reported as “Malicious”, we have the need to block them in explicit rules that we already have created in each of the FWs.
The problem with doing it manually, is that this task “takes a lot of time”, and we want to use some automated way to be able to execute this task.

Is there any way in the Check Point solutions, that allows us to have a more “automated” environment for this type of tasks?

Thanks for your comments.

Re: Automated IP Blocking

the_rock — Fri, 25 Apr 2025 23:51:08 GMT

Ola bro,

How are you? Have a look at my post from last year, hope it can help you. Network feeds do NOT require av or ab blades enabled. I would say to begin with, do NOT use stamparm1 and emerg feeds, others are fine, stamparm 2-8.

https://community.checkpoint.com/t5/Security-Gateways/Network-feed/m-p/212407#M40317

Best,

Andy

Re: Automated IP Blocking

Matlu — Sat, 26 Apr 2025 00:02:38 GMT

Hello, my friend.

Some of my Perimeter FWs do have the AV and AB blades enabled, but others do NOT.

Would this way of working with the “Network Feed” work as well in the FWs that have these blades enabled?

Greetings.

Re: Automated IP Blocking

the_rock — Sat, 26 Apr 2025 00:09:18 GMT

Yes sir, 100%. Regardless whether you have those blades enabled or not, network feeds work fine. I would make sure you have R81.20 installed, as it lets you test the feeds beforehand. Just for the context, I work often with a smaller hospital (I mean, for comparison, its not the size of Ankara city hospital in Turkey, nothing like that lol), but they were doing the same method for a long time like what you described, adding IPs manually.

I showed them the same post, they added ALL the feeds, in 3 days, they had more than 10 million hits, while before implementing net feeds, there was about 25k hits in 1 year.

Andy

Re: Automated IP Blocking

the_rock — Sat, 26 Apr 2025 00:18:05 GMT

reference

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm

Re: Automated IP Blocking

Matlu — Sat, 26 Apr 2025 00:22:21 GMT

And is it possible that even using this method, if it is necessary to add some IPs that report as “Malicious” to our monitoring area, we can somehow add them to the referral “sources”?

For example, you get 3 super strange “Malicious” IPs reported to you.

48.190.1.5
35.120.2.2
191.2.2.4

(Just to give you an example), and you are already using the Network Feeds.
Can these IPs be “tied” to this “Network Feeds” operation? Or would you have to manually create explicit rules to block these particular IPs?

Re: Automated IP Blocking

the_rock — Sat, 26 Apr 2025 00:25:30 GMT

Thats right...though, you can search for any given IP when opening the links I posted, same way you can do ctrl+F to search for anything in text file of web page. Keep in mind, any net feed is updated automatically, so you dont have to do anything yourself.

Andy

Re: Automated IP Blocking

the_rock — Sat, 26 Apr 2025 00:46:12 GMT

Btw, even if you have any gateways on R80.xx, those can also do net feeds, but I definitely suggest they be on R81.20, if possible, to utilize all the available options.

Andy

Re: Automated IP Blocking

the_rock — Sat, 26 Apr 2025 19:05:03 GMT

Btw, figured would update you on this post as well...tested R82 vsx for network feeds, no issues.

Andy

Re: Automated IP Blocking

the_rock — Sun, 27 Apr 2025 13:56:18 GMT

@Matlu If you need me to test anything else in the lab, please let me know.

Andy

Re: Automated IP Blocking

the_rock — Mon, 28 Apr 2025 01:42:52 GMT

Just a word of caution though...maybe dont add all of net feeds I provided at once, start with 2 or 3 and then give it couple of days and see how many hits you get, just to make sure there are not inadvertent effects.

Andy

Re: Automated IP Blocking

Matlu — Mon, 28 Apr 2025 03:12:38 GMT

From the list of .txt file options, which option do you recommend to use in my ‘Network Feeds’?

Re: Automated IP Blocking

the_rock — Mon, 28 Apr 2025 03:23:27 GMT

Hey bro,

Here is the thing. My best suggestion is if you are unsure, always test any IP you are concerned about in below link, its very accurate. We always use it to check those things. Besides, only way to really know is to apply the feed, block it in policy, and then observe and see.

Andy

https://www.abuseipdb.com/

Re: Automated IP Blocking

the_rock — Tue, 29 Apr 2025 00:54:25 GMT

Another helpful link I found.

Andy

https://github.com/Bert-JanP/Open-Source-Threat-Intel-Feeds?tab=readme-ov-file