topic Re: Sharing Threat Emulation Appliance Between Two Security Gateways in Firewall and Security Management

Sharing Threat Emulation Appliance Between Two Security Gateways

usukhbayar_g — Wed, 16 Jul 2025 08:48:35 GMT

We’re currently using a Check Point SandBlast appliance together with our Security Gateway. I’d like to know: is it possible to connect this same SandBlast appliance to another Security Gateway that’s managed by a different Management Server—without giving that team full admin access to our SandBlast?

I saw in the setup guide that the other side needs to create a gateway object and define it as a "TE Appliance." I’m wondering—does doing this give them the same kind of administrative permissions over the appliance that we currently have?

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

G_W_Albrecht — Wed, 16 Jul 2025 09:05:10 GMT

In https://support.checkpoint.com/results/sk/sk113599 we learn that you can use the TE appliance together with a number of Harmony Endpoint Security servers, so sharing should be possible. I would suggest to contact CP TAC to learn how to configure such a deployment! It looks as if only a certificate for TLS is needed but no SIC that would enable administration tasks from SMS.

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

usukhbayar_g — Wed, 16 Jul 2025 09:11:14 GMT

Does it mean configuring SIC between them would enable administration from the another Management server through SmartConsole, therefore configuring TLS is sufficient to work?

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

G_W_Albrecht — Wed, 16 Jul 2025 09:46:44 GMT

Afaik you can only establish SIC with one SMS ! With SIC established, you have access to the GW/TE appliance by using SMS CLI:

$CPDIR/bin/cprid_util -server <IPv4 Address of appliance> -verbose rexec -rcmd /bin/clish -c "show date"

Seesk101047: How to manage a Security Gateway using the "cprid_util" tool for details!

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

PhoneBoy — Wed, 16 Jul 2025 16:52:17 GMT

Looking at sk113599 it's only talking about establishing connectivity with Harmony Endpoint and Harmony Browse.
For a Check Point gateway, I assume the appliance has to be SICed to the same management domain.
Not sure how this would work for an externally managed TE appliance (or if this is even supported).

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

Josh28 — Thu, 17 Jul 2025 09:55:32 GMT

Hello,

Personally I’m using my sandblast with a third-party vendor, as an ICAP server. Maybe someone knows if the Secure Gateways can be configured as a ICAP client? And then the gateways could declare your sandblast as their Icap server ? It might do the trick.

Re: Sharing Threat Emulation Appliance Between Two Security Gateways

_Val_ — Thu, 17 Jul 2025 10:24:45 GMT

Per documentation, it is indeed possible, see here, for example