topic Re: Schedueled policy installs in Firewall and Security Management

Schedueled policy installs

nooni — Wed, 03 May 2023 13:37:38 GMT

Hi,

I am looking to find where schedueled policy installs are initiated from.

The reason for this is that every night i see automated threat prevention policy installs but i cannot find where they are configured.

Environment is R81.10 Take79 and it is an SMS.

There are no smart tasks configured, at least not what i can see, are they unique and only visible for each user ?

No other schedueled tasks are configured.

Re: Schedueled policy installs

G_W_Albrecht — Wed, 03 May 2023 13:51:46 GMT

Look for IPS Updates settings ! Scheduled Updates can end with a policy install: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ThreatPrevention_AdminGuide/Content/Topics-TPG/Threat_Prevention_Scheduled_Updates_Custom.htm?Highlight=On%20successful%20IPS%20update%20on%20the%20Security%20Management%20Server%2C%20install%20policy%20on%20the%20Security%20Gateway

Re: Schedueled policy installs

Tal_Paz-Fridman — Wed, 03 May 2023 13:52:13 GMT

@G_W_Albrecht is correct. Go to - SmartConsole > Security Policies > Threat Prevention > Custom Policy

At the bottom go to - Custom Policy Tools > Updates > Schedule Update.

The second option allows you to configure when policy is installed following a successful update.

Re: Schedueled policy installs

nooni — Wed, 03 May 2023 13:54:28 GMT

Should not be necessary if gateway is configured to update IPS itself right ?

Re: Schedueled policy installs

the_rock — Wed, 03 May 2023 14:17:25 GMT

Still needs to enabled manually.

Re: Schedueled policy installs

G_W_Albrecht — Wed, 03 May 2023 14:55:25 GMT

This is found here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ThreatPrevention_AdminGuide/Content/Topics-TPG/Threat_Prevention_Scheduled_Updates_Autonomous.htm?Highlight=Threat%20Prevention%20Scheduled%20Updates%20-%20Autonomous%20Threat%20Prevention:

Check Point wants the customer to be protected. When a protection update is available, Check Point wants the configuration to be automatically enforced on the gateway. You can configure automatic gateway updates for Anti-Virus, Anti-Bot, Threat Emulation and IPS.

For Anti-Virus, Anti-Bot and Threat Emulation, the gateways download the updates directly from the Check Point cloud.

For IPS, prior to R80.20, the updates were downloaded to the Security Management Server, and only after you installed policy, the gateways could enforce the updates. Starting from R80.20, the gateways can directly download the updates. For R80.20 gateways and higher with no internet connectivity, you must still install policy to enforce the updates.

When you configure automatic IPS updates on the gateway, the action for the newly downloaded protections is by default according to the profile settings.

Re: Schedueled policy installs

nooni — Wed, 03 May 2023 14:50:20 GMT

Not sure if that is correct any longer:

"For IPS, prior to R80.20, the updates were downloaded to the Management server, and only after you installed policy, the gateways could enforce the updates. Starting from R80.20, the gateways can directly download the updates. For R80.20 gateways and higher with no internet connectivity, you must still install policy to enforce the updates"

Please correct me if am wrong but if gateway HAS internet access then this scheduled install is not needed according to above text from documentation.

Re: Schedueled policy installs

G_W_Albrecht — Wed, 03 May 2023 14:59:54 GMT

If the GW is configured to install Updates and has internet access, scheduled policy install is not necessary. You will only need a policy install when changing IPS protection settings.