topic Re: Custom Updatable Objects in R80.40 or R81 in API / CLI Discussion

Custom Updatable Objects in R80.40 or R81

Jordan_Garden — Tue, 09 Feb 2021 20:28:01 GMT

Hello CheckMates team,

In reviewing a precious thread (Can we create custom updatable objects in R80.20) wanted to follow up and ask if this functionality has indeed made its way in R81 and if it is planned to be made available within R80.40 at any point? Have a customer looking to use this functionality instead of the traditional Dynamic URL/IP List via custom application method due to policy install and Blade requirements, and have not been able to find definitive answer on availability. Appreciate any insight you may be able to share and if there is any documentation available.

Re: Custom Updatable Objects in R80.40 or R81

genisis__ — Tue, 09 Feb 2021 20:47:08 GMT

Do you know if the updatable objects is going to be expanded? something obvious like having Checkpoint Cloud updatable object, Cisco Meraki Cloud are additional objects which I think would be good.

Re: Custom Updatable Objects in R80.40 or R81

PhoneBoy — Tue, 09 Feb 2021 20:52:33 GMT

It’s called a Generic Data Center object and it was added in R81.
However, it only covers IPs (not URLs).
As for supporting other “Data Center” types @genisis__ If you have a specific need I would approach your local office with the requirements.

Re: Custom Updatable Objects in R80.40 or R81

Jordan_Garden — Tue, 09 Feb 2021 21:02:16 GMT

Thanks @PhoneBoy . Do you happen to know if there are any listed blade requirements? Do not see anything listed in SK167210

Re: Custom Updatable Objects in R80.40 or R81

genisis__ — Tue, 09 Feb 2021 21:03:44 GMT

Thanks.

Re: Custom Updatable Objects in R80.40 or R81

the_rock — Tue, 09 Feb 2021 21:06:54 GMT

Just on a side note, Im actually surprised that default geo policy was taken away in R81?? @PhoneBoy ...any idea why, just curious? : )

Andy

Re: Custom Updatable Objects in R80.40 or R81

PhoneBoy — Wed, 10 Feb 2021 00:00:39 GMT

The proper way to do Geo Policy from R80.20 is actually to use Updatable Objects in the Access Policy.
This is far more flexible than the traditional Geo Policy.
We hide the Geo Policy by default in R81+ if you haven't configured any rules and can 'unhide' it if you prefer.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk126172&partition=Basic&product=Security

Re: Custom Updatable Objects in R80.40 or R81

PhoneBoy — Wed, 10 Feb 2021 00:03:41 GMT

No specific requirements that I'm aware of.

Re: Custom Updatable Objects in R80.40 or R81

the_rock — Wed, 10 Feb 2021 00:05:34 GMT

Man, you are the best! You are always there for an answer, no matter what the question is : ). Reminds me of good old Pierre Lamy (Im positive you know who Im talking about ; )

Andy

Re: Custom Updatable Objects in R80.40 or R81

PhoneBoy — Wed, 10 Feb 2021 00:07:26 GMT

I'm very familiar with him 🙂

Re: Custom Updatable Objects in R80.40 or R81

JackG — Mon, 15 Feb 2021 08:56:45 GMT

Another useful updatable object in my mind would be an updatable object for Zscaler service.
Zscaler has a lot of ZEN nodes all over the world to provide their SaaS service.
Are there already considerations to integrate Zscaler updatable object within R80.30 ?

Re: Custom Updatable Objects in R80.40 or R81

George_Casper — Wed, 17 Feb 2021 16:11:18 GMT

I wish the Updatable Objects (O365 Team/Zoom etc) were available for selection in the Network Group with Exclusions object that we use to granularly allow split tunneling for Teams & Zooms calling while on the VPN. Silly that the objects are there but you just can't use them. The Teams list isn't too bad to manually maintain but Zoom's is huge.

Re: Custom Updatable Objects in R80.40 or R81

PhoneBoy — Wed, 17 Feb 2021 20:34:55 GMT

Right now the actual encryption domain can't really change "on the fly" as those objects can and do.
We do have a script that can assist with this (at least for Office 365) which I imagine could also be adapted for Zoom usage as well.

Re: Custom Updatable Objects in R80.40 or R81

steffenkoelsch — Mon, 22 Feb 2021 09:39:34 GMT

Would this script be publically available? 🙂

(kind-of hijacking Jordan's thread, but the assumed IP list scraping might by a common base for both purposes)

Steffen

Re: Custom Updatable Objects in R80.40 or R81

David_C1 — Mon, 22 Feb 2021 20:08:49 GMT

As long as we are requesting new updatable objects...how about an updatable object for Check Point services (e.g. updates.checkpoint.com, cws.checkpoint.com). We rely heavily on geo-blocking, and would prefer to only allow our gateways and management to talk only to Check Point URLs, instead all of Israel (we currently block Asia, and have exception for Israel for our gateways/management).

Dave

Re: Custom Updatable Objects in R80.40 or R81

the_rock — Mon, 22 Feb 2021 20:56:58 GMT

I agree 100%. It would also be awesome if countries could be put in a network group, because some geo rules look like "hot mess" if you have 20 countries in there.

Andy

Re: Custom Updatable Objects in R80.40 or R81

genisis__ — Mon, 22 Feb 2021 21:17:16 GMT

I totally agree, and mentioned the exact same thing. It seems a little short sighted of Checkpoint not to include its own cloud services as an updateable object, come on Checkpoint make it happen. I can't believe it will take much effort to do it.

Re: Custom Updatable Objects in R80.40 or R81

the_rock — Mon, 22 Feb 2021 21:18:55 GMT

Yea well, tell that to someone in R&D ; )

Re: Custom Updatable Objects in R80.40 or R81

genisis__ — Mon, 22 Feb 2021 21:21:32 GMT

I guess we are, R&D are on this forum and should be listening to what I hope is taken as a constructive improvement suggestion.

Re: Custom Updatable Objects in R80.40 or R81

the_rock — Mon, 22 Feb 2021 21:24:05 GMT

Lets see...based on previous experience, I am 99.999% sure it wont happen any time soon...but, lets hope Im wrong : )