Impact of adding a bunch (8000) of IP addresses using Management API Reference

Maysam — Tue, 11 Mar 2025 14:10:59 GMT

Hello,

I am using the CLI to bulk add objects to my fw security policy. These are objects with individual IP addresses which I need to block.

I am adding several thousand at this point and am concerned about the potential impact of this on the performance of the firewall.

How can I measure this impact and how can I determine where the limits of this are?

Check Point - Management API reference

Thank you

Maysam

Re: Impact of adding a bunch (8000) of IP addresses using Management API Reference

Duane_Toler — Sat, 15 Mar 2025 03:55:47 GMT

I would suggest instead that you use a Generic Data Center object with a local JSON file for this. It's a one-time object to create, then each time you need to update it, you instead update the JSON file directly and the contents will auto-refresh based on the interval you set when the Generic Data Center is created. A single Generic Data Center JSON range can contain up to 30,000 IP and CIDR entries.

You can use any method you want to create the initial Generic Data Center file initially. You will need to create a one-time UUID, tho, and you can use the command "uuidgen" to do that.

[Expert@cpmgmt01:0]# uuidgen dd304ef4-279f-4a3c-ba70-10d6cbc62fc4

Check out sk167210 for more info on Generic Data Centers:

https://support.checkpoint.com/results/sk/sk167210

Documentation for R81.20:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Generic-DC-Object.htm

After you create everything, be sure to use the object in a rule and install policy. You don't need to do policy installs to update it again; it is automatically refreshed and pushed to the gateway(s) on the refresh interval. Don't set the interval *too* low, nor too high. 30 minutes is probably as low as you want to go.

topic Re: Impact of adding a bunch (8000) of IP addresses using Management API Reference in API / CLI Discussion

Impact of adding a bunch (8000) of IP addresses using Management API Reference

Re: Impact of adding a bunch (8000) of IP addresses using Management API Reference