topic Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint in Endpoint

Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

Pawel_eM — Mon, 04 Apr 2022 12:30:47 GMT

Just wondering or maby just missed it in admin guide but. is there an easier way to allow connections to non "checkpoint services" associated with harmony endpoint?
For example the edr funcionality. Is there an updatable object for that (we are using also checkpoint firewall software 80.40) or i should just check ip associated with every url and pass that list to the network team to unlock the communication?

Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

Chris_Atkinson — Mon, 04 Apr 2022 23:45:47 GMT

Sounds like you are familiar with sk116590 which outlines a list of the URLs.

Recent versions ship with a utility to help validate the connectivity exists.

Do users in your environment use a proxy for their internet access?

Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

Pawel_eM — Tue, 05 Apr 2022 06:23:12 GMT

Hello,
Yes i'm fomiliar with this SK and with the conectiity test tool. Conectivity test looks like this (the part with fails)

In this case its server environment. Yes the servers use proxy. I've made an exclusion for some url directory on the os level (i don't want (by default the servers have restricted access to internet)
to push whole traffic generated by harmony through the proxy server).
The network Team alloved traffic on the firewall from servers to updatable objects of "checkpoint services" and another updatable object for "eu-west-1.elb.amazonaws.com" the aws is for initial agent to connect to management.

Also made na test machine, disabled the proxy but then i see drops on the firewall.

Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

80fd220b-e3b5-4 — Sun, 10 Apr 2022 08:56:52 GMT

Hi Pawel,

which command did you use in order to check the connectivity?

thanks a lot

Emiliano

Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

G_W_Albrecht — Sun, 10 Apr 2022 16:36:32 GMT

Updatable objects are available for MS and Google Services.

Re: Allowing firewall traffic to non "checkpoint services" used by harmony endpoint

Pawel_eM — Fri, 15 Apr 2022 10:04:01 GMT

Used the "CheckConnectivity.exe" in

C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\