topic Re: Custom Feed Blocking - SK103154 in General Topics

Custom Feed Blocking - SK103154

kevin_t — Thu, 14 Nov 2019 20:54:23 GMT

We are currently implementing the SK103154 to block known TOR nodes/IP addresses that Checkpoint provides. We are trying to add more feeds to this custom list though, and they appear to not be reflecting in the gateways. Specifically this URL:

https://talosintelligence.com/documents/ip-blacklist

The Checkpoint feeds work just fine, but this Talos one will not. Anyone have any ideas on why this might be? We are on R80.20

Relevant SK: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103154

Re: Custom Feed Blocking - SK103154

PhoneBoy — Fri, 15 Nov 2019 01:00:51 GMT

Any error messages that might provide a clue?

Re: Custom Feed Blocking - SK103154

Martin_Valenta — Fri, 15 Nov 2019 06:35:17 GMT

Talos is returning http 429 code, when you try to pull their IP list to often, so you just might get blocked for certain period of time..

Re: Custom Feed Blocking - SK103154

kevin_t — Fri, 15 Nov 2019 13:42:41 GMT

No error messages, it works when I enable the custom threat feeds. It is just that nothing populates when I run the command "fw samp get | grep threatcloud_ip_block"

Re: Custom Feed Blocking - SK103154

PhoneBoy — Fri, 15 Nov 2019 19:44:31 GMT

So it is blocking the IPs, just not showing in the appropriate list?
That might be worth a TAC case.