topic Re: Supportcenter now Geo-blocked in General Topics

Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 13:40:24 GMT

In case anyone else runs into this:

We allow "Check Point Services" as a destination for our support admins. This morning, when attempting to access supportcenter.checkpoint.com, I could not. Checking the logs, I found that the destination 194.29.39.55 was being dropped by our geo-blocking policy. We block Israel, among many other countries, in our geo-blocking policy after the rule which allows "Check Point Services". The IP does not resolve to a domain name, but is owned by Check Point.

Not sure how we are going to handle this. Best case scenario is that Check Point updates the updatable object "Check Point Services" to include this IP. I don't really want to open "Israel" for all clients.

Dave

Re: Supportcenter now Geo-blocked

Chris_Atkinson — Thu, 02 Feb 2023 14:10:31 GMT

You could open the parent subnet that contains it as an option rather than the whole country in the interim.

@Micky_Michaeli is this something that is intended to be covered by the existing updatable object?

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 14:16:38 GMT

Hm...never really ran into that sort of issue, but I always tell every customer to never block country of Israel for obvious reasons. Now, if you have to do that, logically, as long as the rule allowing CP services is ABOVE geo rule blocking Israel, dont see why that would be a problem. I assume that that rule has worked fine up until now?

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 14:34:29 GMT

Access to the support site and all other Check Point sites has worked fine up until today, with one exception, catalog.checkpoint.com always has been geo-blocked, as it must not be included in the "Check Point Services" updatable object.

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 14:35:43 GMT

Yes, I could and very well may do this as a fix, however, I'd like to think Check Point could keep the updatable object for their own services up to date.

Dave

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 14:38:06 GMT

Correct, I dont see catalog site as per link below I pointed out.

How to verify that Security Gateway and/or Security Management Server can access Check Point servers?

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 14:48:42 GMT

Based on this, I am understanding that the updatable object "Check Point Services" includes only the hostnames/domains listed in sk83520? supportcenter.checkpoint.com is not listed here either, yet this was allowed by "Check Point Services" until this morning.

According to the revision history, sk83520 has not been updated since May 29, 2017.

Dave

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 14:48:35 GMT

That, Im not sure whatsoever, so I will let someone who works for Check Point confirm. Reading the sk, its not 100% clear to me and I dont want to assume anything.

Andy

Re: Supportcenter now Geo-blocked

Chris_Atkinson — Thu, 02 Feb 2023 14:50:09 GMT

You can see the raw list here as is:

https://secureupdates.checkpoint.com/cp_services/V1_0_0/gw/cp_services_uo

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 15:05:33 GMT

Thank you, I will bookmark that. Any chance we could get "catalog.checkpoint.com" added to the list?

Also, I was just able to connect to supportcenter.checkpoint.com...I think my mistake was trying to connect to support.checkpoint.com. I cannot connect to support.checkpoint.com with our geo-blocking policy in place, I can connect to it from a source not subject to our geo-blocking policies. support.checkpoint.com resolves to 194.29.39.55, which is what I saw getting geo-blocked in my logs.

Dave

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 15:11:39 GMT

Based on maxmind.com, which CP uses by the way for their Geo database, it shows that IP belongs to country of Israel, which in your case is blocked, but since support.checkpoint.com is not included in the list Chris sent, it makes sense why its not working, but it is puzzling how come it did work for you up until today though.

Andy

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 15:17:12 GMT

I think this was my mistake (see above). supportcenter.checkpoint.com was and is working, support.checkpoint.com is not, which makes sense based on the list Chris sent.

Ideally, both support.checkpoint.com and catalog.checkpoint.com would be added to the list of URLs contained in the "Check Point Services" updatable object.

Dave

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 15:18:42 GMT

Ok, got it, see what you mean.

Cheers,

Andy

Re: Supportcenter now Geo-blocked

Micky_Michaeli — Thu, 02 Feb 2023 17:45:56 GMT

Hi @Chris_Atkinson , @David_C1

The domain supportcenter.checkpoint.com is included in "Check Point Services" object.

We use domains in this UO instead of set of IPs as the domains are resolved to different IPs from time to time according to DNS servers.
For example, currently supportcenter.checkpoint.com is resolved to a different IP:
Name: supportcenter.g04.checkpoint.com
Address: 194.29.39.18
Aliases: supportcenter.checkpoint.com

We have DNS Passive Learning (sk161612) to improve the matching of Domain objects (the content we have in Check Point Services object) - please review it as it can solve the issue when a domain is resolved suddenly to a 'new' IP before the GW resolved it and saved it on its cache.

Thanks,
Micky

Re: Supportcenter now Geo-blocked

Micky_Michaeli — Thu, 02 Feb 2023 17:55:08 GMT

Hi @David_C1,

I will ask the relevant R&D team to add these 2 missing domains to the UO object.

Thanks,
Micky

Re: Supportcenter now Geo-blocked

David_C1 — Thu, 02 Feb 2023 17:58:37 GMT

Excellent, thank you.

Dave

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 18:02:04 GMT

Excellent explanation, thank you @Micky_Michaeli

Re: Supportcenter now Geo-blocked

Wolfgang — Thu, 02 Feb 2023 20:33:09 GMT

Something strange…. support.checkpoint.com sometime working sometimes not. Not behind any Check Point device.

https://support.checkpoint.com looks like this:

and a little bit different https://supportcenter.checkpoint.com :

I thought I used support.checkpoint.com over the last 20 years.

Re: Supportcenter now Geo-blocked

the_rock — Thu, 02 Feb 2023 20:38:49 GMT

Im so glad you pointed this out, because I thought I was going crazy : - ). I always used support.checkpoint.com and Im positive would always redirect to supportcenter.checkpoint.com

Re: Supportcenter now Geo-blocked

PhoneBoy — Fri, 03 Feb 2023 06:55:29 GMT

I didn’t think support.checkpoint.com was “public” just yet…guess it is now 😉
We are redesigning our support portal and plan to launch it formally in the next few months.
The current “beta” is missing a few things, though.
Feedback is welcome.