topic Re: Custom Intelligence Feed Exceptions Not Working in General Topics

Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 16:52:03 GMT

I am running R81.10 with GA JHA take 130 installed on my gateways and SMS.

I have a External Custom Intelligence Feed named Talos_blacklist configured on my gateway cluster via the CLI.

I have a IP that is on that blacklist that gets by design of the feature.

However I need to make an exception for this IP address and everything I have tried in SmartConsole does not work, traffic to the IP in question is still dropped due to my Talos_blacklist.

In the example with my screen shots the source is 10.1.1.10 > 185.242.113.224 (black listed IP). From the log card I have selected add an exception, select the defaults, the exception is created (see screen shot), I install threat prevention policy and traffic is still blocked from my source to the destination due to the Talos_blacklist.

I have also tried creating my own threat prevention rule and assigning the source and/or destination to a dummy no threat prevention policy that doesn't have any TP enabled and that does not work as well.

Is it possible to make exceptions for IP's on External Custom Intelligence Feed's and if so how can I create one that will work?

Thank you in advance.

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Fri, 05 Jan 2024 18:01:36 GMT

I think protected scope should be any and source should be 10.x.x.x

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 18:37:34 GMT

The exception doesn't work that way either. It's almost as if exceptions through SmartConsole aren't support with Custom Intelligence Feed's but I can't find any documentation stating that or showing a different way to do an them.

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Fri, 05 Jan 2024 18:42:41 GMT

I see what you mean. Any difference if you leave protection/site as n/a?

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 18:51:27 GMT

Good idea. I tried with the protection / site set to N/A. When I test traffic again no logs are generated but running zdebug I see the following:

[Expert@SG-1:0]# fw ctl zdebug + drop | grep 185.242.113.224
@;4184305;[kern];[tid_0];[SIM-241965305];pkt_handle_stateless_checks: dropping d ue to dos_pkt_should_drop(), conn: <10.1.1.10,1,185.242.113.224,0,1>;
@;4184305;[kern];[tid_0];[SIM-241965305];do_packet_finish: SIMPKT_IN_DROP vsid=0 , conn:<10.1.1.10,1,185.242.113.224,0,1>;
@;4185381;[kern];[tid_0];[SIM-241965305];pkt_handle_stateless_checks: dropping due to dos_pkt_should_drop(), conn: <10.1.1.10,1,185.242.113.224,0,1>;
@;4185381;[kern];[tid_0];[SIM-241965305];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.1.1.10,1,185.242.113.224,0,1>;
@;4186459;[kern];[tid_0];[SIM-241965305];pkt_handle_stateless_checks: dropping due to dos_pkt_should_drop(), conn: <10.1.1.10,1,185.242.113.224,0,1>;
@;4186459;[kern];[tid_0];[SIM-241965305];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.1.1.10,1,185.242.113.224,0,1>;
@;4187515;[kern];[tid_0];[SIM-241965305];pkt_handle_stateless_checks: dropping due to dos_pkt_should_drop(), conn: <10.1.1.10,1,185.242.113.224,0,1>;
@;4187515;[kern];[tid_0];[SIM-241965305];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<10.1.1.10,1,185.242.113.224,0,1>;

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Fri, 05 Jan 2024 18:53:25 GMT

Seems to me that pings are dropped based on that...

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 19:03:50 GMT

If I delete the exception the pings are then dropped by the blacklist again. If I turn of the custom intelligence feed the pings work as expected.

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Fri, 05 Jan 2024 19:05:55 GMT

Not sure, sorry...maybe worth TAC case to verify. Please share the solution once its fixed.

Best,

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 19:07:07 GMT

Will do. In the meantime if someone from Check Point can chime in and let me know if this is even supported or not I would really appreciate it.

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Fri, 05 Jan 2024 19:08:06 GMT

Im curious too, for sure. In the meantime, I will keep digging to see if there is a way...

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Timothy_Hall — Fri, 05 Jan 2024 19:21:35 GMT

The zdebug shows that the drop is occurring in the sim/SecureXL module even though Threat Prevention is responsible, which is normally enforced by a Firewall Worker Instance in the Medium Path at least. This is a little-known optimization to drop traffic solely by IP address at a very early stage of processing inside sim, even though Threat Prevention is normally enforced after Access Control. Custom Observables can be complex and based on many things other than header values such as IP addresses and ports (which is all SecureXL really looks at for the most part), and my guess is that the exception is not being applied correctly down into this sim optimization. If you selectively disable SecureXL for either IP address (sk104468: How to exclude traffic from SecureXL) does the exception start working? My guess is it might.

See here for more detail about this optimization: Are IoC feeds processed before Access Control policy?

Also hopefully goes without saying, but once you try selectively disabling SecureXL make sure to start a new ping (or whatever test traffic) after waiting at least 30 seconds with no test traffic at all.

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Fri, 05 Jan 2024 21:13:09 GMT

Hi Tim,

Thank you for the great info!

I tried with selectively disabling SecureXL for the destination IP and had the same results, assuming I edited the table.def file correct:

[Expert@SMS-1:0]# vi $FWDIR/lib/table.def

f2f_addresses={<185.242.113.224>};

If I use the exception the way SmartConsole creates it from the log card option with the source being the protected scope traffic to the destination continues to be dropped by the threat prevention blacklist.

If I change the exception that SmartConsole created in anyway such as moving the host object in the protected scope to the source or adding the destination IP to the destination field I then see the drops in zdebug.

In my lab environment I turned off SecureXL on the gateway with fwaccel off just incase my addition to the table.def file wasn't correct and had the same results.

Re: Custom Intelligence Feed Exceptions Not Working

Timothy_Hall — Fri, 05 Jan 2024 21:26:19 GMT

Thinking about it more, disabling SecureXL won't matter as the optimal drop occurs long before it even figures out what path the connection should be handled in. It still sounds like the exception you created is not being integrated into the optimal drop calculation inside sim, but this may be the case on a Firewall Worker Core as well if exceptions cannot be applied against custom indicators at all as you suspected initially. Let me tag @Peter_Elmer and hopefully have him weigh in.

Re: Custom Intelligence Feed Exceptions Not Working

Tobias_Moritz — Mon, 08 Jan 2024 13:58:58 GMT

Very fresh from R81.20 JHF T43 from today:

PRJ-43434,
PRHF-26673

Threat Prevention

UPDATE: It is now possible to add exceptions to external Custom Intelligence feeds.

Would be nice to know, how to do it. Just an exception for the relevant TP policy rule, like you tried?

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Mon, 08 Jan 2024 14:00:10 GMT

Im installing it in my lab atm, lets see : - )

Andy

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Mon, 08 Jan 2024 14:09:06 GMT

I wonder if this will be added to 81.10....

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Mon, 08 Jan 2024 19:28:16 GMT

I just innstalled jumbo 43 in the lab, pushed policy, literally no new options for TP exceptions for IOC, at least that I can see.

Best,

Andy

Re: Custom Intelligence Feed Exceptions Not Working

PhoneBoy — Mon, 08 Jan 2024 19:01:04 GMT

Try creating a regular Threat Prevention exception in the policy.

Re: Custom Intelligence Feed Exceptions Not Working

Mike_Jensen — Mon, 08 Jan 2024 19:22:26 GMT

Hi PhoneBoy, I have tried and it doesn't work either.

Re: Custom Intelligence Feed Exceptions Not Working

the_rock — Mon, 08 Jan 2024 19:28:41 GMT

No dice either...

Andy