topic Re: Import Updatable Objects in General Topics

Import Updatable Objects

JED — Fri, 03 Jan 2025 09:54:00 GMT

Hi All,

Following some broad reading of SK documents we now have some questions relating to the use of the Updatable Objects.

Currently our gateways are on R81.10 and the SMS is on R81.20.

The questions are as follows:

1. The Use of the updatable object in the rule base : does the Updatable object get its objects from the updates on SMS or the gateway or both?

2. How do you check the "contents" of the allowable/ contained addresses in a group in the Updatable Object : e.g. "United Kingdom" or Google Services ( two listed)?

3. What is the frequency of the updates : ( again does this get updated on gateway or SMS : ( in 1 above) ? How is it checked.

4. In reference to item 2. and the "Google Services" we have found the URL that identifies the "Ip ranges that Google makes available to users on the internet" : Would it be this ( or similar) that Checkpoint uses for the updates in the first instance.

5. Currently we are the stages of infancy with the use of these Updatable Objects, there are some SK's that provide some very good information but again there is some missing info to describe its baseline operation.

6. Does the use of these or the Updates / frequency/ timeline have any load implications on any CPU on Gateway or SMS?

All the best JED.

Re: Import Updatable Objects

AkosBakos — Fri, 03 Jan 2025 11:56:11 GMT

Hi think you saw this sk: https://support.checkpoint.com/results/sk/sk131852

The Time-to-Live (TTL) for FQDN cache is 60 minutes. When using FQDN mode, all Domain Objects are refreshed once per minute. To refresh the Domain Object resolution, the Security Gateway queries all defined DNS servers for both "domain.com" and "www.domain.com" from the Domain Object.

Re: Import Updatable Objects

Gaurav_Pandya — Fri, 03 Jan 2025 11:58:52 GMT

Hi JED,

I can answer few of your questions.

1. Information will be fetched by firewall

3. It fetches information when it is updated from vendor side.

You can check sk131852 for more information

Re: Import Updatable Objects

PhoneBoy — Fri, 03 Jan 2025 16:12:13 GMT

To answer number 2, see: https://community.checkpoint.com/t5/Security-Gateways/Updatable-Objects-Audit-changes-and-contents/m-p/217510#M41428

I believe updates are fetched once an hour.
The load on the gateway is minimal, though I believe there is also a limit to the number of Updatable Objects allowed in the policy.

Re: Import Updatable Objects

the_rock — Fri, 03 Jan 2025 16:30:35 GMT

Let me take "crack" at it, though someone will correct me, Im sure 🙂

Andy

1. The Use of the updatable object in the rule base : does the Updatable object get its objects from the updates on SMS or the gateway or both? I believe management

2. How do you check the "contents" of the allowable/ contained addresses in a group in the Updatable Object : e.g. "United Kingdom" or Google Services ( two listed)? Im only aware ofm domains_tool command for this

3. What is the frequency of the updates : ( again does this get updated on gateway or SMS : ( in 1 above) ? How is it checked. every 60 mins

https://support.checkpoint.com/results/sk/sk131852

6. Does the use of these or the Updates / frequency/ timeline have any load implications on any CPU on Gateway or SMS? I had never seen any impact myself at all