topic Re: Updatable blocklists from web-server in General Topics

Updatable blocklists from web-server

gilyazovamir — Tue, 18 Feb 2025 10:25:43 GMT

Hello Mates!

There is a gateway 77.30, a management server 81.20 and a web server on the LAN with text lists: MD5, SHA1, SHA256, url, domain, hostname. These lists are periodically updated. Is it possible to configure blocking on the gateway based on these lists?

As I understand functions like Custom Intelligence Feeds, Network Feeds do not work on 77.30 gateways?

Re: Updatable blocklists from web-server

Ruan_Kotze — Tue, 18 Feb 2025 11:33:37 GMT

Hi,

Your understanding is correct, network feeds, custom intelligence feeds and data center objects are not supported in 77.30. I'm sure you're well aware but 77.30 also not supported anymore.

Cheers,
Ruan

Re: Updatable blocklists from web-server

Tal_Paz-Fridman — Tue, 18 Feb 2025 12:19:16 GMT

As @Ruan_Kotze correctly wrote, IOC Feeds and Network Feeds work with current versions like R81.20 and R82:

https://support.checkpoint.com/results/sk/sk132193

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Network_Feed.htm?tocpath=_____17

R77.30 has reached End of Support in September 2019 so upgrade would be advised for many important reasons:

https://www.checkpoint.com/support-services/support-life-cycle-policy/#software-support

Re: Updatable blocklists from web-server

gilyazovamir — Tue, 18 Feb 2025 12:45:26 GMT

Thank you, mates!

So I guess there is no other option to block something by lists on 77.30?

Re: Updatable blocklists from web-server

G_W_Albrecht — Tue, 18 Feb 2025 12:53:58 GMT

Please, do not mention R77.30 - does the customer really have support for this version that is out of support for more than 4 years now ? And does he still get the sevices like IPS, AM, AV etc. ?

Re: Updatable blocklists from web-server

PhoneBoy — Tue, 18 Feb 2025 21:45:30 GMT

Even if you could configure R77.30 to block based on one of these lists, you would need to run HTTPS Inspection to block these items effectively.
While HTTPS Inspection does work in R77.30, it lacks SNI support and support for modern TLS ciphers.
Bottom line: upgrade the R77.30 gateway to a supported release.