topic Re: Want to Block IP in CLI. in Hyperscale Firewall (Maestro)

Want to Block IP in CLI.

maxtaan — Sun, 30 Jul 2023 07:59:05 GMT

I want to block a lots of ip(around 2k-2.5k). But in smartconsole, if i want to add them it is kind of impossible task to create 2.5k object manually and add them in a group.

So i want to know is there any option/command/way to add these ip via CLI? and create object against an single ip via CLI? and also add them in a group(new/existing) at a one time?

Re: Want to Block IP in CLI.

Chris_Atkinson — Sun, 30 Jul 2023 09:03:41 GMT

There are some different options available depending on the gateway version and what blades are enabled?

Re: Want to Block IP in CLI.

maxtaan — Sun, 30 Jul 2023 09:26:01 GMT

fw vpn cvpn urlf av appi ips anti_bot ThreatEmulation content_awareness Scrub, these fiewall blade i have enabled. Plese provide me all the way or one working way.

OS ver: r81.10(Scalable)

Re: Want to Block IP in CLI.

Chris_Atkinson — Sun, 30 Jul 2023 10:37:05 GMT

CLI or other bulk method examples include:

fwaccel dos deny / blacklist - see Here or Here
Custom Intelligence Feeds (ioc_feeds) - see Here and Here
Management CLI / API - see Here
Generic Datacenter objects - see Here and Here
Network Feeds (R81.20) - see Here

Re: Want to Block IP in CLI.

maxtaan — Sun, 30 Jul 2023 09:59:40 GMT

How can i use them? any guide or video? Please help me with details things.

Re: Want to Block IP in CLI.

the_rock — Sun, 30 Jul 2023 17:15:53 GMT

I attached some things for you that can help. Json files, you can use for DC objects in a rule (automatically updated every 5 mins), as well as where you can create indicators themselves). I also pasted some useful links below. You can also make your own ioc feed file.

Andy

https://community.checkpoint.com/t5/Partner-Community/How-often-do-ioc-feeds-get-updated/m-p/187524#M1607

https://support.checkpoint.com/results/sk/sk132193

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_ThreatPrevention_AdminGuide/Topics-TPG/Configuring_Threat_Indicators.htm?Highlight=show%20_interval

https://community.checkpoint.com/t5/Security-Gateways/What-is-the-maximum-IOC-feed-range/m-p/174070#M31650

Re: Want to Block IP in CLI.

the_rock — Sun, 30 Jul 2023 17:20:31 GMT

However, IF you prefer to add IPs manually, you can do it via API, example below. Then, once those addresses are in dashboard, its easy to group them.

Andy

https://sc1.checkpoint.com/documents/latest/APIs/#~v1.9%20

mgmt_cli add host name "BAD_185.206.27.13" ip-address "185.206.27.13" --format json
mgmt_cli add host name "BAD_162.208.16.20" ip-address "162.208.16.20" --format json
mgmt_cli add host name "BAD_89.248.165.131" ip-address "89.248.165.131" --format json
mgmt_cli add host name "BAD_185.206.24.70" ip-address "185.206.24.70" --format json
mgmt_cli add host name "BAD_162.208.16.14" ip-address "162.208.16.14" --format json
mgmt_cli add host name "BAD_87.251.75.45" ip-address "87.251.75.45" --format json
mgmt_cli add host name "BAD_185.206.24.50" ip-address "185.206.24.50" --format json

Obviously, you can give them any name you like : - )

Re: Want to Block IP in CLI.

Bob_Zimmerman — Mon, 31 Jul 2023 04:04:45 GMT

The big differences:

fwaccel dos deny / blacklist is handled on the firewall's command line. Good for immediate, but short-lived blocks.
Management CLI / API is handled on the management server's command line (or web calls to the management server). You end up with objects in your management server which you can later see with SmartConsole. This is good for long-lived stuff you don't expect to change frequently. Requires a policy push to take effect.
ioc_feeds, generic datacenter objects, and R81.20 network feeds cause the firewall to download a list from some external system. ioc_feeds only blocks the things in the list. Generic datacenter objects and R81.20 network feed objects could potentially be used to allow the things in the list. If you have an incident response team which is separate from the firewall team, these features can allow the incident response team to block attackers more quickly by updating a feed which they control.

Re: Want to Block IP in CLI.

Hugo_vd_Kooij — Mon, 31 Jul 2023 07:52:02 GMT

I would most definitly put a tag on them. It has become my "standard" in all scripting to add a tag to objects so I can easiliy use the tag later. Some scripts add up to 3 different tags as it makkes sense in our setup.

Re: Want to Block IP in CLI.

maxtaan — Mon, 31 Jul 2023 17:06:47 GMT

Hello @the_rock Sir,

Mgmt API works only for r81.20. But Environment where i need to add multiple IP it's run on r81.10. And others procudre is so complex(sorry to say). Is these are the best practice for add multiple ip's??

We can add multiple url by exporting .csv file. Is there any option/way like that?

Re: Want to Block IP in CLI.

Dario_Perez — Mon, 31 Jul 2023 17:10:23 GMT

I think fwaccel dos deny is the best way to do this

Re: Want to Block IP in CLI.

the_rock — Mon, 31 Jul 2023 17:11:15 GMT

That process works 100% on R81.10, done it many times.

Yes, you can use CSV, but its more appliabce when adding them to app site, as shown below, which you can then use in the rule, as long as you have appc/urlf blade enabled.

Andy

Re: Want to Block IP in CLI.

the_rock — Mon, 31 Jul 2023 17:15:54 GMT

Excellent point @Dario_Perez

@maxtaan Please refer to below, it has all you need.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/PTG/SecureXL/fwaccel-dos-deny.htm

https://support.checkpoint.com/results/sk/sk112454

Re: Want to Block IP in CLI.

maxtaan — Mon, 31 Jul 2023 17:18:01 GMT

Hello @Dario_Perez ,

Is it works in maestro (security group and r.81.10) environment?

Re: Want to Block IP in CLI.

Dario_Perez — Mon, 31 Jul 2023 17:36:26 GMT

check https://support.checkpoint.com/results/sk/sk112454

is supported starting R80.20SP with jumbo, which is included on R1+

Also I have used before.

Re: Want to Block IP in CLI.

JH_Ranger — Wed, 25 Jun 2025 03:52:09 GMT

Hi maxtaan, have you managed to apply the fwaccel dos deny in Maestro? I would also prefer to use fwacccel, as it's a lot quicker than doing policy drops.

Also not sure if that command supports dropping entire subnets. The Threat Prevention guide only mentions singular IPs.

Re: Want to Block IP in CLI.

Wolfgang — Wed, 25 Jun 2025 05:02:14 GMT

@JH_Ranger it's supported with Maestro and you can add subnets.

see fwaccel dos deny

Re: Want to Block IP in CLI.

garrod — Wed, 25 Jun 2025 05:58:53 GMT

Hi,

IOC Feeds can come in Handy, by using a text file or TOR list, you can block list of IP Addresses with no hassle.

https://support.checkpoint.com/results/sk/sk132193