topic Re: Blocking TOR dynamically on Maestro + VSX in Hyperscale Firewall (Maestro)

Blocking TOR dynamically on Maestro + VSX

eliadcourt — Sun, 30 Mar 2025 10:29:37 GMT

Hi everyone.

I wish to block TOR using the list published by CP.

AFAIU, my options are:
1. Network feeds.
2. IOC feeds.
3. Dynamic object.

Network feeds isn't supported on VSX - sk79700.

As for IOC feeds, I had a hard time figuring out if it's supported.
I tried using it, but I couldn't do "Test Feed", as it didn't recognize any FW object.
I've added the object anyway, and installed policy.
Under the new object I don't see any observables.
In CLI, ioc_feeds doesn't show anything.

If I try adding through ioc_feeds, it says it's missing the AV-AB blades, even though they are installed.
We had some weird issue I can't remember right now, that these blades didn't work properly because it needed them to be active on the VS 0 as well.

Last is dynamic object, but building some mechanism is a bit to time consuming right now.

Any thoughts?

Re: Blocking TOR dynamically on Maestro + VSX

Tal_Paz-Fridman — Sun, 30 Mar 2025 12:49:34 GMT

According to the SK for IOC the following is supported:

Only these versions for Scalable Platforms (Maestro and Chassis) support IoC feeds:
- R81.10 and higher (PMTR-65769).
- R80.20SP Jumbo Hotfix Accumulator, Take 283 or higher (MBS-13295).

https://support.checkpoint.com/results/sk/sk132193

Re: Blocking TOR dynamically on Maestro + VSX

eliadcourt — Sun, 30 Mar 2025 12:58:13 GMT

Yeah, sorry, forgot to mention.
We have 81.20 jhf 84 on th SGMs., and jhf 65 on the MGMT.

Re: Blocking TOR dynamically on Maestro + VSX

Wolfgang — Sun, 30 Mar 2025 20:43:03 GMT

@eliadcourt following sk79700, IOC feeds are supported with VSX, only network feeds not.

Re: Blocking TOR dynamically on Maestro + VSX

PhoneBoy — Mon, 31 Mar 2025 15:11:25 GMT

And specifically, it's the "test" functionality that doesn't work.
If you have a non-VSX gateway to validate the feed on, it should work on VSX.