CLOB and Classifiers

[valterj]

Hi, all. 

Could someone explain me the relationship between Classifier and CLOB? I understood that Classifier will define which blade will handle with that packet, based on your type, and attach and tag/object ID for this packet based on the blade. How about CLOB? Is it a part of the classification process or the result of classification? How CLOB is generated? 

Regards. 

Valter Junior

[Chris_Atkinson]

@HeikoAnkenbrand Talks about these here:

R80.x Security Gateway Architecture (Content Inspe... - Check Point CheckMates
R81.x Security Gateway Architecture (Logical Packe... - Check Point CheckMates

Please also review sk120964 and see if it helps with your understanding.

[valter_esjunior]

Hi, all.

I've returned for this topic because these terms still not clear for me. 

• Classifiers are used to identify which blade will handle with that connection?
• From that specific connection, CLOBs are objects, information that the Classifier "extracts" from a packet in that connection?
• For each transcation inside a connection, a HANDLE determines which module will inspect each packet in that flow?

• The Observer decides if enough information is known to publish a CLOB to the security policy? CLOBs are observed in the context of their transaction and the connection that the transaction belongs to. The Observer may request more CLOBs for a dedicated packet from the Classifier or decides that it has sufficient information about the packet to execute the rule base on the CLOB. That's it?

I'm trying to understand how this flow works since the first packet in a connection arrives the Security Gateway. 

Regards!

[Chris_Atkinson]

Question: Classifiers are used to identify which blade will handle with that connection?

Answer: Classifiers are blade-specific modules that analyze traffic and assign CLOBs to classification results. They:

• Tag traffic with CLOB object IDs, such as application, file type, and user.
• Notify the Manager of matches for further processing.

A blade can have multiple Classifiers.

Question: From that specific connection, CLOBs are objects, information that the Classifier "extracts" from a packet in that connection?

Answer: A CLOB (Classification Object) contains packet data used for security decisions, including application, Security Zone, Dynamic Object, file type, and access Role.

Kernel debug displays CLOB types as numeric IDs. Common types include:

CLOB_TYPE_APPLICATION 1

CLOB_TYPE_SOURCE_NETWORK 2

CLOB_TYPE_DESTINATION_NETWORK 3

CLOB_TYPE_SERVICE 4

CLOB_TYPE_SOURCE_ACCESS_ROLE 7

CLOB_TYPE_SOURCE_FQDN_DOMAIN 32

CLOB_TYPE_DESTINATION_FQDN_DOMAIN 33

CLOB_TYPE_FILE 41

CLOB_TYPE_CONTENT 42

Question: For each transcation inside a connection, a HANDLE determines which module will inspect each packet in that flow?

Answer: A Handle tracks each transaction’s rulebase state and CLOBs. It aggregates classification data, including applications and categories, until a decision point triggers rulebase execution.

Question: The Observer decides if enough information is known to publish a CLOB to the security policy? CLOBs are observed in the context of their transaction and the connection that the transaction belongs to. The Observer may request more CLOBs for a dedicated packet from the Classifier or decides that it has sufficient information about the packet to execute the rule base on the CLOB. That's it?

Answer: Observers gather and refine CLOBs for advanced inspection. Each Observer registers for one or more CLOB types. For example:

• The Application Observer collects application and URL categorization CLOBs.
• The Content Observer collects file type and content CLOBs.

The Manager notifies Observers, which can trigger further classification or rulebase evaluation.

For more information this topic is also covered in the CCTE course.