Creating Malicious URL

[ihenock101]

I have checkpoint firewall and when I create custom application/sites by default it creates services like http, https, HTTP_proxy, and HTTPS_proxy and I have two questions regarding this, the first one is what are this services used for in the Application/sites the second is usually I used to block malicious or suspicious urls through this application/sites object category the question is which place is best to place these app/sites groups either on the destination or in the services section on the rule base?

Regards,

[G_W_Albrecht · Accepted solution]

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Chris_Atkinson]

Those services typically represent the default ones to which URL filtering / AppC policy is applied unless you have the non-standard ports option enabled.

The latter depends on the object type, "domain" objects can be used in the destination of a FW/Access policy but a site/category is typically in the services column depending on the blades enabled.

[PhoneBoy · Accepted solution]

There are a couple different ways to block URLs:

• Adding them as part of Custom Application/Site objects in the Access Policy (requires a policy install to change)
• Using ioc_feeds with the AV/AB Blades: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...
• In R81.20, using a Network Feed object: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

ioc_feeds doesn’t use the Access Policy at all.
For the other two methods, you can put the relevant object in the Access Policy with appropriate rules to block traffic to and from those IPs.