Custom Feed Blocking - SK103154

[kevin_t]

We are currently implementing the SK103154 to block known TOR nodes/IP addresses that Checkpoint provides.  We are trying to add more feeds to this custom list though, and they appear to not be reflecting in the gateways.  Specifically this URL:

https://talosintelligence.com/documents/ip-blacklist

The Checkpoint feeds work just fine, but this Talos one will not.  Anyone have any ideas on why this might be?  We are on R80.20

Relevant SK:  https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[PhoneBoy]

Any error messages that might provide a clue?

[kevin_t]

No error messages, it works when I enable the custom threat feeds.  It is just that nothing populates when I run the command "fw samp get | grep threatcloud_ip_block"

[PhoneBoy]

So it is blocking the IPs, just not showing in the appropriate list?
That might be worth a TAC case.

[Martin_Valenta]

Talos is returning http 429 code, when you try to pull their IP list to often, so you just might get blocked for certain period of time..