New Support Portal

[PhoneBoy]

After a soft-launch back in February 2023, we have formally launched a new support portal!

This means https://supportcenter.checkpoint.com (and links to the previous site) now redirect to the new site https://support.checkpoint.com.

It has a completely redesigned interface (mobile-friendly, even!) and has significantly improved performance.

Latest features:

• Subscription to individual SK aritcles (from 30 Jan 2024).

  1. In an SK article, click 'Subscribe' in the top right corner.
  2. To see all these subscribed SK articles, on the main Support Center page, click "My Subscriptions".
  3. Refer to the section "Subscribe to updates for specific articles".

• Subscription to SK articles of types "Product Alert" and "Security Alert" (from 30 Jan 2024).

  1. On the main Support Center page, click "My Subscriptions".
  2. Refer to the top sections "Product Alerts" and "Security Alerts".

• Subscription to SK articles for each Product (from 07 July 2024).

  1. On the main Support Center page, click "My Subscriptions".
  2. Refer to the bottom section "Subscribe to updates for specific products".
  3. The main toggle enables / disables the entire feature (whether to send / not send the weekly email).
     This email will be sent each Sunday and will contain all SK articles that were created / were updated in the past 7 days for the subscribed Products.
     Note - If you disable the main toggle, then this page remembers all your subscriptions for all products.
  4. Click the relevant pillar.
  5. You can subscribe either to all products in this pillar or to specific products.
  6. At the top of this section, you can search for products.
     
     Note - RSS support is not planned at this time.

Feedback is welcome!

Click here to send feedback for Check Point Support Center

[Mikael]

Did you use a domain-object for the exclusion or did you use a custom application in AppCtrl?

I can easily see a domain object failing as the reverse lookup probably won’t look like checkpoint.com…

It would have been nice if the dynamic object for checkpoint services would have included these new servers…

[David_C1]

I used a domain object.

And agreed, it would be nice if the updatable object "Check Point Services" included this, we already have an exception for that.

Dave

[the_rock]

This is what it looks like on R81.20...I checked and nothing changed even since R80.30

Andy

 

[the_rock]

I can definitely confirm what you said as well.

[PhoneBoy]

@Micky_Michaeli can you check to see if we're covering the new SupportCenter in our Check Point Services object?

[HadiFrohar]

@PhoneBoy yes, support.checkpoint.com is included in our Check Point Services objcet

Best regards

[the_rock]

@HadiFrohar Is there a way to confirm 100% everything that is included in CP services object?

Andy

[HadiFrohar]

Hi @the_rock 

Everything related to support.checkpoint.com is included in the object. Is there any issue?

[the_rock]

Hey @HadiFrohar ,

No issues, I was just wondering if there was an official list of FQDNs included in that object, thats all : - )

Cheers,

Andy

[HadiFrohar]

@the_rock all domains included in Check Point services object can be found here: https://secureupdates.checkpoint.com/cp_services/V1_0_0/gw/cp_services_uo

Best regards

[the_rock]

10-4...THANK YOU @HadiFrohar 💪

[David_C1]

There is an issue for me. When I search from https://supportcenter.us.checkpoint.com/supportcenter/portal, the searches go to US based servers. When I search from https://supportcenter.checkpoint.com or  https://support.checkpoint.com, the searches go to Ireland based servers, which we block. We allow traffic to "Check Point Services", but these searches are not being caught by this rule (this rule is before the rule which blocks Ireland).

Dave

[the_rock]

Can you confirm if any of those sites is listed in below list?

https://secureupdates.checkpoint.com/cp_services/V1_0_0/gw/cp_services_uo

Andy

[David_C1]

The drops I'm seeing are not listed in the link above, they are various addresses from AWS (EU West-1).

Dave

[the_rock]

Forgive me if this was asked before, but just to make sure I understand this right. So you have CP services object allowed, but Ireland is blocked in GEO policy?

Andy

[David_C1]

That is correct. In policy layer for Geo-protection, we allow (rule 3) access to "Check Point Services" updatable object, we block (rule 9) access to Ireland (and other countries).

Dave

[the_rock]

Ok, Im just not used to anyone blocking Ireland, thats all : - ). Anywho, so are you saying you actually use legacy geo policy still or are you using updatable objects as you should?

Andy

[David_C1]

We do not use the legacy geo-policy, we use updatable objects.

And yes, we are pretty aggressive in our geo-blocking. Strictly business related.

Dave

[the_rock]

Hm...so appears like fw is doing whats its supposed to do, as it shows blocking Ireland, based on the screenshot you sent, maybe its just the way those sites are being resolved.

Andy

[Tony_Graham]

It's pretty hard to block Ireland these days with all of the email services that run out of there

but we used to block Ireland as it was a source of relentless phishing. 

[the_rock]

I once met old Irish man here in Canada who told me he was 75 and never had a drink in his life...that would be same if you met someone in Italy who never heard of Ferrari...I guess anything is possible : - )

Anyway, maybe Im biased, but I absolutely love Cork, Ireland, best place ever! But yes, you are correct, I had situation once where lots of weird things happened, as customer inadvertantly blocked Ireland, but we totally forgot that S1C CP mgmt instance was running out of there, so took us few hours to sort that out.

Andy

[Tony_Graham]

I am pretty sure MS runs some cloud servers there like hosted Exchange. That's why I think it was a phishing farm for awhile. It seems to have been corrected which is why we no longer block them. Obviously with my last name I am not biased either. 😉

[the_rock]

I definitely remember meeting LOTS of Grahams' in Great Britain : - )

[David_C1]

We have an additional rule to allow access to Microsoft infrastructure using updatable objects (e.g. "Office365 Worldwide Services", "Azure Public Services") before our rules which block destinations based on countries. I see a lot of allowed traffic to Ireland hitting this rule.

The solution for this is for Check Point to update their updatable object to include all the necessary infrastructure (wherever it may be geographically based).

Dave

[the_rock]

You are 100%, sounds most logical to me as well.

Andy

[Tony_Graham]

FWIW, Another problem country is India. A lot of issues like Ireland.

[Pedro_Espindola]

Hey @PhoneBoy ,

It is not working well for me. Is there a way to use the old portal?

The table of contents is really hard to read and the hyperlinks do not work.

[just13pro]

These 2 days, all the SK can't be opened.

Either showing "This site can't be reached" or when able to open, suddenly can go to blank page.

My internet is OK, browse other website no problem.

[David_C1]

Searches are still not working for me, still going to IP ranges not included in the "Check Point Services" updatable object. Another page with the same issue: https://support.checkpoint.com/product-alerts. This is also going to IP addresses (in Ireland) that are not part of the "Check Point Services" updatable object.

Frustrating,

Dave

[the_rock]

O man, that does sound very frustrating...(deep sigh)