Multi-CMA Shared Object Group - For blocking AbUsers

[Rafee]

- Is there an option to create a global object group which can be shared across multiple CMA's for blocking AbUsers as we need to keep adding the IP's on daily basis which takes lot of effort.

- do we have a better way of handling AbUsers across multiple CMA's by reducing the effort of manually adding IP's to each object group across multiple CMA's

Thank you in Advance!

[PhoneBoy]

You can create global objects at the MDS level and share them.
However, that also means you will need to push policy to all the gateways in all the relevant CMAs upon making any changes.

There are far better ways to accomplish this that require far less effort:

• Using ioc_feeds https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... (requires Anti-Bot and/or Anti-Virus to be enabled on relevant gateways)
• Generic Datacenter objects (available from R81): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 
• Network Feed objects (available from R81.20): https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuid...

For ioc_feeds, you need to have Anti-Bot or Anti-Virus blade enabled .
For Generic Datacenter and Network Feed objects, the object should be defined per-domain and referenced in the Access Policy.
The gateways will periodically fetch the feed, maintaining a consistent posture across CMAs without the need to push policy or additional configuration changes.