SandBlast Now TechTalk Video and Slides

[PhoneBoy]

Below is an excerpt from our TechTalk with @Nir_Naaman on Threat Hunting with Sandblast Now.

Available to CheckMates members:

• Full Video
• Slides

Q&A will be added as a comment to the post.

[PhoneBoy]

Can SandBlast Now Be Used on Any Check Point Appliance?

SandBlast Now can be enabled on most Check Point appliances with an active NGTX subscription. It cannot be enabled currently on:

• SMB Appliances (6xx/7xx/9xx/11xx/1200R/14xx)
• Scalable Platforms (41k/44k/61k/64k)

How are Appliances Managed with SandBlast Now?

Using the SandBlast Now portal, which is web-based and hosted in our cloud.

Are there SandBlast Now-specific Appliance SKUs?

Yes, but they are regular Check Point appliances with failopen NICs. 

Do the Failopen NICs Work with the Power Out?

When the power is out, the NICs are passthru at the hardware level.

How do I get the SandBlast Now Portal Activated for Production or Evaluation?

Please check with your local Check Point SE. The standard "all-in-one" evaluation license can be used for evaluating SandBlast Now.

Is HTTPS Inspection Supported?

Not yet, but it is on the roadmap.

[Nir_Naaman]

Some clarifications:

Are there SandBlast Now-specific Appliance SKUs?

Yes, but they are regular Check Point appliances with failopen NICs. 

There are indeed six NOW SKUs. These are bundles that include NGTX plus the 4 port copper 1Gbps fail-open NIC. However, NOW is a supported mode of operation for any NGTX gateway.

For example, there are NOW SKUs for the 5400 and 5800 appliances: CPAP-5400-NOW and CPAP-5800-NOW. However, if you need a 5600, or even a 5800 with a 10 Gbps fiber fail-open NIC, just purchase the corresponding NGTX appliance.