AV blade/user check/windows updates

[the_rock]

Hey guys,

Figured would share this, since customer and I had been working with TAC escalation guy for couple weeks and he told us would probably open a task with R&D to see if there is a way to make block page come up every time when specific file types are blocked (in our case msi and exe). Its somewhat inconsistent at this point, since random sites dont show block pages when msi file is blocked and some are even allowed. I will update once we have fully working solution, but in the meantime, figured would share some screenshos that can hopefully help others if you find yourself in similar situation.

Andy

[Lesley]

I don't fully understand the issue, but here is what I can see

screenshot 1, I would the recommended bypass object listed in this SK:

https://support.checkpoint.com/results/sk/sk163595

Screenshot 7 rule 1 this rule will not match the traffic becuase it is set to N/A.
Therefore it will not hit the blades. I would recommend to right click it and add the blades you want to exclude(in this case AV)

[the_rock]

Hey Lesley,

We had problem where windows updates were not working when msi and exe files were blocked through AV blade.

Andy

[JaAnd]

Hi Andy,

maybe you could try to add in DST Updateble Object of recommended by CP HTTPS inspection bypass for Microsoft updates? It seems to be quite accurate in my use cases. Of course it might be sometimes to wide, but MS seems to be unpredictable in some ways 😜 Maybe good old manually defined URLs would do the job?

[the_rock]

Hey @JaAnd  🙂

Yes, thats what we did, just added microsoft defender and it worked. Regardless, blocking files and showing block page is absolutely needed and it has to work CONSTANTLY, which sadly, is far from what happens now.

Andy

[the_rock]

For what its worth, TAC guy originally had us add akamai, cloudflare and github to bypass, but though that fixed windows updates, it broke few sites for ssl inspection.

Andy