BLOCK BAD REPUTATION IPS IN A DYNAMIC WAY

[K_montalvo]

Hello experts,

Kindly guide me if its possible to have like a rule, blade or external connector or any recommended configuration in order to have protection on the Gateway perimeter  to block malicious reported IP address range like botnets, hackers etc? This is with the purpose to reduce having to create objects and manually applied to specific existing block rule on the network access layer.

Thanks!

[Chris_Atkinson · Accepted solution]

ioc_feeds, available natively in R81 SmartConsole - refer sk132193.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics...

Other options exist depending on your enabled blades and might leverage dynamic / imported objects (sk167210) or the available APIs.

[Magnus-Holmberg]

known bad IP shouldn´t that be filtered within the IPS blade?

[Chris_Atkinson]

Anti-bot & Anti-virus have such reputation based protections but if you wish to leverage external or custom feeds you need to use something else.

- ioc_feed

- Network feed objects (R81.20)

[Magnus-Holmberg]

Sure but correct me out am wrong.

anti bot us for outgoing.

having a checkpoint provided ip list of bad stuff for incoming would be great, such as know bot network. Ips would be perfect for this.

[Chris_Atkinson]

"perfect" is relative, some also might prefer fwaccel dos (SecureXL) level mitigation of such similar lists.

[Magnus-Holmberg]

Sure, seen also from check point  side as IPS is something you pay for.

I would be more than happy to have this as a regular dynamic object just as O365 to have “suspected IP ranges and DNS” 

[the_rock]

so true 🙂

[PhoneBoy]

The “incoming only” block for Anti-Bot was fixed in R81.
Even in R80.40 and earlier, while an outbound packet was allowed, the inbound replies were correctly blocked.

[Magnus-Holmberg]

Do you mean that Anti-Bot would block incoming attempts from known “bad” ip addresses to a web server based on these lists it has?

my understanding was been that anti-not was a post infection blade killing the C&C traffic or similar originating from the inside network to destination to C&C “bad ip”

if it dose both then it’s great 🙂
Maybe something I just misunderstood.

[PhoneBoy]

I had it reversed prior to R81: Inbound wasn't blocked, but the outbound reply was.
Either way, in R81 and above, feeds imported via ioc_feeds will be blocked inbound or outbound.
This is documented here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Magnus-Holmberg]

How about anti bot without using custom feeds? 

[PhoneBoy]

On ThreatCloud feeds, I don't believe we block inbound (but could be wrong about that).

[cem82]

To utilise custom feeds do need both AB and AV blades enabled not just one of them in R81.10 anyway

[the_rock · Accepted solution]

Hey bro,

What I always do is use below link, get all IPs from the txt file, slap it in .csv file, import in mgmt, create a rule with group object containing the file you import and thats it.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Chassis_AdminGuide/Topics-Chassis-...

You can also use below sites to confirm if site might be malicious.

https://www.virustotal.com/gui/home/upload

https://www.urlvoid.com

[shanil420]

Hi the_rock!

can you please let me know how to block multiple IP's on Locally managed R81.10.

Thanks & Regards,

Shanil

[the_rock]

Hey @shanil420 ,

Im not overly familiar with SMB appliances, so dont know if same method would work or not, but Im sure there is a way to import a list that can be blocked. Let me spin up a demo and will check for you,

Andy

[shanil420]

Thank you so much for your quick reply. Much appreciate the support 👍

[the_rock]

Im still checking if there is good way to do this on locally managed SMB.

Andy

[Tal_Paz-Fridman]

Please look at IOC Feeds feature:

sk132193 What is the "Custom Intelligence Feeds" feature?

https://support.checkpoint.com/results/sk/sk132193

Also refer to:
https://community.checkpoint.com/t5/Threat-Prevention/CheckMates-Tips-and-Tricks-IOCs-TAXII-feeds-an...

[the_rock]

I was more thinking of adding generic data center object that can be used with .json file to block the bad known IPs, but I dont believe thats possible on locally managed SMB?

Andy

[shanil420]

Thank you so much Tal, appreciate your support.

Since im a newbie is there any way i can apply this using GUI.

[Tal_Paz-Fridman]

Sure! in SmartConsole go to - Security Policies > Threat Prevention > Select any Threat Prevention Policy > At the bottom go to - Custom Policy Tools > Indicators 

[the_rock]

That would work if it was centrally managed, but its NOT...its locally managed.

Andy

[shanil420]

Yes this is locally managed. Is there a way to limit Web console & SSH access by geolocation.?   

[the_rock]

 

[shanil420]

awsome! guess this will help. Thank you so much! 

[shanil420]

Since this is locally managed how can i add Smartconsole. Will it interfere with the LAN network ?

[the_rock]

 

[shanil420]

Will changing this affect my LAN network? As per your view what is the best method to manage checkpoint? can you share me an guide pls