Checkpoint option for DMZ-based update server

[Garrett_DirSec]

Hello Checkmates --

What are checkpoint options for deployment of dedicated "update server" to be placed on DMZ allowing Security Gateways to receive updates for advanced blade features.

This not a new topic for certain Govt networks and Utility SCADA networks where Internet isolation is best practice. 

The keys:

1) advanced features enabled on Checkpoint gateways:   IPS, Antibot, AppCtl.

2) checkpoint gateway can't talk outside local network (ie.   can't communicate directly with Checkpoint public update servers).

3) granular communication to specific "update server" on DMZ is permissible.    

Advise on thoughts.    thx

[Bob_Zimmerman]

The term you should ask about is "Private Threat Cloud" or PTC. My environment has some. I strongly recommend against them. They've given us nothing but headaches.

[Garrett_DirSec]

Hello @Bob_Zimmerman -- thanks for the quick reply and insight.

Yes -- I suggest the customer will be excited about solution:

1) not a headache

2) no additional cost

[Chris_Atkinson]

PTC or a Proxy are the solutions that come to mind.

[PhoneBoy]

IPS and App Control have actual signatures that can be downloaded.
Most everything else is a dynamic lookup to ThreatCloud, for which you would need Private ThreatCloud: https://support.checkpoint.com/results/sk/sk149692