IP Reputation & Custom Intelligence Feeds

[62742738]

Which does security gateway look for first? Custom Intelligence Feeds or the IP Reputation?

Because the traffic of a certain IP is getting blocked but it is not included in the custom feeds and the logs show that it is due to IP reputation.

[_Val_]

The answer is, both at the same time. If an IP appears in either, it will be blocked. 

[62742738]

Do you have any idea as to why an IP keeps getting blocked despite its exclusion from custom feeds and the logs show that it is due to IP reputation?

[PhoneBoy · Accepted solution]

If traffic is blocked due to your configured Threat Intelligence feeds, the logs will reflect that.
IP Reputation comes from ThreatCloud and is enforced by AntiBot and/or AntiVirus blades.
You can configure a specific exclusion for this IP address in your Threat Prevention policy.
If you think the relevant IP address is not malicious/bad reputation, please contact TAC to have the situation reviewed: https://help.checkpoint.com 

[62742738]

Alright, got it. Thank you!