Memory Utilization on IP Address blocked in the Firewall.

[keydee]

Our team is going to block a thousand ip address for incoming traffic in our firewall, however, here's our inquiry. "Can the firewall accommodate thousands of objects created on the checkpoint firewall? how impactful would it be on checkpoint's resources given that it is saved on the memory.

[PhoneBoy · Accepted solution]

There are several mechanisms you can use to block IP addresses, none of which should necessarily be limited by memory.
That said, operationally speaking, having thousands of objects for IPs you want to block is probably not the right approach.
Not to mention every time you add such an IP, you'd have to push Access Policy.

You might want to explore some of the options here, none of which involve creating objects, but does involve CLI commands: https://community.checkpoint.com/t5/Threat-Prevention/Blocking-IP-address/m-p/34587#M1048 

You can also use the ioc_feeds feature to have Threat Prevention block the IPs: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

For R81 gateways, you might want to look into the Generic Data Center objects.
This will allow you to create a single object that's fed via a JSON file that can be hosted on any web server that the gateways will periodically pull and enforce without a policy installation.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

Even without Generic Data Center objects, you can use a Dynamic Object to achieve something similar (requires CLI commands on each gateway to manipulate): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

Lots of ways to approach this.

[Bob_Zimmerman]

Regarding the dynamic object option, it's also worth mentioning cprid_util (sk101047). It can help run the CLI commands on each firewall without needing to actually log in to each firewall.

These are all much better options than creating host or network objects and sticking them in a group. Manual objects stuck in a group don't really cause problems on the firewalls, but they dramatically slow down the management server's policy verification process. I have a few firewalls too old to support Geo Protection, so somebody made on the order of 30,000 network and address range objects for IP blocks owned by countries my company does no business in. Verification times went from ~3 minutes to ~15 minutes. The firewalls themselves are perfectly fine, though.

[the_rock]

@PhoneBoy gave you all valid options. Honestly, updatable objects is one very good option here, because put it this way...no one wants to sit there and keep adding IP addresses manually every time you wish to block something. Yes, there is API for that, it would be faster, but still, lots of work regardless.

[PhoneBoy]

I forgot one option: using the Identity Awareness API and Access Roles.
See: https://sc1.checkpoint.com/documents/latest/IdentityAPIs/#ida_api_intro~v1%20