SandBlast limitations

[Hllrdm]

Hello!

We want to check all files on the file storage using the TE 1000X. Is there any information on how to configure the TE1000X to check all new files on the file share?

We are also interested in the technical details of how the TE1000X works. For example, the well-known 100MB file size limit. Are there any other limitations? And where can we find these limitations documented?

[PhoneBoy]

The TE1000X does not reach out and scan file shares, or anything else for that matter, it only emulates files sent to it either from another Check Point gateway or received through an API.
It is managed similar to other Check Point gateways. 

[Hllrdm]

Hello!

Here we need to emulate files that are sent or received in the organization through the Security Gateway. Are there any limitations for these files and for the TE1000X itself?

[PhoneBoy]

It has to be one of the supported types and, yes, the you are limited to 100mb file size.
Note the default is less than that (15mb) and you'll need to configure the limit appropriately. 

[Hllrdm]

Are there any other restrictions besides 100 MB? Could you also clarify where the 100 MB limit is configured?

[PhoneBoy]

There's a table highlighting difference between local and cloud emulation here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

The exact location to configure the file size limit will depend on the version of code you're running on your management.
For R81.10: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ThreatPrevention_AdminGuide/... 

[Hllrdm]

So I understand correctly that there are no restrictions and features in SandBlast other than 100MB?

[PhoneBoy]

Any limitations should be mentioned in the documentation I provided previously.
What precise limitations are you concerned about?

[Hllrdm]

I'm interested in all the constraints. I don't see all the explicit limitations in the documentation. Can you tell me in which section I should look for restrictions?

[PhoneBoy]

I don't think there's a specific section of the documentation that says "limitations."
Best to fully read the documentation to understand how the solution is deployed.

[Hllrdm]

Therefore, I started this topic, since the documentation does not say about the limitations in SandBlast. Even the 100 MB limit is clearly not written. Can you have information from personal experience?

[PhoneBoy]

Limitations are somewhat "point of view" dependent and I don't think every vendor lists them all.
We do provide our partners some competitive materials that compare our Threat Emulation to other similar solutions, which might give you a better idea.