Custom Intelligence (IoC) Feeds protection directions - inbound / outbound

[Emil_T]

Hi

I need a clarification regarding protection direction of the feature. The article https://support.checkpoint.com/results/sk/sk132193 does not explicitly mention whether the protection applies to inbound, outbound or bi-directional traffic. I've come across some discussions around it, but would prefer a more clear / official answer.

Based on testing I performed, it appears that the feature blocks only inbound traffic. For example, if one sends ping (icmp echo request) from LAN to internet, the request is accepted, but the corresponding reply is blocked blocked. Same with telnet or any other protocol. The unidirectional enforcement may not align with standard security requirements which typically expect traffic  to be restricted in both directions.

      

1. Is there any formal documentation or knowledge base article that confirms the intended protection direction ?

Thx

[the_rock · Accepted solution]

I also got confirmation last year from TAC it would only apply inbound. The sk you mentioned is the best reference. 

Andy

[Emil_T]

The should really state it clearly in the documentation. It's very misleading.

[the_rock]

I understand. You can always give feedback at the bottom and mention it.

Andy

[the_rock]

I just gave the feedback and got automated email right away. I will update you once someone responds.

Andy