IP and URL Block Feature
Check Point Maestro R80.20SP Administration Guide | 221
IP and URL Block Feature
Starting in Take 209 of R80.20SP Jumbo Hotfix Accumulator (
), you can use new tools to block
malicious traffic:
The "
ip_block
" command that lets you block malicious traffic to or from certain IP addresses (see
).
The "
url_block
" command that lets you block malicious traffic to or from certain URLs (see
).
In addition, refer to
.
IP Block Feature
Description
The IP Block feature provides the ability to block malicious traffic to and from certain IP addresses.
The IP Block feature requires the list of malicious IP addresses as a feed (URL).
The IP Block feature runs periodically, fetches the IP list again and updates the IP addresses in the
Security Gateway based on the list in the feed.
The blocking mechanism is enforced by an Access Control rule with a Dynamic Object.
Check Point's Security Intelligence maintains and periodically updates a list of IP addresses known as TOR
Exit Nodes:
https://secureupdates.checkpoint.com/IP-list/TOR.txt
Best Practice
- We recommend to consider the "Custom Intelligence Feeds" from
Note
- These IP ranges are excluded by default: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
