Product Limitations

Automatic Enablement of Anti-Bot Anti-Virus and Threat Emulation Blades

• Threat Prevention Software Blades are not enabled automatically when you create a new Security Gateway or Cluster Two or more Check Point Firewalls that work together in a redundant configuration - High Availability, or Load Sharing. object in these ways:

  • In Desktop SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. when you select the Wizard Mode.

  • In Web SmartConsole.

  • Using a Management API command (add simple-gateway / add simple-cluster).

• Threat PreventionSoftware Blades are not enabled automatically on these devices:

  • Standalone Configuration in which the Check Point Firewall and the Security Management Server products are installed and configured on the same server. (Security Gateway and Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. on the same server).

  • Traditional VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Firewalls and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Gateway and Traditional VSXVirtual System.

  • Spark Firewall appliances.

  • Full High Availability Cluster (ClusterXL and Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. on the same server).

Zero Phishing

• In-browser Zero Phishing Software Blade on a Check Point Firewall (R81.20 and higher) that provides real-time phishing prevention based on URLs. Acronym: ZPH. does not support Internet Explorer.

• JavaScript injection for HTTP 2.0 connections is not supported.

• In-browser Zero Phishing does not support mirrored traffic (Mirror Port, Span Port, Tap mode)..

Policy Installation

• In the first installation, you cannot install both the Access Control and Threat Prevention policies on the same gateway at the same time. You must install one and then the other.

Anti-Virus

• VSNext does not support Anti-Virus Software Blade on a Check Point Firewall that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Check Point Firewall before users are affected. Acronym: AV. archive scanning.

IPS

• Check Point does not support JA3 and JA4 profiling technologies.

Malware Prevention using IP and Port Indicators

• Malware Prevention using IP and Port Indicators supports only IPv4 traffic.

• Malware Prevention using IP and Port Indicators is disabled when the Security Gateway is not connected to the Internet.

Threat Emulation

• Threat Emulation Software Blade on a Check Point Firewall that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. is supported only on Private ThreatCloud The cyber intelligence center of all of Check Point products. Dynamically updated based on an innovative global network of threat sensors and invites organizations to share threat data and collaborate in the fight against modern malware. Appliances with Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. OS 64-bit .

  Threat Emulation is not supported on:

  • IPSO OS.

  • Windows OS.

• 3900 appliances do not support local emulation (Known Limitation PMTR-115010).

• TE100X, TE250X, TE1000X, TE2000X models do not support R82 and higher versions.

• ThreatCloud emulation and remote emulation are not supported on Virtual Systems in Bridge Mode Check Point Firewall or Virtual System that works as a Layer 2 bridge device for easy deployment in an existing topology. because they have no IP address.

• In cluster, Threat Emulation local cache is not synchronized.

• When a file is processed over HTTP, UserCheck Functionality in a Check Point Firewall and endpoint clients that gives users a warning when there is a potential risk of data loss or security violation. This helps users to prevent security incidents and to learn about the organizational security policy. cannot send messages in the browser after the download started.

  • New malicious files require UserCheck agent to display the UserCheck message

  • For malicious files that are known to Threat Emulation, UserCheck messages can be displayed in the browser.

• For local emulation, Threat Emulation uses port 8080 and requires it to be free and available, and no other service is allowed to use it, including WebUI.

• In the Monitor (SPAN / TAP) deployment:

  • The Prevent UserCheck rule action that blocks traffic and files and can show a UserCheck message. action in the Threat Prevention policy is not supported.

  • HTTPS Inspection Feature on a Check Point Firewall that inspects traffic encrypted by the Secure Sockets Layer (SSL) protocol for malware or suspicious patterns. Synonym: SSL Inspection. Acronyms: HTTPSI, HTTPSi. is not supported.

  • SMTPS over TLS inspection is not supported.

• Custom OS images are not supported for cloud emulation.

• Alternative OS images are not supported for local and remote emulation.

• An appliance has a smaller data sample set compared to cloud emulation, which may impact detection accuracy.

• Update of OS Images Local and Remote Emulation must be manual. You must download the required images and schedule the update to avoid disrupting operations.

• In Local and Remote emulation, Shared Threat Database takes time to update which may result in potential delay in threat intelligence.

• Not defining the topology in the Security Gateway object may cause:

  • Internal files sent to the cloud (potential privacy concern).

  • ThreatCloud quota overuse.

  • Impact on performance, because more files are emulated than necessary.

• Multiple file execution is not supported with executable files, or CPU-Level images.

• Running a local Threat Emulation appliance as a StandAlone (both a Security Management Server and Security Gateway are installed on the same device) is not supported.

• If the Anti-Virus blade is also enabled, there is an expected degradation in Threat Emulation performance of approximately 5-10%.

• VSX and VSNext do not support local emulation.

• VSNext does not support Threat Emulation archive scanning.

• VSNext does not support using a Mail Transfer Agent Feature on a Check Point Firewall that intercepts SMTP traffic and forwards it to the applicable inspection component. Acronym: MTA. for Threat Emulation.

• Spark Firewall appliances and Threat Emulation appliances do not support Autonomous Threat Prevention.

Threat Extraction

• Threat Extraction Software Blade on a Check Point Firewall that removes malicious content from files. Acronym: TEX. web support applies to web downloads, but not web uploads.

• Supported file types for web are: Word, Excel, PowerPoint and PDF.

• Threat Extraction supports these file types and extraction methods:

  Format	Extensions	Mail / Web / Both	Supported Extraction Methods
  Adobe FDF	fdf	Both	Extract/Convert to PDF
  Adobe PDF (all versions)	pdf	Both	Extract/Convert to PDF
  Microsoft Docfile	Microsoft Visio, Microsoft Project, and so on	Mail	Extract/Convert to PDF
  Microsoft Excel 2007 and above	xlsx, xlsb, xlsm, xltx, xltm, xlam	Both	Extract/Convert to PDF
  Microsoft Excel 2007 Binary	xlsb	Both	Extract/Convert to PDF
  Microsoft Excel 97 - 2003	xls	Both	Extract/Convert to PDF
  Microsoft PowerPoint 2007 and above	pptx, pptm, potx, potm, ppam, ppsx, ppsm	Both	Extract/Convert to PDF
  Microsoft PowerPoint 97 - 2003	ppt, pps, pot, ppa	Both	Extract/Convert to PDF
  Microsoft Word 2007 and above	docx, docm, dotx, dotm	Both	Extract/Convert to PDF
  Microsoft Word 97 - 2003	doc, dot	Both	Extract/Convert to PDF
  Rich Text Format	rtf	Both	Extract/Convert to PDF
  Compressed graphic Format JPEG	jpeg,jpg,jpe,jfif	Mail	Extract/Convert to PDF
  Multi Picture Format File	mpo	Mail	Convert to PDF
  Ichitaro word proccessing application	jtd	Mail	Convert to PDF
  Hanword	hwp	Mail	Convert to PDF
  Graphics interchange Format	gif	Mail	Extract/Convert to PDF
  Tagged Image File Format	tif,tiff	Mail	Extract/Convert to PDF
  Portable Network Graphics	png	Mail	Extract/Convert to PDF
  Bitmap image file	bmp	Mail	Extract/Convert to PDF
  Device independent Bitmap file	dib	Mail	Convert to PDF
  Encapsulated Postscript file	eps	Mail	Convert to PDF
  adobe Photoshop Document	psd	Mail	Convert to PDF
  Targa Graphic	tga	Mail	Convert to PDF
  Paintbrush bitmap image file	pcx	Mail	Convert to PDF
  DICOM image	dcm	Mail	Convert to PDF
  JavaScript File	js	Mail	Convert to PDF
  Extensible Markup Language	xml	Mail	Convert to PDF
  Plain Text file	txt	Mail	Convert to PDF
  Hypertext Markup Language	html	Mail	Convert to PDF

• In a cluster, Threat Extraction is only supported in High Availability mode.

Traditional Anti-Virus

VSX and VSNext do not support Traditional Anti-Virus.

Anti-Spam

• VSX and VSNext do not support Anti-Spam Software Blade on a Check Point Firewall that provides comprehensive protection for email inspection. Synonym: Anti-Spam & Email Security. Acronyms: AS, ASPAM..

• Scalable Platformssupport Anti-Spam in Security Gateway mode only.

Autonomous Threat Prevention

• Spark Firewall appliances and Threat Emulation appliances do not support Autonomous Threat Prevention.

• Autonomous Threat Prevention does not support MTA. To manage a Security Gateway as an MTA, use Custom Threat Prevention.

• The Global Domain does not support Autonomous Threat Prevention. Other Domains support it.

MTA

• The 3900 appliances do not support Mail Transfer Agent (Known Limitation PMTR-115040).

• Autonomous Threat Prevention does not support MTA. To manage a Security Gateway as an MTA, use Custom Threat Prevention.

• There is no option to use multiple certificates for different mail servers.

• For performance reasons, it is recommended to deploy one Security Gateway for MTA and Anti-Spam, and another Security Gateway for Threat Emulation and Threat Extraction

• MTA uses the same static rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. for all emails.

ICAP

• ICAP is not supported in Autonomous Threat Prevention, it is supported only in Custom Threat Prevention mode.

ICAP Client

• ICAP Client The ICAP Client functionality in a Check Point Firewall that enables it to interact with an ICAP Server responses (see RFC 3507), modify their content, and block the matched HTTP connections. does not support ClusterXLLoad Sharing mode.

• ICAP Client does not work when strict hold is active (Anti-Virus in deep scan mode, Threat Extraction on HTTP, Threat Emulation in Hold mode).

• There is no full Fail-Open support. In case of HTTP / HTTPS requests or responses with body and with only a single ICAP Server The ICAP Server functionality in a Check Point Firewall that enables it to interact with an ICAP Client requests, send the files for inspection, and return the verdict. Service, the Fail Mode is always Fail-Close.

  ICAP Client in Check PointSecurity Gateway can support the Fail-Open with the Trickling From The End mode (see Configuring ICAP Client Data Trickling Parameters).

• There is no true data-modification (meaning, no true content adaptation) during the data trickling.

  In the Trickling at the End mode, there is no data modification at all.

• Data Trickling (both Trickling from the Start and Trickling at the End modes) cannot work when there is no Content-length header in the HTTP message.

• Web extraction does not support ICAP Client functionality.

ICAP Server

• ICAP Server supports Anti-Virus deep-scan, but does not support any additional functionality, such as MD5 hash, URL reputation, and signature-based protection

• ICAP Server functionality is not supported in ClusterXL Load Sharing mode

• ICAP Client does not support ClusterXLLoad Sharing mode.

• You cannot create exceptions for an ICAP rule.

• Traditional VSX does not support ICAP Server..

• Scalable Platforms do not support ICAP Server.

• When using ICAP Server,in Threat Emulation > General > Protected Scope, Threat Emulation scans all files, regardless of the option you select.

SSH DPI

SSH Deep Inspection supports only these blades:

• Anti-Virus

• IPS Software Blade on a Check Point Firewall that inspects and analyzes packets and data for numerous types of risks (Intrusion Prevention System).

• Threat Emulation

UserCheck

When processing a file over HTTP, UserCheck cannot send messages to the browser after the download started:

• For newly identified malicious files, the UserCheck Agent is required to display the UserCheck notification.

• For files already known to be malicious by Threat Emulation, the UserCheck messages can be displayed in the browser.

The SMTP protocol does not provide a user interface for displaying UserCheck messages:

• For the Anti-Virus, IPS and Threat Emulation blades - The UserCheck agent is supported only when a client uses SMTP to send an email through the SMTP server.

• Sending UserCheck notifications through email is not supported for Anti-Virus, IPS and Threat Emulation.

• For the Threat Emulation and Anti-Virus blades - To provide user-friendly notifications over email, configure the Security Gateway as a Mail Transfer Agent - When a malicious attachment is detected, it is replaced with a text file.

Monitoring Threat Prevention

The number of packet captures that the Security Gateway can send to the Log Server Dedicated Check Point server that runs Check Point software to store and process logs. does not exceed 25 per second.

HTTPS Inspection

• CRL validation is not supported in pure IPv6 environments (when IPv4 addresses are not configured on the Security Gateway's interfaces).

• In the HTTPS Inspection policy, when selecting the same action that already appears in the Action column, the Security Management Server records it as a change within the SmartConsole session.

• The Security Gateways supports HTTP/3 inspection only when it runs in the User Space Firewall (USFW) mode, which is the default in versions R82 and higher.

• The Security Gateway downgrades HTTP/3 traffic to an earlier HTTP version when it operates in the kernel mode firewall.

  For information about the User Space Firewall (USFW) mode, see the Release Notes for your version and sk167052.

• The Security Gateway drops HTTP/3 traffic when the Threat Prevention "Deep Inspection" mode is enabled.

• Chromium-based web browsers allow HTTP/3 traffic only if the HTTPS Inspection certificate is signed by a trusted CA from the Chromium trust list.

• Chromium-based web browsers do not allow adding certificates for HTTP/3 traffic to the browser's trusted store. See sk111754.

• Inspection of QUIC traffic over a proxy is not supported.

• Protocols that rely on QUIC, except HTTP/3, will be downgraded to an earlier HTTP version.