2.1 Updatable Objects & Dynamic Security Policy Objects

2.1 Updatable Objects & Dynamic Security Policy Objects

In modern enterprise networks, cloud services and Software-as-a-Service (SaaS) applications continually change their public IP address ranges and domain endpoints. Traditional static network objects—such as host IP addresses, IP ranges, and fixed network subnets—require security administrators to manually update object definitions and push a full security policy every time a cloud vendor publishes an infrastructure update. Check Point R82 solves this operational challenge through Updatable Objects and Dynamic Security Policy Objects.

Updatable Objects are pre-configured, dynamic network objects that represent public cloud services, SaaS applications, external threat intelligence feeds, and geographical locations. Instead of storing hardcoded IP addresses within the Security Management Server database, the Security Gateway periodically queries Check Point Cloud Services to retrieve the latest authoritative IP ranges for these services and dynamically updates its kernel enforcement tables in real-time—without requiring a full policy compilation or installation.

---

Supported Object Types & Categories

Check Point R82 categorizes Updatable Objects into several distinct service groups within SmartConsole:

---

Update Architecture & Execution Flow

The synchronization of Updatable Objects relies on a decoupled architecture operating between Check Point Cloud Services, the Security Management Server, and the Security Gateway.

Step-by-Step Update Workflow

1. Policy Reference Push: When a policy containing an Updatable Object is initially pushed from SmartConsole, the Security Management Server includes the object's unique identifier (GUID) and metadata in the policy package sent to the Security Gateway.
2. Background Scheduled Polling: A dedicated background service on the Security Gateway (cp_updatable_objects_installer) periodically polls the Check Point Cloud Download Center over HTTPS (port 443) to check for updated IP lists. By default, this interval is set to every 3 hours.
3. Kernel Memory Table Injection: When an IP update is received, the gateway writes the new IP ranges directly into kernel dynamic memory tables. The active policy rulebase immediately enforces traffic matching against the updated IP list.
4. Zero Traffic Interruption: Because IP updates modify dynamic kernel tables rather than compiling a new inspect format policy file (.fws), policy push lockouts, memory spikes, and packet drops associated with full policy installation are completely avoided.

---

Policy Layer Integration & Use Cases

Updatable Objects can be embedded across multiple policy rulebases within Check Point SmartConsole:

1. Access Control Policy

Administrators can create explicit allow or drop rules targeting Updatable Objects. For example, creating an Access Control rule permitting internal subnet traffic to Office365_All_Services ensures seamless connectivity even as Microsoft modifies its server addresses worldwide.

2. HTTPS Inspection Bypass (Critical Practice)

SSL/TLS inspection introduces significant CPU overhead and can cause application failure due to SSL certificate pinning (common in desktop applications like Microsoft Teams and Zoom). Placing Updatable Objects (e.g., Zoom_Services) in the HTTPS Inspection Bypass rulebase ensures encrypted media streams pass through uninspected without administrative overhead.

3. Threat Prevention & Anti-Bot Exceptions

Updatable Objects can be used within Threat Prevention rules and Anti-Bot whitelist exceptions to prevent false-positive blocks against verified cloud infrastructure.

---

Fallback Behavior & Local Caching

High-availability perimeter networks must maintain security enforcement even during internet connectivity degradation or Check Point Cloud unreachable states.

• Persistent Local Cache: The Security Gateway maintains a local cache file located at $FWDIR/database/dynamic_objects.dat and within permanent dynamic object kernel tables.
• Connectivity Interruption Fallback: If the Security Gateway loses internet connectivity or fails to authenticate to the Check Point Download Center, the system retains and continues enforcing the last successfully downloaded IP list indefinitely.
• Proxy Server Integration: For gateways isolated behind strict perimeter firewalls, administrators can configure explicit HTTP/HTTPS proxy settings under SmartConsole -> Global Properties -> Web Browsing / Proxy to route Updatable Object sync requests through an internal proxy.

---

CLI Inspection & Troubleshooting Tools

Security engineers frequently need to inspect dynamic object tables directly on the Gaia OS command line to confirm IP resolution or debug traffic flows.

Essential Gaia CLI Commands

# List all active dynamic objects and their currently resolved IP ranges in gateway memory
fw ctl dynamic_objects -l

# Query resolution details for a specific Updatable Object
fw ctl dynamic_objects -o Office365_Exchange

# Manually force an immediate update of all Updatable Objects from Check Point Cloud
cp_updatable_objects_installer update

# Check the status of the dynamic objects background update daemon
cp_updatable_objects_installer status

Log File Inspection

When dynamic updates fail, engineers should examine the following log files on the Security Gateway:

• $FWDIR/log/dynamic_objects.log : Records kernel memory table injection operations.
• $FWDIR/log/updatable_objects.log : Details HTTPS connection attempts, proxy authentication, and downloaded package checksums from Check Point Cloud.

---

Object Comparison: Static vs. Domain vs. Updatable Objects