> Source: [sk167210](https://support.checkpoint.com/results/sk/sk167210)
# sk167210 - Generic Data Center feature
| Property | Value |
|----------|-------|
| Solution ID | sk167210 |
| Date Created | 2020-07-29 |
| Last Modified | 2026-05-18 |
| Technical Level | General |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS), R82.10, R82, R81.20, R81.10 (EOS) |
| OS | Gaia |
## Solution
### Overview
Starting from version R81, the Generic Data Center feature provides the ability to enforce access to/from IP addresses defined in JSON files. These JSON files can be located on external web servers or locally on the Management Server.
The Generic Data Center objects are updated automatically on the Security Gateway each time the JSON file changes. There is no need to install policy for the updates to take effect.
Objects created based on these JSON files can be used as a source, or a destination in the following policies: Access Control policy, NAT policy, Threat Prevention policy, HTTPS Inspection policy.
### Notes
* This feature is supported for Security Gateways R81 or higher.
* Beginning in [R81.10 Jumbo Hotfix Take 113](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/Take_113.htm) (see PRJ-48196), you can use Generic Data Centers and Dynamic Objects with a Maestro cluster (except Maestro VSX)
* GDC Support for Maestro VSX setup is added as part of CloudGuard Controller automatic updates under: CG_take_36 for R81.10, CG_take_31 for R81.20 and CG_take_20 for R82 (Follow [sk181842](https://support.checkpoint.com/results/sk/sk181842))
* Generic Data Center objects are not supported in Group objects.
* Both IPv4 and IPv6 addresses are supported.
* Port 18208 needs to be allowed from the Management server to the Security Gateways.
### Configuration in SmartConsole
To create a new Generic Data Center you have two options:
* Click the '+' button in the Source/Destination column, choose import 'Data Centers', and then choose 'New Data Center' and click on 'Generic Data Center...' (as shown below):
* In the 'Objects' pane, choose 'More objects types' and then 'Cloud' -\> 'Data Center' and click on 'New Generic Data Center...' (as shown below):
**In the object window:**
1. Enter the URL for the JSON feed (in case of local path you should enter the full path starting with '/'). For example: https://example.com/file.json (remote feed), /tmp/file.json (local feed).
2. Choose update interval in seconds, this interval will define the time between JSON feed scans (default is set to 60 seconds and minimum value is 10 seconds).
3. In case you wish to have a privilege credentials for your server you can add a 'Custom Header' and assign to it key and value.
To check connectivity to the given URL click '**Test Connection** '.
For HTTPS connections you will get the server's certificate and only if you choose to trust it the feed will be connected.
**In the import window:**
You have 2 types of Generic Data: Generic Data Object, Generic Data Folder.
Each Generic Data Object represents one of the objects in the JSON file.
Generic Data Folder represents all JSON objects from the JSON file and its name derived from the Data Center object name (UI name).
To select objects from the import window, click the '+' to the right.
**To import objects from an existing Generic Data Center:**
1. Click the '+' button under the Source/Destination column.
2. Select import 'Data Centers', and then select the name of the existing Generic Data Center.
3. The import window opens. Add the objects with the '+' button.
### JSON File Structure
Here is an example for JSON file structure:
```
{
"version": "1.0",
"description": "Generic Data Center file example",
"objects": [
{
"name": "Object A name",
"id": "e7f18b60-f22d-4f42-8dc2-050490ecf6d5",
"description": "Example for IPv4 addresses",
"ranges": [
"91.198.xxx.xxx",
"20.0.0.0/24",
"10.1.1.2-10.1.1.10"
]
},
{
"name": "Object B name",
"id": "a46f02e6-af56-48d2-8bfb-f9e8738f2bd0",
"description": "Example for IPv6 addresses",
"ranges": [
"2001:0db8:85a3:0000:0000:8a2e:0370:7334",
"0064:ff9b:0000:0000:0000:0000:1234:5678/96",
"2001:0db8:85a3:0000:0000:8a2e:2020:0-2001:0db8:85a3:0000:0000:8a2e:2020:5"
]
}
]
}
```
#### **Notes**:
* Currently, only version 1.0 is supported.
* The "id" field should be a **unique UID**.
* **Mandatory fields:** "version", "objects", "name", "id", "ranges".
### **Step by Step Example - Create new rule with Generic Dat**a Center
The JSON file can be located on a remote server or locally on the Management Server.
Here we have a JSON file called "**GenericDC.json**".
The example below shows how to configure the object, if the JSON file is located:
* on a remotely server at *http://172.16.x.xxx/CheckPoint/GenericDC.json*
* locally on the Management Server at */tmp/GenericDC.json*
Procedure:
1. In the object window, we will give the name '**CheckPoint** ' to our object, enter the URL, and click '**Test Connection**':
|-------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|
| Remote feed: | Local feed: |
|  |  |
2. Create a new rule to block all destinations to '**Boston-financial-lab**'.
First, click the '+' button in the new rule in the **Destination** column and import the Generic Data Center object we created before (as shown below):
3. The import window opens.
4. Click the '+' button on the left to the '**Boston-financial-lab**' object (as shown below):
**Mapping between attributes in the JSON file and columns in the Import window:**
* "name" fields will be in the column 'Name'.
* "id" fields will be in the column 'ID'.
* "description" fields will be in the column 'Description'.
* "ranges" field will be in the column 'Content'.
* 'URL' column will contain the URL feed.
Example:
5. Our rule is ready (as shown below):
6. Click **Install Policy**.
7. All changes made to the '**Boston-financial-lab**' object in the JSON file are updated automatically without policy installation.
### Limitations
* Policy Installation fails when the maximum number dynamic objects is reached (the default value is 5000). Refer to [sk167576](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167576).
* You can make up to 15,000 changes in a JSON file between two time intervals at which the JSON file is sampled, with a maximum of 30,000 IP addresses.
* Domains/FQDN's are not supported in data center objects
### Monitoring
To monitor Generic Data Center on the Security Gateway, run the following command in Expert mode:
|--------------------------------------------------------------------------------------------|---------------------------|
| Get a list of IP addresses for all Generic Data Center objects that are used in the policy | dynamic_objects -cfo_show |
To monitor Generic Data Center on the Smart Console, check the following logs:
* Logs related to Data Center objects:
Appear under the blade "CloudGuard IaaS". Contain information regarding scans, updates, errors related to the feed.
Example:
* Logs related to Dynamic objects:
Appear under the blade "Firewall". contain information regarding updates performed on the Security Gateway for Generic Data Center objects.
Example:
* To monitor ERRORs related to Generic Data Center objects scans and updates check the following log file on the security Management - $FWDIR/log/cloud_proxy.elg .
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content