Release an address list with a clear view of its impact.

1. Agree the source and every affected rule

A deployment Administrator, or an account with equivalent global Check Point administration and direct-edit authority, manages Network Feeds. Grant and team-scope object permissions do not authorize feed creation, editing, release, or deletion. An existing feed can still be selected in a supported rule field when that user's access permits it.

• External: the default. Gateways retrieve a list from an existing HTTP or HTTPS feed URL, using the configured format and parser.
• Local: Naradox stores a manually maintained IPv4/IPv6 address or CIDR list in its bundled database and serves the explicitly released version.

Choose deliberately: an existing object's External/Local source cannot be switched. Review the intended policy use and other rules referencing the feed. Later content releases can affect all of them without another policy installation. Agree who reviews the list and who releases it; a Local release does not enter the delegated rule-approval workflow.

2. Prepare a gateway-reachable HTTPS address

For Local feeds, the deployment's APP_URL must be an HTTPS origin, such as https://naradox.example.com, without a path, query, fragment, or embedded credentials. The host operator verifies this under Local Check Point Network Feeds in the bundled docs/INSTALL_ADMIN.md before creating the draft.

• Every consuming gateway must resolve that hostname and reach the existing Naradox HTTPS service. A browser reaching Naradox does not prove gateway reachability.
• The gateways must trust the endpoint's TLS certificate. This is separate from Naradox's certificate verification when connecting to Check Point Management.
• The reverse proxy must preserve the feed route and its authentication header as described in the installation guide. Naradox manages the feed credential; the browser does not expose it.

Local feeds use the existing service; they need no additional listener or feed-specific port. Ordinary database backups cover the stored feed records. The HTTPS address and gateway trust still need to work after a host move or restore; follow the recovery guidance.

3. Save the Local draft and create its Check Point object

1. In Rulebase, select the intended Check Point instance and policy context, then open Browse. Use the Network category, select a manageable network object, and choose New object to open network management.
2. In network management, choose New object, select Network feed as the object type, enter a descriptive Name, and set Source to Local.
3. Add the agreed addresses to Address list and use Add to include them in the draft. Review the complete list and its count.
4. Choose Save draft. Check the saved entries and the Not released state.
5. Review metadata and the Advanced refresh interval, then choose Create. Wait for the Check Point operation to finish and verify the resulting object in Browse.

Local lists accept at most 1,000 raw entries, before duplicates are removed. Use individual IPv4/IPv6 addresses or canonical CIDRs: for example, 192.0.2.0/24 expresses a network, while 192.0.2.5/24 has host bits and is rejected. Use your organization's actual intended addresses. Local domain lists, arbitrary ranges, JSON, and custom parsing are unsupported.

Create also saves a new draft if needed before configuring the Check Point object. Neither Create nor Save draft releases its content. After successful creation closes the editor, reopen the new feed with Edit for the release step.

4. Release the reviewed list and verify gateway use

In the Local editor, confirm the saved list, review the displayed additions and removals, and choose Release feed. Release requires a saved, current revision with at least one valid entry. Confirm the displayed Released revision and entry count after success.

The first use also requires the feed object in the intended Check Point policy and successful policy installation on the relevant gateways. Naradox supports feed references in Source/Destination for Access Control and HTTPS Inspection, and Original Source/Original Destination for NAT. Threat Prevention and translated NAT fields do not accept feed references through this workflow.

Once configured in an installed policy, gateways fetch new releases at their next successful refresh. The editor's default Refresh interval (minutes) is 60. A release changes what Naradox serves; it does not prove that a gateway fetched or applied that version. Have the firewall administrator confirm gateway refresh and the intended traffic behavior using the available Check Point evidence. This version has no gateway Test feed action.

Update the draft before replacing released content

When returning through Rulebase's Browse, select the feed and choose Editto open network management, then choose Edit there to open the feed editor. Update its Address list and choose Save draft. Check Unreleased changes, additions, and removals against the requested change before selecting Release feed. Saving alone keeps the previous released list available. A successful release replaces that list atomically; failed validation or persistence preserves it.

Save object handles Check Point metadata such as comments or the refresh interval. When the local list or draft name also changed, save the draft first; Save object remains blocked until that succeeds. Neither save releases the list. Record the release and relevant configuration changes using Audit and evidence.

Use an existing External feed

In the same Network feed creation form, keep Source: External and enter the gateway-reachable Feed URL. Match Format and Data type to the source: Flat List uses its delimiter, data column, and ignored-line prefix; JSON requires the corresponding JSON query. Review the refresh interval and any gateway-proxy requirement.

Create and inspect the object, then configure and install its policy use as above. External content is maintained at its source; it has no Naradox Save draft or Release feed step. Object creation success does not establish source availability, correct parsing, or successful gateway refresh.

Recover saved work and investigate stale content

• Check Point creation failed: the Local draft remains saved. Resolve the reported problem and follow the offered retry. To resume later, open a Local Network feed creation form for the same instance and select it under Saved drafts.
• Revision changed: reload the current saved draft, compare it with the intended update, and save again. Do not overwrite another administrator's changes without reviewing them.
• Empty release rejected: a feed must contain at least one valid entry. Review the policy change needed to stop using a feed instead of treating an empty release as deactivation.
• Gateways still use old content: check the released revision, policy installation, refresh interval, gateway DNS/reachability, TLS trust, and proxy path. During an outage, gateways may continue using their cached list.
• After database recovery: the supported restore stops serving Local releases while retaining drafts and URLs. A restored draft may differ from the formerly released list. Review its entries against the intended current policy and explicitly release each intended feed before restoring delivery. Follow deployment recovery; cached gateway entries can still remain active.

For an uncertain Check Point result, inspect current object state before creating a replacement. Include the instance name, feed name, revision, time, and sanitized error in a support request.

Retire the object and hosted content deliberately

Deleting a Check Point Network Feed object leaves the Local endpoint intact because other consumers may still reference it. Review and update those references through your normal firewall-change process before removing hosted content.

The separate Delete hosted feed action erases the saved list and its credential and stops serving content. Its confirmation explicitly warns about gateway impact. It does not remove Check Point objects or rules, and gateways may retain cached entries. An instance's active local feeds must be explicitly cleaned up before the connector can be deleted or pointed at another target.