topic Re: Rules I created is not working in Cloud Firewall

Rules I created is not working

Nidhi01 — Mon, 18 Sep 2023 10:25:03 GMT

I have configured the checkpoint firewall in Azure. I have used Checkpoint Security Manager and Cloud Guard single gateway plan for this environment.

The environment is like this - I have created one Virtual network and there are two subnets in the Vnet. I have deployed Server Manager in the Subnet 1 and Cloud guard single gateway where its first NIC is connected to Subnet 1 and the second NIC is connected to Subnet 2. I have deployed two Azure Virtual machines in the same network only but in different Subnets like VM01 in Subnet 1 and VM02 in Subnet 2. Now I wanted to block RDP service from VM01 to Vm02 as by default they can communicate with each other. However, the rule I created in the Checkpoint Server Manager does not block the RDP from the source to the destination. what could be the possible reason behind this? why is my rule not hitting the source and destination?

I am expecting that I can block RDP for VM01 and VM02 through the rules I created in checkpoint smart Console.

Re: Rules I created is not working

PhoneBoy — Mon, 18 Sep 2023 15:15:58 GMT

What version?
Did you deploy from one of our templates or manually?
What shows in the logs when VM01 attempts to access VM02?
Have you confirmed the traffic is actually traversing the gateway (via tcpdump or similar)?

Re: Rules I created is not working

Nidhi01 — Mon, 18 Sep 2023 15:21:20 GMT

I am using R80.10 version,

I have deployed the security manager and gateway from the Azure portal.

I am not sure how to confirm that the traffic is traversing through the gateway or not. Can you please let me know how can I check that and how to fix it?

Re: Rules I created is not working

the_rock — Mon, 18 Sep 2023 15:37:23 GMT

Can you send screenshot of the rule thats not working (please blur out any sensitive info)?

Also, as @PhoneBoy mentioned, its important to verify that traffic is indeed traversing the firewall, otherwise, if not, its totally logical why rule would never get hit.

Makes sense?

Andy

Re: Rules I created is not working

PhoneBoy — Mon, 18 Sep 2023 18:03:27 GMT

Please check the version again as R80.10 is End of Support.
Easiest way I know to check: with tcpdump on the gateway itself.
If the gateway isn't seeing the traffic, it can't enforce any sort of policy on it.

Re: Rules I created is not working

the_rock — Mon, 18 Sep 2023 18:33:42 GMT

Very easy...anyway, R80.10 is totally unsupported, but regardless of version, command is the same. Say interface is eth2 and IP is 10.10.10.10

you can run below:

tcpdump -enni any host 10.10.10.10

or/and

fw monitor -e "accept host(10.10.10.10);"

Andy

Re: Rules I created is not working

Nidhi01 — Tue, 19 Sep 2023 04:06:00 GMT

Thanks Andy,

I have attached a screenshot of the rules I created.

Re: Rules I created is not working

Nidhi01 — Tue, 19 Sep 2023 04:07:58 GMT

I am sorry, the version is R81.10

Re: Rules I created is not working

the_rock — Tue, 19 Sep 2023 10:19:42 GMT

The rule works 100%, you can clearly see that from your screenshot. There are even logs showing that at the bottom.

Andy

Re: Rules I created is not working

Nidhi01 — Tue, 19 Sep 2023 10:22:10 GMT

Yeah it's generating logs but the main purpose to create a rule is to block the RDP of the virtual machines but I am able to take RDP of the VM01 and VM02. its not blocking.

Re: Rules I created is not working

G_W_Albrecht — Tue, 19 Sep 2023 11:36:06 GMT

I would suggest you involve TAC to resolve this issue !

Re: Rules I created is not working

the_rock — Tue, 19 Sep 2023 12:37:48 GMT

RDP from where exactly? Remember what both @PhoneBoy and myself mentioned in previous responses, run captures to make sure that traffic even hits the firewall, because if not, it will never work.

Andy

Re: Rules I created is not working

Duane_Toler — Fri, 22 Sep 2023 16:27:56 GMT

Check your Azure VMs. The VMs are deployed automatically with a public IP address attached to their NICs. This IP is directly reachable to the Internet, not via your VNET. The VM also has a local IP on the subnet, but that's a private IP. Are you trying to reach your VM via the Azure public DNS name of "vm01-asdfadsf.<region>.cloudapp.azure.com" ? If so, then you're reaching the VM's direct-attached public IP; which will not pass through your CloudGuard firewall.

Re: Rules I created is not working

the_rock — Fri, 22 Sep 2023 19:10:05 GMT

Good point, I totally missed the config was in Azure.

Andy