topic Re: Dependencies in FW Configuration in Firewall & Security Management

Dependencies in FW Configuration

Matlu — Tue, 29 Sep 2026 14:59:05 GMT

Hello everyone,
Whenever a change is made at the routing level (dynamic or static) on a firewall managed by an SMS or a CMA from an MDS… or, for example, when modifying NTP/SNMP settings…
Is it ‘mandatory’ to implement policies?
Or is the change simply made on the firewall and the implementation ignored?
Thank you for your clarification.

Re: Dependencies in FW Configuration

Chris_Atkinson — Tue, 29 Sep 2026 15:48:58 GMT

For static routing changes in VSX yes.

Other changes typically only require policy to be pushed if the policy needs to be updated to take the settings change into account to allow the traffic to pass including things like anti-spoofing etc.

Re: Dependencies in FW Configuration

Matlu — Tue, 29 Sep 2026 16:06:44 GMT

Hello,
In a ‘traditional environment’ without VSX, if you need to work with BGP,
I plan to carry out the configuration via my firewall’s CLI, but once I’ve finished doing that, do I need to install policies from the MDS?
Thank you.

Re: Dependencies in FW Configuration

Lesley — Tue, 29 Sep 2026 16:21:51 GMT

If you change BGP routing via local GAIA clish no policy push is needed from MGMT.

If you change the NTP servers in GAIA no push is needed.

BUT if there is a rule that the firewall uses to reach the NTP server it needs to be changed.

Source: Firewall , destination: NTP server old port 123

A policy push is to change this rule policy. It does not tell the firewall to change the GAIA config or something. All changes in GAIA config are active after you do save config, no push needed

Re: Dependencies in FW Configuration

Matlu — Tue, 29 Sep 2026 17:19:04 GMT

Hey Lesley
Just for the record:
This logic applies in the same way in VS environments, doesn’t it?
Let’s imagine I have four VS's on my VSX, and on one of them I’m using BGP whilst on another I’m using OSPF, and I make changes to the configuration via the CLI…
Is it enough just to run ‘save config’ on the configuration I’ve made, right?
There’s no need to send policies for installation

Re: Dependencies in FW Configuration

Lesley — Tue, 29 Sep 2026 17:29:04 GMT

Virtual Systems support:

OSPF

RIP

BGP

PIM

Static routes, you change via Smart Console. But if you want to change SNMP / NTP or other gaia config it is local gaia CLISH and no push needed. Indeed save config

Re: Dependencies in FW Configuration

Bob_Zimmerman — Tue, 29 Sep 2026 17:30:18 GMT

Generally, yes. With VSX, some things must be done through the CLI (dynamic routing, bonding), while others must be done through SmartConsole (static routes, interface IP/mask changes, VLANs). Certain interface changes need a policy push simply because antispoofing is part of the policy.

Routing changes (whether static or dynamic) never need a policy push to take effect. They may send traffic through different paths, which could cause it to no longer match existing rules (for example, if you change the route to a destination, it might be in a different zone), and it can take a policy push to fix that, but that's technically not part of the routing change.

Re: Dependencies in FW Configuration

Chris_Atkinson — Wed, 30 Sep 2026 00:21:18 GMT

sk39960 - How to allow Dynamic Routing protocols traffic (OSPF, BGP, PIM, RIP, IGRP) through Check Point Security Gateway