topic Re: Negating a specific object in Firewall and Security Management

Negating a specific object

donat5 — Thu, 26 Mar 2020 19:49:31 GMT

I noticed that the option to negate a specific object is no long available in R80.xx, only available option is "negate cell"

I wonder why CheckPoint removed such a important feature.

I am simply trying to allow "any" but deny/negate "https" in the services cell, does anyone have a workaround?

Re: Negating a specific object

Maarten_Sjouw — Thu, 26 Mar 2020 21:50:26 GMT

Negate the cell which in fact stops anything but what is in that cell.
It might be named a bit different but it still works the same.

Re: Negating a specific object

donat5 — Thu, 26 Mar 2020 23:27:11 GMT

@Maarten_Sjouw

This even makes things more complicated; I would like to allow everything but https, how should my rule look like?

Any represents a lot of services which I cannot list.

Re: Negating a specific object

Ryan_Ryan — Thu, 26 Mar 2020 23:40:52 GMT

I think your only option is two rules

top rule - service https - action - drop

second rule allow any

Re: Negating a specific object

donat5 — Fri, 27 Mar 2020 00:09:33 GMT

@Ryan_Ryan

It seems so far the only option but why cp decided to get rid of such a good feature?

Now we end up with 2 rules instead of 1; I think checkpoint should reconsider putting this feature back.

Re: Negating a specific object

Ryan_Ryan — Fri, 27 Mar 2020 00:17:09 GMT

No idea..

Its possible with network groups - create group with exclusion

seems there is no option to create service group with exclusion - you could have created a group containing tcp and udp 1-65535 and icmp and then exclude https.

If you wanted a really ugly solution you could create a group like above but with tcp range 1-442 and range 444-65535 group that together with udp range all ports and icmp.

Re: Negating a specific object

PhoneBoy — Fri, 27 Mar 2020 04:26:09 GMT

I've been using Check Point since version 2 and I'm pretty sure it was never allowed to negate a specific object in a cell with two or more items in it.

Here's a snapshot from R77.30 where I'm selecting a specific object and I'm being offered "Negate Cell"

And it shows like this when negated.

Visually, it looks a little different in R80.x:

In either case, the effect is the same.

Re: Negating a specific object

Maarten_Sjouw — Fri, 27 Mar 2020 06:14:00 GMT

It would look just like this, it allows my home lan to anything but the RFC1918 networks on any port but HTTP/HTTPS:

Re: Negating a specific object

donat5 — Fri, 27 Mar 2020 14:12:53 GMT

Oh...then I misunderstood @Maarten_Sjouw explaination and thought that everything in the cell is allowed and the rest dropped. This makes sense now, thanks @PhoneBoy