topic Re: With updatable objects do you still need to Geo Policy? in Firewall and Security Management

With updatable objects do you still need to Geo Policy?

Alex_Mondol — Mon, 09 Mar 2020 23:31:43 GMT

Now that since R80.20 there have been Updatable Objects, do we still need to deploy Geo Policy? Although Geo Policy is more on the NIC or ACL level BlockList vs processed by FW workers, what is the Check Point recommendation? Use both for a granular approach? Use Updatable Objects only? Use Geo Policy Only? Does the use of both have any implications on each other? Please Check Point Let me know what you recommend. Thanks

Re: With updatable objects do you still need to Geo Policy?

PhoneBoy — Tue, 10 Mar 2020 02:01:51 GMT

The Geographic Dynamic Objects are meant to replace Geo Policy in R80.20 and above gateways.
From a performance perspective, they should operate identically.
From a flexibility perspective, the Dynamic Objects approach is the clear winner.

Re: With updatable objects do you still need to Geo Policy?

Alex_Mondol — Tue, 10 Mar 2020 02:46:39 GMT

So are you saying that from an organization that has not deployed either and has been given the go ahead to deploy Geo Protection, should we instll both Policy and Updatable Objects? or only do Updatable objects? Is Geo Policy truely faster since its dropped at a NIC level like an ACL would be? or Updatable Object should be the only deployment advised?

Re: With updatable objects do you still need to Geo Policy?

Alex_Mondol — Tue, 10 Mar 2020 02:49:16 GMT

Are there any advantages to deploy both Geo Policy and Updatable objects? or Are we just complicating troubleshooting if we do both? or is it not advised to do both?

Re: With updatable objects do you still need to Geo Policy?

Alex_Mondol — Tue, 10 Mar 2020 02:58:16 GMT

If our intent was to block these foreign countries sources from externally sourced coming in would this be correct?

Re: With updatable objects do you still need to Geo Policy?

Timothy_Hall — Tue, 10 Mar 2020 12:27:06 GMT

If you have an existing Geo Policy setup you can continue using it. However for any new R80.20+ policies I would strongly advise using Geo Updatable Objects instead. There is a very slight performance edge for Geo Policy as it is checked just after antispoofing long before reaching the security policy where Geo Updatable Objects are located. However Geo Updatable Objects are so much more flexible and easier to use and understand, that I'd advise against using Geo Policy going forward despite its very slight performance edge.

Re: With updatable objects do you still need to Geo Policy?

PhoneBoy — Tue, 10 Mar 2020 19:51:35 GMT

That's the right idea.