topic Re: Manually defined encryption domain via user_early.def in Firewall and Security Management

Manually defined encryption domain via user_early.def

Wolfgang — Sun, 01 Dec 2019 11:26:24 GMT

Hello CheckMates,

I had a customer who is using a manually defined encryption domain for some of the remote third party VPN peer gateways. Normally this is done via user.def file and entries for "subnet_for_range_and_peer"...

But in this environment the customer is using "user_early.def" file in the same directories and the syntax in the file is the same like in user.def.

Anyone know this ? I never used "user_early.def" for such kind of configuration.

regards

Wolfgang

Re: Manually defined encryption domain via user_early.def

HeikoAnkenbrand — Sun, 01 Dec 2019 18:00:43 GMT

Hi @Wolfgang,

One question that keeps coming up is. Which config files are used on the management server to compile policies with user specificlally INSPECT code?

Here are the most important config files, which we can customize Check Point INSPECT code individually:
      |-> user.def                                          -> User-defined implied rules that can be added in Check Point INSPECT language (sk98239)
      |-> fwui_head.def
                  |-> table.def                             -> Definitions of various kernel tables for Check Point security gateway (sk98339)
                  |-> auth.def
                  |-> base.def
                            |-> crypt.def                   -> VPN encryption macros (sk98241)
                            |-> services.def
                            |-> proxy.def
                            |-> crypt.def

If you search in $FWDIR/lib for all files for „include user_early.def“ so you can find the dependent file.

More read here:

R80.x - Policy Installation Flowchart

Re: Manually defined encryption domain via user_early.def

HeikoAnkenbrand — Mon, 02 Dec 2019 07:46:20 GMT

Hi @Wolfgang,

I checked it out on an R80.30 gateway.

"user_early.def" is an include file in "fwui_head.def"

You can also use the following command to search for dependencies:

# grep -rnwi '/opt/CPsuite-R80.30/fw1/lib/' -e 'user_early.def'

One more comment:
The normal user.def is executed after the "fwui_head.def". So you have the possibility to execute INSPECT code before user.def if you add the code to user_early.def.

Re: Manually defined encryption domain via user_early.def

Wolfgang — Mon, 02 Dec 2019 08:47:02 GMT

Good Morning HeikoAnkenbrand,

thanks a lot for your help.

I got the same findings this morning and I think now it's understandable why the user_early.def is working.

In the meantime I opened a TAC case and got an answer. They told me, that this kind of configuration for "subnet_for_range_and_peer" should be done only via user.def in R80.30.

Wolfgang