topic Re: Blocking an object in Firewall and Security Management

Blocking an object

Ftopacho — Mon, 12 Jul 2021 20:37:04 GMT

Dear team,

I need your assistance. A few days back, one of my servers was affected. It stopped receiving internet. I can’t ping 8.8.8.8. There’s a NAT between the local IP NATTED to the Public IP.

I decided to change the IP of the server to a new IP address. I was able to ping 8.8.8.8. When I go to the firewall and change the object IP address to the new IP address of the server, I realize that am unable to ping 8.8.8.8.

Within the same rule, there are other objects that are not affected at all yet they also have similar configurations.

So this leaves me thinking, it’s like this object has been blocked by the checkpoint firewall and why is it blocked???

How can I find out and also restore the object???

Your contributions will be highly appreciated.

Thanks

Re: Blocking an object

PhoneBoy — Mon, 12 Jul 2021 23:24:31 GMT

Without knowing the precise changes you made your precise network configuration, the version/JHF level, etc, it's difficult to say what is actually happening here.

What precise changes did you make?
If you don't know, you should be able to see in the Audit logs exactly what changes were made.
That should also help you configure your system back to the way it was previously.

If you are on R80.40 or above, you can revert the entire configuration database back to what it was before you made the change (however, that causes all current changes to be lost).
See also: https://community.checkpoint.com/t5/Policy-Management/R80-Change-Control-A-Visual-Guide/td-p/39702

Re: Blocking an object

Ftopacho — Tue, 13 Jul 2021 03:35:40 GMT

No changes were made at all. This happened from the blue.

Re: Blocking an object

PhoneBoy — Tue, 13 Jul 2021 04:56:26 GMT

We still don't your precise network configuration, your access and NAT policy, the version/JHF level, etc.
Anything in the logs?
Have you look at any packet captures with fw monitor or tcpdump?