topic App & URL Filtering Behavior in Firewall and Security Management

App & URL Filtering Behavior

fatalXerror — Thu, 10 Jan 2019 13:01:54 GMT

Hi Guys,

I deployed a CP firewall running R80.10 and I am using App & URL Filtering however, I noticed an abnormal behavior.

For example, I have a policy for Symantec Updates so my policy looks like the following below,

Source: Internal Subnet

Destination: Any

Service & Application: Symantec-Updates

Action: Permit

When I check the logs for the particular rule, I noticed some traffic which supposed to be not there like going to other site not related to Symantec.

I would like to know why is like that, is that normal or my rule is not correct?

Thanks

Re: App & URL Filtering Behavior

PhoneBoy — Sat, 12 Jan 2019 21:07:00 GMT

First, I'd set the destination to "Internet" as opposed to any (unless some of the traffic is destined internally).

It also could be a false positive, in which case the TAC will need to investigate.

Re: App & URL Filtering Behavior

fatalXerror — Mon, 14 Jan 2019 06:24:40 GMT

Hi Dameon Welch-Abernathy‌,

thanks for the feedback. Technically, "Internet" and "Any" should be the same right?

Re: App & URL Filtering Behavior

HristoGrigorov — Fri, 21 Jun 2019 09:11:48 GMT

I find this thread especially educating on what is Internet when it comes to firewalls:

https://community.checkpoint.com/thread/6099-properly-defining-the-internet-within-a-security-policy

Re: App & URL Filtering Behavior

PhoneBoy — Mon, 14 Jan 2019 13:36:25 GMT

Any literally means anything, including the Internet.

Internet does not include your internal networks.