topic Re: R81 location of implied_rules.def in Firewall and Security Management

R81 location of implied_rules.def

Michael_Horne — Wed, 13 Oct 2021 07:12:39 GMT

Hello All,

I am looking for the location of the implied_rules.def on a Management sever running R81. I am looking to remove RADIUS from the implied rules so that it can travel over a site to site VPN.

sk92281 mentions that for R81 you should refer to the Security Management Administration Guide, except that a search of this for the word "implied_rules", does not show any mention of the location for implied_rules.def

I did find the versions of the file in $FWDIR/lib directory and updated them:

This has not changed the list of implied rules when I view them in SmartConsole. We did do a "cpstop" before changing the files and did a "cpstart" after updating the files as per sk31692.

Also a test of RDAIUS traffic does not show in the logs, so I assume the the implied rules are still being match.

Can anyone point me in the location of the implied_rules.def for R81?

Many thanks,

Michael

Re: R81 location of implied_rules.def

G_W_Albrecht — Wed, 13 Oct 2021 07:50:03 GMT

I gave feedback for sk92281 as no location is given in the Admin Guides, but it also says:

The "implied_rules.def" file is a placeholder for implied security rules.

All the changes made in this file are transferred to the managed Security Gateway / Cluster during policy installation.

Re: R81 location of implied_rules.def

Michael_Horne — Wed, 13 Oct 2021 08:29:19 GMT

Hello,

I can confirm that a policy installation was done after following the process for updating the "implied_rules.def" file. It was an assumption, that once the restart of the management services using "cpstop" then "cpstart" as per the RADIUS SK sk31692, that listed implied rules visible in SmartConsole would reflect the fact that RADIUS rules were removed. If not, it woudl be very confusing.

It does seem that the implied_rules.def in $FWDIR/lib is the correct location of this file, although it did not have the expected result. So that is why I was looking for confirmation of the correct location as it is not specifically mentioned in sk92281

Many thanks,

Michael

Re: R81 location of implied_rules.def

_Val_ — Wed, 13 Oct 2021 08:40:14 GMT

Yes it is. $FWDIR/lib/

However, it seems the lines you grep-ed are commented out, aren't they?

Re: R81 location of implied_rules.def

Michael_Horne — Wed, 13 Oct 2021 08:51:44 GMT

Hello,

I followed the instructions in sk31692 and it only mentioned to remove the one line:

I am not sure exactly how the management server uses this file or the syntax, but it looks similar to the syntax used in C programing files with the # denoting commands that are specific to the compiling process. They also use #define and #if.

I am not sure that the lines starting with # are comments

Many thanks,

Michael

Re: R81 location of implied_rules.def

Chris_Atkinson — Wed, 13 Oct 2021 09:32:00 GMT

Which version gateway is targeted?

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Multi-DomainSecurityManagement_AdminGuide/Topics-MDSG/Configuring_Implied_Rules_or_Kernel_Tables_for_Security_Gateways_implied_rules.def.htm

Re: R81 location of implied_rules.def

G_W_Albrecht — Wed, 13 Oct 2021 09:04:22 GMT

$FWDIR/lib is the correct place for R81 gateways.

Re: R81 location of implied_rules.def

_Val_ — Wed, 13 Oct 2021 09:55:21 GMT

You are right, it is not commented, my bad. With R81, I think you need to reboot the management so the file is pulled properly. If it still does not work for you, please open a TAC case

Re: R81 location of implied_rules.def

G_W_Albrecht — Wed, 13 Oct 2021 13:33:14 GMT

I have a response to my feedback - the information has just recently been added, also for simple SMS: This is a link to the relevant section:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Configuring_Implied_Rules_or_Kernel_Tables_for_Security_Gateways_implied_rules.def.htm?tocpath=Managing%20Gateways%7CConfiguring%20Implied%20Rules%20or%20Kernel%20Tables%20for%20Security%20Gateways%7C_____2

Re: R81 location of implied_rules.def

Michael_Horne — Thu, 14 Oct 2021 09:02:37 GMT

Hello,

I believe you have found the root cause of my problem, as the target gateways are still running R80.40. I have only updated the files for the R81 gateways.

This table is not in my PDF version of the R81 Admin guide.

Many thanks,

Re: R81 location of implied_rules.def

G_W_Albrecht — Thu, 14 Oct 2021 09:26:30 GMT

That his table is not in my PDF version of the R81 Admin guide also was my issue ! Solution:

- open the Admin Guide on page 3 Important Information

- click Download the latest version of this document in PDF format

- look if the date on the cover page is later as the one of your PDF

Re: R81 location of implied_rules.def

G_W_Albrecht — Thu, 14 Oct 2021 14:23:32 GMT

If it works now, i would appreciate a Kudo 8)

Re: R81 location of implied_rules.def

Michael_Horne — Thu, 14 Oct 2021 19:39:49 GMT

Both the table and also how to download the latest version using the link in the PDF, both earn Kudo points.