topic Re: Service Objects in Firewall and Security Management

Service Objects

Anthony_Kahwati — Fri, 04 Feb 2022 15:49:59 GMT

Can someone clarify for me if the out of the box service objects are more than just a TCP port match?

For example, if I choose the SSH object as my service in a access policy rule does it behave differently to me creating a from-scratch service object called mySSH that also matches TCP/22? Is there any application awareness in it or is it just a TCP match with some specific timeouts?

Hope that makes sense...

Thanks

Re: Service Objects

Chris_Atkinson — Fri, 04 Feb 2022 16:06:19 GMT

It depends on the specifics of the particular service object.

Then if you use objects found in the AppWiki or that otherwise have "protocol signature" enabled then more advanced recognition is performed rather than simple ports.

https://appwiki.checkpoint.com/appwikisdb/public.htm

Re: Service Objects

Timothy_Hall — Sat, 05 Feb 2022 14:55:02 GMT

Please see my post here which should fully answer your question:

https://community.checkpoint.com/t5/Management/Enable-Protocol-Signature-by-default/m-p/139285/highlight/true#M29469

Re: Service Objects

the_rock — Sat, 05 Feb 2022 16:27:31 GMT

You definitely got correct answers from both @Timothy_Hall and @Chris_Atkinson , but I will tell you from my own personal experience, its hit and miss, depending on which service you use. Sometimes, it behaves the same, sometimes not...