topic Packet Flow in Checkpoint Firewall in Firewall and Security Management

Packet Flow in Checkpoint Firewall

ashish_verma — Tue, 04 Sep 2018 06:49:22 GMT

Hello All,

I am very confused with the packet flow of checkpoint firewall. I have seen in many places fw ctl chain is referred to understand the packet flow but I am not able to interpret it.

Could someone please help me in understanding the packet flow in terms of

SAM

IP spoofing

Policy lookup

Dst NAT

route lookup

Src NAT

VPN

etc..

Even better if we can connect it with the output of fw ctl chain

I would really appreciate any comment.

Re: Packet Flow in Checkpoint Firewall

Jerry — Tue, 04 Sep 2018 07:49:44 GMT

here you find everything (almost!) what you need reg. the CP packet flow:

sk116255

also Heiko Ankenbrand‌ posted some very useful diagrams recently ... look them up here

Re: Packet Flow in Checkpoint Firewall

Jerry — Tue, 04 Sep 2018 07:51:47 GMT

https://community.checkpoint.com/docs/DOC-3041-r80x-security-gateway-architecture-logical-packet-flow

Re: Packet Flow in Checkpoint Firewall

_Val_ — Fri, 21 Jun 2019 09:12:28 GMT

Check this out: https://community.checkpoint.com/docs/DOC-3061-security-gateway-packet-flow-and-acceleration-with-diagrams

Re: Packet Flow in Checkpoint Firewall

ashish_verma — Tue, 04 Sep 2018 10:07:48 GMT

Thank you Very much to all of you. Got the answer. Thanks again

Re: Packet Flow in Checkpoint Firewall

lance2022 — Sun, 24 Apr 2022 17:35:44 GMT

Hi Jerry,

I know it's an old post, but do you happen to know any other link which might help me to see those packets get dropped.

e.g: when the initial packet enters the slow path and gets dropped due to a missing firewall policy, how can I look this up.

if I run fw mon, I would only see the packet "i", but it has two places where the packet could get discarded. how to know it got discarded due to policy and not "drop template".
thanks a lot
Lance (Sonicwall :))

Re: Packet Flow in Checkpoint Firewall

Waver — Wed, 29 Mar 2023 01:28:52 GMT

👍

Re: Packet Flow in Checkpoint Firewall

Timothy_Hall — Wed, 29 Mar 2023 11:54:48 GMT

Command fw ctl zdebug + drop will show you all live packet drops in both SecureXL and the INSPECT Firewall Instances and why.