topic Re: Variables in Snort Rules to identify Networks in Firewall and Security Management

Variables in Snort Rules to identify Networks

Moosa — Sun, 31 Jul 2022 21:38:48 GMT

Hi Everyone,

It seems like a very basic question, but I cannot find an answer for it.

In Snort Rules there are two variables commonly used: $EXTERNAL_NET and $HOME_NET

In Cisco FMC there is something called variable sets, where we define these variables and include the subnets in the variables.

Where do we do that in Check Point? I am not aware of any variables I can create in Check Point. Will it be identified by a Network Object if I create them by exact name as variables in Snort Rule?

Thanks in advance.

Re: Variables in Snort Rules to identify Networks

PhoneBoy — Mon, 01 Aug 2022 01:27:56 GMT

Those variables are automatically converted to “any” and cannot be set.
I presume this also applies in later versions than R80.30 as well.
See: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ThreatPrevention_AdminGuide/html_frameset.htm

Re: Variables in Snort Rules to identify Networks

Moosa — Mon, 01 Aug 2022 13:33:25 GMT

Thank you. I went through that document yet missed that point, it is mentioned there.