topic Re: Policies in Traditional and Simplified mode in Firewall and Security Management

Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 15:41:56 GMT

Is it possible to copy all firewall, QoS rules from a simplified policy to a traditional policy?

Re: Policies in Traditional and Simplified mode

PhoneBoy — Fri, 06 Jul 2018 16:57:16 GMT

Traditional Mode policies have been discouraged since at least NG (R5x) versions.

In R80, the ability to create new Traditional Mode policies was removed and isn't coming back.

What's the real problem you're trying to solve?

Let's find a way to solve that in a way that doesn't involve Traditional Mode policies.

Re: Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 17:25:23 GMT

Hello Dameon,

Thank you first.

I have a IPsec VPN established and I need to forward all Internet traffic to this tunnel, but only one internal subnet must be affected on tihs.

How can I do this using communities?

Re: Policies in Traditional and Simplified mode

PhoneBoy — Fri, 06 Jul 2018 19:59:03 GMT

This exact problem (and solution) is here: Excluding subnets in encryption domain from accessing a specific VPN community

Re: Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 22:18:49 GMT

Thank you Dameon.

I want to send to that tunnel only requests from 192.168.1.0/24 going to the Internet (example);

Thinking on that, I will need to exclude all my internal subnets going to the Internet, example:

// // User defined INSPECT code //  vpn_exclude_src={<192.168.1.1,192.168.1.254>}; vpn_exclude_dst={<I need to put all Internet IPs here?>};  #ifndef IPV6_FLAVORipv #define NON_VPN_TRAFFIC_RULES ((src in vpn_exclude_src) and (dst in vpn_exclude_dst)) #else #define NON_VPN_TRAFFIC_RULES 0 #endif

So, I'll need to put all Internet IPs on vpn_exclude_dst?

Re: Policies in Traditional and Simplified mode

PhoneBoy — Fri, 06 Jul 2018 22:32:36 GMT

Correct.

All IPs can be represented using the range specified in the All_Internet object, which is <0.0.0.0,255.255.255.255>.

Re: Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 22:36:11 GMT

Thanks

Re: Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 22:40:14 GMT

And a curious thing: why Check Point does not put this kind of configuration in the Smart Dashboard?

Re: Policies in Traditional and Simplified mode

PhoneBoy — Fri, 06 Jul 2018 22:51:21 GMT

If I had to guess, it's because it's not a common use case.

I personally hadn't heard of this specific use case before.

Re: Policies in Traditional and Simplified mode

Jones_Jardel_Po — Fri, 06 Jul 2018 23:16:51 GMT

Uhmmm... but this case does not sounds like a not common case.

If it was a common case, we will not have a SK to this kind of situation...

Re: Policies in Traditional and Simplified mode

PhoneBoy — Fri, 06 Jul 2018 23:40:51 GMT

SKs exist for both common and uncommon issues.