https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169521#M30700 <P>This is indeed the correct behavior.&nbsp;</P> <P>I will make sure it is updated in all the administration guides.</P> <P>Tal</P> Sun, 29 Jan 2023 11:41:20 GMT Tal_Paz-Fridman 2023-01-29T11:41:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169246#M30636 <P>Management R81.10</P> <P>&nbsp;</P> <P><A href="https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_IdentityAwareness_AdminGuide/Content/Topics-IDAG/Configuring-Identity-Awareness-Using-Identity-Awareness-in-Firewall-Rule-Base.htm?TocPath=Configuring%20Identity%20Awareness%7CUsing%20Identity%20Awareness%20in%20the%20Firewall%20Rule%20Base%7C_____2#Negate_and_Drop" target="_blank">https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_IdentityAwareness_AdminGuide/Content/Topics-IDAG/Configuring-Identity-Awareness-Using-Identity-Awareness-in-Firewall-Rule-Base.htm?TocPath=Configuring%20Identity%20Awareness%7CUsing%20Identity%20Awareness%20in%20the%20Firewall%20Rule%20Base%7C_____2#Negate_and_Drop</A></P> <P>&nbsp;</P> <DIV id="tinyMceEditorabihsot___1" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image.png" style="width: 242px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/19315i88B1DE0A71B6BDFF/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></P> Thu, 26 Jan 2023 08:38:54 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169246#M30636 abihsot__ 2023-01-26T08:38:54Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169253#M30638 <P>Can you please share a screenshot of the rule&nbsp;you tried, you negated the actual object?</P> Thu, 26 Jan 2023 09:21:13 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169253#M30638 Chris_Atkinson 2023-01-26T09:21:13Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169256#M30639 <P>I am not aware how you can negate object. I negated cell, which contains only access role and management doesn't allow to publish changes where consequently no policy installation is possible.</P> Thu, 26 Jan 2023 09:31:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169256#M30639 abihsot__ 2023-01-26T09:31:43Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169258#M30640 <DIV id="tinyMceEditor_742af0da919011abihsot___0" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <P>example rule.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/19316i0041EB249E154E87/image-size/large?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span></P> Thu, 26 Jan 2023 09:35:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169258#M30640 abihsot__ 2023-01-26T09:35:33Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169268#M30642 <P>This is the only way to get which result ? Looks like you want to drop all sources that are not your test-access-role. So better use two rules: test-access-role any any any allow and any any any any drop...</P> Thu, 26 Jan 2023 11:48:13 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169268#M30642 G_W_Albrecht 2023-01-26T11:48:13Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169271#M30643 <P>This is just an example rule as it was requested.</P> <P>The point here is that documentation contradict to what you get in management. It was long time ago, but I am pretty sure it worked in previous versions.</P> Thu, 26 Jan 2023 12:01:46 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169271#M30643 abihsot__ 2023-01-26T12:01:46Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169279#M30645 <P>I have sent a request to the relevant R&amp;D owner and will update.</P> Thu, 26 Jan 2023 13:05:38 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169279#M30645 Tal_Paz-Fridman 2023-01-26T13:05:38Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169521#M30700 <P>This is indeed the correct behavior.&nbsp;</P> <P>I will make sure it is updated in all the administration guides.</P> <P>Tal</P> Sun, 29 Jan 2023 11:41:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169521#M30700 Tal_Paz-Fridman 2023-01-29T11:41:20Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169530#M30703 <P>It did work 100%. I remember customer doing this in R80.20 version just fine.</P> Sun, 29 Jan 2023 17:09:20 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Negate-access-role-no-longer-possible/m-p/169530#M30703 the_rock 2023-01-29T17:09:20Z