topic Re: I am curious about the policy matching logic. in Firewall and Security Management

I am curious about the policy matching logic.

JaeYoung_An — Mon, 12 Aug 2024 07:40:51 GMT

I'm curious about check point's policy matching method.

Let's take an example

As shown below, sip and custom-made udp-5060 were included in one policy.

So which of the following two ports does the checkpoint match to?

As far as I know, Service is Any, and if there is a port conflict due to the 'match for any' option, it is determined randomly when installing the policy.

However, I cannot find any explanation as to the order in which they are matched when two conflicting ports are added to one policy.

If you know the policy matching logic or have any SK involved, please let me know

Have a nice day and I'll wait for your reply.

Re: I am curious about the policy matching logic.

rrbranco — Mon, 12 Aug 2024 09:13:53 GMT

take a look here for VOIP

https://support.checkpoint.com/results/sk/sk95369

ATRG: VoIP

Check the topology and all details. Extra attentions to the rules according to your scenario and ports used.

Special attention to the following quotations:

Do not use this service in the same rule with the 'XXXXXX' service (because they contradict each other).

...

Best regards

Re: I am curious about the policy matching logic.

G_W_Albrecht — Mon, 12 Aug 2024 09:24:13 GMT

R81.20 Quantum Security Management Administration Guide - Rule Matching in the Access Control Policy

Re: I am curious about the policy matching logic.

PhoneBoy — Mon, 12 Aug 2024 21:29:08 GMT

You mean one rule?
The multiple "Match for Any" rules behavior is documented: https://support.checkpoint.com/results/sk/sk150553
I assume it is similar when you add the services to the rule explicitly as well (i.e. it's random).