topic Re: IMPLIED RULE NUMBER 0 in Firewall and Security Management

IMPLIED RULE NUMBER 0

Capt_Mundo — Sun, 30 Jul 2023 06:14:33 GMT

Hi Admin,

I have a question. What does implied rule number 0 means? When a traffic is accepted and logged via Implied Rule number 0, does that mean the traffic has a session?

Thanks

Re: IMPLIED RULE NUMBER 0

Chris_Atkinson — Sun, 30 Jul 2023 07:48:20 GMT

The following resources should help with your understanding:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topics-SECMG/Implied_Rules.htm

https://support.checkpoint.com/results/sk/sk17745

Re: IMPLIED RULE NUMBER 0

kristen09 — Tue, 01 Aug 2023 09:01:23 GMT

@Capt_Mundo wrote: LiveTheOrangeLife
Hi Admin,
I have a question. What does implied rule number 0 means? When a traffic is accepted and logged via Implied Rule number 0, does that mean the traffic has a session?
Thanks

Hello,

Implied Rule number 0 is a concept used in some firewall configurations. It refers to the default rule that allows traffic that doesn't match any explicit rules to be accepted and logged. When traffic is accepted and logged via Implied Rule number 0, it means that the firewall allowed the traffic because there was no specific rule to block it.

I hope this may be right answer.

Best regard,

Kristen

Re: IMPLIED RULE NUMBER 0

DBS — Fri, 09 Feb 2024 05:03:40 GMT

Handy to know

Re: IMPLIED RULE NUMBER 0

hilalwani — Wed, 06 Mar 2024 09:04:01 GMT

I have a stealth rule in place which is blocking outside to inside unknown traffic. but yesterday morning the firewall received a traffic from an unknown malware site and accepted/passed that malware site through an implied rule. I wonder how is it possible.

Re: IMPLIED RULE NUMBER 0

G_W_Albrecht — Wed, 06 Mar 2024 09:20:48 GMT

The last sentence is not true - when traffic is accepted and logged via Implied Rule, no further inspection by the FW is done, no matter if there is a specific rule to block it or not. Sounds like ChatGPT to me...

Re: IMPLIED RULE NUMBER 0

RamGuy239 — Thu, 10 Oct 2024 10:09:45 GMT

I know this is a old post. But I just wanted to correct the above statement:

When traffic is accepted and logged via Implied Rule number 0, it means that the firewall allowed the traffic because there was no specific rule to block it.

This is not the case, at least not with Check Point. Implied Rules on Check Point will match as rule 0, that is correct. But as the name implies, rule 0 comes before your explicit rules. This traffic won't get blocked by you creating rules to block it, as the traffic will always match rule 0 first.

:18190 for instance is SIC and is accepted in implied rules by default as part of "Control Connections". Unless you override and disable this, you won't be able to block TCP-18190. Even if you create rule 1 saying src:any, dst:any, service:tcp-18190, action:drop, you would still not be dropping any TCP-18190 traffic, because it's matching and being accepted in rule 0.

Re: IMPLIED RULE NUMBER 0

_Val_ — Thu, 10 Oct 2024 10:14:29 GMT

absolutely right