topic Re: Problems with INTERNET object in Firewall and Security Management

Problems with INTERNET object

Matlu — Sat, 31 May 2025 00:49:58 GMT

Hello, Mates

Have you ever had errors with FW rules, which have configured in the “Destination” column the object “INTERNET” that appears when we activate APPC+URL?

I have a few policies, but the FW does not respect the order of the rules, and goes to the implicit one which is “Clean UP” and blocks the traffic.

When I change the destination from “INTERNET” to an “ANY”, the FW starts to “respect” the order of all the rules.

For example:
Rule 1:
Source: 100.130.10.0/24
Destination: INTERNET
Services: News/Media

If I leave the rule as I just wrote it, the FW does not respect the traffic, and goes to the last rule, and everything is discarded.
The only solution I have found is to change the “INTERNET” to “ANY” and then everything works fine.

Any idea why this is happening?

I have a FW in R82 version, with active blades like “APPC,URFL, IPS, AV”.

Greetings.

Re: Problems with INTERNET object

Chris_Atkinson — Sat, 31 May 2025 02:09:34 GMT

How is your topology defined, is 100.130.10.0/24 the actual src subnet for example a DMZ?

Re: Problems with INTERNET object

Matlu — Sat, 31 May 2025 02:25:36 GMT

Hello
My Check Point is in bridge mode.
I am not currently working the device with 'Securitys Zones'
In the topology of my Check Point object, I only have one of the interfaces referenced as EXTERNAL and the other as THIS NETWORK.

Re: Problems with INTERNET object

Chris_Atkinson — Sat, 31 May 2025 02:38:31 GMT

There are existing SKs for such scenarios refer sk106319, sk152432

Re: Problems with INTERNET object

the_rock — Sat, 31 May 2025 13:33:00 GMT

Ola bro,

Never had such an issue myself, you just need urlf blade enabled in the layer to use Internet object. Can you give an example? I can test it in the lab tomorrow.

Andy

Re: Problems with INTERNET object

Chris_Atkinson — Sat, 31 May 2025 23:44:30 GMT

It's expected behavior for some topologies involving bridge mode, improperly defined topology or only a single interface.

Re: Problems with INTERNET object

the_rock — Sat, 31 May 2025 23:48:46 GMT

Ah ok, makes sense.

Andy

Re: Problems with INTERNET object

Matlu — Sun, 01 Jun 2025 16:10:20 GMT

My only doubt with the documents, is that there is no ‘listed’ version R81.20 and R82

Should I assume that this behavior, impacts all versions, despite not being in the document?

Thanks

Re: Problems with INTERNET object

the_rock — Sun, 01 Jun 2025 20:08:32 GMT

That would make sense to me bro.

Andy