topic Re: Management Server Traffic Hits the Implied Rules in Firewall and Security Management

Management Server Traffic Hits the Implied Rules

chethan_m — Wed, 13 Aug 2025 06:35:02 GMT

Hi,

We are currently deploying CGNS firewalls on AWS.

Architecture:

The management server is hosted on-premises behind a Check Point firewall cluster.
The CGNS firewall cluster is deployed in the cloud (AWS).
A route-based IPsec site-to-site VPN is established between the on-prem Check Point firewall cluster and the AWS VPN Gateway.

The Issue:

Initially, we successfully established SIC communication between the on-prem SMS and the CGNS firewall cluster, and were able to push policies.
However, after a few minutes, the communication between the SMS and CGNS firewalls dropped (Gateways Lost).
We observed that traffic related to CPD (port 18191) and CPD_amon (port 18192) was hitting implied rules instead of the explicit VPN access rules configured.
Non-Check Point related traffic continues to flow over the VPN tunnel and is encrypted as expected.

Should any exclusions be made in the "$FWDIR/lib/implied_rules.def file" to ensure CP management traffic is properly use the VPN tunnel instead of Implied rules.

Any guidance or suggestions to help resolve this would be greatly appreciated.

Thank you,

Chethan

Re: Management Server Traffic Hits the Implied Rules

_Val_ — Wed, 13 Aug 2025 06:43:53 GMT

SIC traffic should not go via your VPN rules, ever. If your VPn tunnel is down, you would lose control. For that reason, it is covered by implied rules, and it is not recommended to change that.

Management traffic is encrypted, and there is no need to encrypt it again through your IPSec tunnels.

Re: Management Server Traffic Hits the Implied Rules

chethan_m — Wed, 13 Aug 2025 06:48:26 GMT

Thank you for the quick response, @_Val_

There is currently no alternative communication channel between the on-prem SMS and the cloud-deployed CGNS firewalls. AWS Direct Connect is also not yet in place.

Given that the management server traffic is already encrypted, would it be feasible to re-establish SIC using public IP addresses instead of private IP addresses?

Regards,

Chethan

Re: Management Server Traffic Hits the Implied Rules

_Val_ — Wed, 13 Aug 2025 06:51:24 GMT

I don't see why not, I've done this many times with many customers around the globe.

Re: Management Server Traffic Hits the Implied Rules

chethan_m — Wed, 13 Aug 2025 06:57:36 GMT

Thank you once again, I see — this is the solution.

Regards,

Chethan