topic Re: Checkpoint interface topology in Firewall and Security Management

Checkpoint interface topology

Prathmesh131992 — Tue, 30 Dec 2025 16:50:27 GMT

Hi team,

Can I know difference between get interface with topology and without topology meaning. And when we use this, tell me scenario.

Re: Checkpoint interface topology

PhoneBoy — Tue, 30 Dec 2025 23:42:56 GMT

One of the core security features of the product is Anti-Spoofing.
For anti-spoofing to work, topology must be defined.
The topology includes all the networks reachable from that interface.

This can either be done manually or as part of "Get Interfaces with Topology" though you should only use this option before the gateway goes into production.
This has been discussed here among other places: https://community.checkpoint.com/t5/General-Topics/Get-interface/m-p/246503

Re: Checkpoint interface topology

Martijn — Wed, 31 Dec 2025 08:01:13 GMT

When you get interfaces with topology, Check Point will automatically generate objects for the anti-spoofing settings.
They will be linked to the interfaces, but may not be visible in the Object Tree. Check:

sk126872 - Some Network objects are not visible in the SmartConsole object list

Something to be aware of if you want to use these objects in a policy.

Re: Checkpoint interface topology

Vincent_Bacher — Wed, 31 Dec 2025 09:55:05 GMT

Since I encountered problems here and there a long time ago when importing with topology, I have never done it again since then, and the point mentioned that objects are automatically created that I create myself has prevented me from doing it again to this day. But for beginners, I would always recommend importing with topology first and learning how to use as feature correctly.

Re: Checkpoint interface topology

the_rock — Wed, 31 Dec 2025 14:20:26 GMT

I personally never do get interface with topology, as that would reset it all to what fw "thinks" should be defined...its way safer (in my opinion) to do without topology and as long as you set it per routing option, you are good to go, since if something changes on that interface subnet, no need to do anything, it would update it for you.

Below is what Im referring to and its always good idea to assign the zone as well.

Also, in simple words, anti spoofing is there so say if interface subnet is on 10.10.10.0/24 and traffic comes from 192.x.x something, it would get dropped.

Interface - Topology Settings

Re: Checkpoint interface topology

genisis__ — Wed, 31 Dec 2025 14:36:30 GMT

With dynamic routes, better to either turn it off, not really recommended or as you have said use "Network defined by routes", but ultimately need to keep an eye on it, and would suggest not using prevent mode straight away if you have critical services.

Re: Checkpoint interface topology

the_rock — Wed, 31 Dec 2025 14:37:25 GMT

100%