topic Re: MDS - Workflow permission in Firewall and Security Management

MDS - Workflow permission

Magnus-Holmberg — Mon, 09 Oct 2023 15:32:40 GMT

Hi,

We have upgraded a few MDS now to R81.20 with some issues.
But my question is.

The Multi-Domain super users / Domains Super User etc by default.
They are refering to permission profile "read write all"

However the Read Write all default profile is not having the "approve / reject other sessions"
And all default object are "read only"

What is check points recommendation, create new profiles and dont use the default object.
Or is this something that will be availible later on within a HFA?

Regards,
Magnus

Re: MDS - Workflow permission

PhoneBoy — Mon, 09 Oct 2023 21:39:47 GMT

The default permission profiles are Read Only and cannot be modified.
However, "Super User" (one of the default permissions) includes Approve/Reject other sessions.

Re: MDS - Workflow permission

Magnus-Holmberg — Sat, 21 Oct 2023 13:07:57 GMT

Am unable to create a MDS Superuser that get this access.
This cant be how its intended to work

No, the domain - superuser is ref the same read / writes all that is not changeable and do not include this permission.
So am not able to create any high priv account with this access.

Regards,
Magnus

Re: MDS - Workflow permission

PhoneBoy — Fri, 20 Oct 2023 20:10:48 GMT

Seems like an oversight.
@Tomer_Noy do you know if this is intended behavior?

Re: MDS - Workflow permission

MES — Thu, 16 Nov 2023 09:11:59 GMT

I have the same problem after the upgrade to 81.20 + JH38. Practically I'm not able to reset any password for the MDS users anymore. How can we resolve this issue?

Re: MDS - Workflow permission

PhoneBoy — Thu, 16 Nov 2023 17:15:53 GMT

If this behavior changed as a result of an upgrade and it's not otherwise documented as expected behavior, it warrants a TAC case: https://help.checkpoint.com

Re: MDS - Workflow permission

Magnus-Holmberg — Thu, 28 Dec 2023 11:12:49 GMT

Same still on R81.20 HFA41, dont know did you get it resolved?