topic How to Create IA Access Role with Multi Src,Dst IP-Address? in Firewall and Security Management

How to Create IA Access Role with Multi Src,Dst IP-Address?

Security_Consul — Tue, 14 Jul 2020 05:37:28 GMT

I have planned to integrate Identity Awareness for Large Scale with existing production firewall, we have existing 1700+ Rule with "networks, service object" So my target is Add "AD User, Networks, Service object on the top of existing rule with new rule for Monitoring before migrate to New Rule with Access role.

Example Existing Rule

Source IP have 20+ Object, Destination IP 20+ Object

If possible don't change behavior for my customer admin to manage their firewall. existing behavior admin can verify src,dst IP its just look at the rule because src,dst shown on the rule. In the feature admin have to double click on "access-role" for check src,dst IP some thing like that.

My English skill is not so good, But I'm try to explain!

GIAG R80.30

Re: How to Create IA Access Role with Multi Src,Dst IP-Address?

PhoneBoy — Tue, 14 Jul 2020 15:43:31 GMT

An Access Role can incorporate one or more of the following:

Username
Host (as registered to Active Directory)
Specific Source IP or Network
Remote Access Client (from R80.10)

Access Roles can be used in a Source or Destination in a role.
However, you can't mix "regular" network objects and Access Roles in the same source/destination cell, discussed here: https://community.checkpoint.com/t5/Policy-Management/Policy-verification-failed-for-rule-with-network-objects-and/m-p/66718#M3942
This might mean duplicating some of your existing rules.

Re: How to Create IA Access Role with Multi Src,Dst IP-Address?

Security_Consul — Wed, 15 Jul 2020 07:01:20 GMT

Its only way to create access role rule just add everything need to consider of the rule into 1 access role object (Network Object, AD User)

May be add more one access role object

But my target no need to change admin's behavior.