topic Re: Verification succeeds for two same sequential rules in Firewall and Security Management

Verification succeeds for two same sequential rules

KostasGR — Tue, 08 Jun 2021 15:33:14 GMT

Hello

At R81 Verification succeeds for two same sequential rules. See attachment.

You can easily replicate.

BR,

Kostas

Re: Verification succeeds for two same sequential rules

Bob_Zimmerman — Tue, 08 Jun 2021 16:25:25 GMT

At a guess, that seems like something the zone might cause. Zones are complicated to resolve to specific addresses, so I wouldn't be surprised if the verification process treats them as not matching anything, or simply skips rules which use them.

Re: Verification succeeds for two same sequential rules

PhoneBoy — Tue, 08 Jun 2021 19:37:40 GMT

Actually, this is expected behavior from R80.40.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk161574&partition=Advanced&product=Quantum

Re: Verification succeeds for two same sequential rules

Bob_Zimmerman — Thu, 10 Jun 2021 22:38:08 GMT

Wow. That's good to know. I have a few policies in my managements which I don't want anybody pushing (one with QoS, and a few are migrations in progress), so I intentionally break them with overlapping rules at the end. I'll have to confirm they have different actions. They might just be two drop rules in some.

Re: Verification succeeds for two same sequential rules

LaRockas — Fri, 11 Jun 2021 13:07:00 GMT

Hi PhoneBoy ,

The feature with the overlapping rules and the verification was very useful for large environments with many may rules . It was helping to housekeep the rules . Also it was an extra for our environment when we migrate from Cisco ASA , to help us reduce the rules . I understand the need for others to have overlapping rules , but it would be better to be able to change it with some change to the GUI , and not all the procedure that the SK161574 (Advanced Technical Level) describes .

Re: Verification succeeds for two same sequential rules

PhoneBoy — Fri, 11 Jun 2021 23:03:43 GMT

I believe the primary reason this was done was to reduce the overall policy compilation/installation time, also an issue in environments with many, many rules.
I would expect this process to take more time if this check is re-enabled.
Moving the setting to the UI would have to be addressed as an RFE.

Re: Verification succeeds for two same sequential rules

abihsot__ — Wed, 07 Jul 2021 09:07:01 GMT

I feel your frustration. I was thinking the same and policy verification for hide rules is very useful to prevent rulebase from growing unnecessary. In my opinion it is a shady way of speeding up policy installation time.