topic Policy verification between a rule that has as source access role and a rule that has as source IP. in Firewall and Security Management

Policy verification between a rule that has as source access role and a rule that has as source IP.

KostasGR — Fri, 02 Apr 2021 09:53:17 GMT

Hello

Can policy verification at r80.40 work between a rule that has as source access role with specific network 192.168.1.0/24 and any user for example and a rule that has as source IP the network 192.168.1.0/24?

BR,

Kostas

Re: Policy verification between a rule that has as source access role and a rule that has as source

PhoneBoy — Sat, 03 Apr 2021 16:27:02 GMT

Rules are only marked as hiding when they have the same source/destination/service.
In R80.40, if such rules have the same action, they’re not flagged at all.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk161574&partition=Advanced&product=Quantum

For your specific question: I don’t know what the intended behavior is.

Re: Policy verification between a rule that has as source access role and a rule that has as source

the_rock — Sun, 04 Apr 2021 01:48:10 GMT

Can you send specific example (screenshot)? I believe this behavior never changed with Check Point since days of R55 or even before. If specific rule higher in the rulebase hides one below, then verification will most likely fail. Its a bit different now with layered rules, but principle is still the same.

Re: Policy verification between a rule that has as source access role and a rule that has as source

PhoneBoy — Mon, 05 Apr 2021 01:11:42 GMT

R55 did not have Access Role objects (that only came in at R75).
That said, the basic rulebase verification logic is the same as it's been since well before that.
Between the rulebase layers and the different rulebase matching process in R80+, I'm not sure how relevant the policy verification step is.

Re: Policy verification between a rule that has as source access role and a rule that has as source

KostasGR — Tue, 06 Apr 2021 06:17:33 GMT

Hello

I am attaching the screenshots.

The verification result is pass.

BR,

Kostas