topic Re: Verify Access Control Policy - desire feature? in Firewall and Security Management

Verify Access Control Policy - desire feature?

S_E_ — Mon, 15 Apr 2019 13:22:51 GMT

Hi,

we just recognized following:

Give is a SmartCenter with multiple policies sets. Each policy has a certain firewall assigned. One of the policy set is attached to a 'test firewall' gateway, and only for test purposes.

Running now the verifier on the SmartCenter, it checks *all* security policies, not only the active one (highlighted tab). And if there is something wrong with the 'test policy set', you are not able to verify/push one of the other policies.

Is this a desired feature or a bug?

I was originally under the impression that the policies are independent. At least, you do not use the same objects.

Regards,

Security Management Server R80.20 Jumbo Take 10

Re: Verify Access Control Policy - desire feature?

PhoneBoy — Mon, 15 Apr 2019 14:45:05 GMT

In R80.20, at least, you have to choose the policy you wish to verify.

How are you verifying policy?

Re: Verify Access Control Policy - desire feature?

S_E_ — Mon, 15 Apr 2019 15:28:30 GMT

hi,

exactly as you described. Via main menu in SmartConsole.

Regards

Re: Verify Access Control Policy - desire feature?

PhoneBoy — Mon, 15 Apr 2019 17:04:54 GMT

How do you know it's verifying multiple policies and not the one you specified?

Re: Verify Access Control Policy - desire feature?

S_E_ — Tue, 16 Apr 2019 06:39:14 GMT

hi,

good point.

Verification has been done on one of the policies.

The verification stopped with errors. However, the test policy had a broken cluster member. (misconfiguration on the test gateway)

Regards

Re: Verify Access Control Policy - desire feature?

G_W_Albrecht — Tue, 16 Apr 2019 07:19:46 GMT

You wrote: if there is something wrong with the 'test policy set', you are not able to verify/push one of the other policies.

Can you provide more details and screenshots ? Never have encountered such an issue...

Re: Verify Access Control Policy - desire feature?

S_E_ — Thu, 18 Apr 2019 11:21:38 GMT

hi,

sorry, can't really share a screenshot (customer system)

And it we recognized this 2 times. Obviously when someone 'played' in the test policy/test-gw.

So, meanwhile I assume. There should be no impact between the poliy sets when you are not using the same objects.

Thanks

Regards

Re: Verify Access Control Policy - desire feature?

G_W_Albrecht — Thu, 18 Apr 2019 11:30:52 GMT

You can obfuscate / blacken any screenshot to hide customer details !

Re: Verify Access Control Policy - desire feature?

PhoneBoy — Thu, 18 Apr 2019 19:44:34 GMT

Might be worth a TAC case instead as this doesn't seem like expected behavior.