topic Re: Order of Geo-Protection Enforcement in R80.20 in Firewall and Security Management

Order of Geo-Protection Enforcement in R80.20

Patrick_Taphorn — Fri, 21 Dec 2018 01:55:46 GMT

Scenario: R80.20 gateway is assigned to Geo-Protection policy that Allows access To/From United States, To/From Isreal, and default action of Drop for all other countries.

End-user is traveling to United Kingdom and needs access web server behind gateway. An Access Policy rule is created using new R80.20 Updatable Geo Object to allow United Kingdom access to web Server.

Question: Will The Geo-Protection policy drop the traffic from the United Kingdom BEFORE the access policy rule is hit?

Re: Order of Geo-Protection Enforcement in R80.20

Ryan_St__Germai — Fri, 21 Jun 2019 09:08:16 GMT

I asked a similar question. I didn't get a direct answer. https://community.checkpoint.com/thread/9888-do-geo-location-objects-trump-the-ips-geo-policy

Re: Order of Geo-Protection Enforcement in R80.20

_Val_ — Fri, 21 Dec 2018 14:05:08 GMT

Actually, the answer you got is correct, but probably not clear enough.

As far as I am concerned, and that was also mentioned by Tim Hall, Geo policy is enforced before Access rules. The comment done by Tomer is saying: if you have any concerns about order of rules, use Unified Policy with inline layers, where you have more control over the order of things.

Now, in the example above the topic starter only allows USA and Israel traffic while dropping anything else. The answer to the question at the end is yes, rule 7 will not be matched, as Geo Policy drops all UK traffic before Access rules

Re: Order of Geo-Protection Enforcement in R80.20

Timothy_Hall — Fri, 21 Dec 2018 15:20:04 GMT

Geo Policy will always be enforced first, long before the rulebase is ever reached. If Geo Policy specifies a drop (whether configured as a whitelist or a blacklist) the traffic will be killed very early in firewall processing. If Geo Policy specifies an Accept, then the rulebase potentially using Geo Objects in R80.20 will be consulted. From a performance optimization perspective, it is always preferable to drop traffic using the Geo Policy if possible but the Geo Objects in R80.20 do offer some additional policy flexibility.

Your question is quite timely for reasons that will be publicly announced soon. 🙂

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: Order of Geo-Protection Enforcement in R80.20

Patrick_Taphorn — Fri, 21 Dec 2018 15:43:48 GMT

Thanks Tim for the clarification. Hopefully the big announcement is being able to select a Updatable Geo Object as a source or destination object in the Geo Policy Exceptions list.

Re: Order of Geo-Protection Enforcement in R80.20

Timothy_Hall — Thu, 27 Dec 2018 14:32:31 GMT

Actually the announcement is that I will be kicking off the Tuesday CheckMates break-out sessions at CPX360 Vegas and Vienna with an in-depth discussion of "your secret weapon" Geo Policy/Objects.

See the CPX360 schedule for details.

Re: Order of Geo-Protection Enforcement in R80.20

Danny — Wed, 17 Apr 2019 18:42:50 GMT

I added a check for Geo Policy Blade and it's update status to our ccc script.