topic Any vs. All_Internet? in Firewall and Security Management

Any vs. All_Internet?

Vladimir — Thu, 09 Nov 2017 20:54:38 GMT

I see multiple references imploring admins to use All_Internet instead of *Any.

Looking at the All_Internet object, it contains a range of 0.0.0.0-255.255.255.255.

Does this object posses any kind of hidden property or unique behavior that makes it a better fit for the policy, or is it simply an alias for *Any?

Re: Any vs. All_Internet?

Danny — Fri, 21 Jun 2019 09:01:27 GMT

The All_Internet object is just a simple network address range containing all IPv4 addresses (public and private) per default. From my point of view this is not ideal for using it within a security policy to address the public Internet, which doesn't route private networks.

I suppose it may supersede the Global Properties definition for Non Unique IP Addresses making proper Policy Verification checks harder. However, from my perspective even *Any is not ideal to address the Internet within a security policy because it means Any network, even private ones, all VPNs, Office Mode and everything.

That's why I created a dedicated topic for:

https://community.checkpoint.com/message/10464

Re: Any vs. All_Internet?

PhoneBoy — Fri, 10 Nov 2017 06:22:36 GMT

In practical terms, Any and All_Internet are identical.

However, when you try to use HIDE NAT on "Any" source, it doesn't work.

If you use All_Internet as the source, it will work.

See: Fail to perform Manual NAT on source with source "Any"

There are a couple of other edge cases documented in SK where you would use All_Internet instead of Any.

Re: Any vs. All_Internet?

Hugo_vd_Kooij — Fri, 10 Nov 2017 09:11:17 GMT

Actually that only makes sense in an IPv4 only world.

In the real world this is no longer the case.

Re: Any vs. All_Internet?

Daniel_Taney — Fri, 10 Nov 2017 18:09:13 GMT

There's additional discussion regarding this topic over in this thread, too, if it helps!