topic Re: Outbound Firewall Cleanup Rule in Endpoint

Outbound Firewall Cleanup Rule

RobertTaylor — Thu, 15 Aug 2024 05:39:22 GMT

I'm trying to implement a "Outbound - Cleanup" rule as shown that logs blocked traffic.

The purpose of this is two part:

Block Any Undefined Traffic
Log Blocked Traffic in case additional exceptions are required (logging wouldn't always need to be enabled, just sometimes when troubleshooting a policy)

The issue that I'm having is that after applying this policy HTTP traffic is being blocked by the Cleanup rule even though it is added as a service on Rule #3.

Is this how its supposed to work?

Am I missing something, or is this a bug?

Re: Outbound Firewall Cleanup Rule

PhoneBoy — Thu, 15 Aug 2024 17:19:39 GMT

Are you managing via Infinity Portal or on-prem (and if so, what version/JHF level)?
What client version(s) is/are involved?

Re: Outbound Firewall Cleanup Rule

the_rock — Thu, 15 Aug 2024 17:33:59 GMT

You mean rule 2?

Andy

Re: Outbound Firewall Cleanup Rule

RobertTaylor — Thu, 15 Aug 2024 22:52:40 GMT

Sorry your correct, yes I meant rule #2

Re: Outbound Firewall Cleanup Rule

RobertTaylor — Thu, 15 Aug 2024 22:54:42 GMT

This is an Infinity Portal service (EPMaaS).

The installed version is the current recommended version 88.32.

Re: Outbound Firewall Cleanup Rule

the_rock — Thu, 15 Aug 2024 23:00:16 GMT

I dont know if fw up execute command works on smb, but you can try. Just google fw up execute check point and it will give right syntax.

Andy

Re: Outbound Firewall Cleanup Rule

RobertTaylor — Thu, 15 Aug 2024 23:01:57 GMT

Is that for endpoint or gw?

Re: Outbound Firewall Cleanup Rule

the_rock — Thu, 15 Aug 2024 23:07:58 GMT

gateway

Re: Outbound Firewall Cleanup Rule

RobertTaylor — Thu, 15 Aug 2024 23:22:26 GMT

ok
I'm having this issue on the endpoint, thanks for the help though

Re: Outbound Firewall Cleanup Rule

the_rock — Thu, 15 Aug 2024 23:24:36 GMT

I know you are, but fw is dropping it on wrong rule, so to me, seems like fw problem, NOT endpoint

Re: Outbound Firewall Cleanup Rule

PhoneBoy — Fri, 16 Aug 2024 18:04:48 GMT

Endpoint has its own firewall that operates a bit differently from our Quantum (Spark) appliances 🙂

Re: Outbound Firewall Cleanup Rule

PhoneBoy — Fri, 16 Aug 2024 18:05:10 GMT

Recommend engaging the TAC here: https://help.checkpoint.com

Re: Outbound Firewall Cleanup Rule

the_rock — Fri, 16 Aug 2024 18:40:48 GMT

K, fair enough, tells u how much I know about endpoint side lol

Andy