topic Re: Mobile Access Web Portal Access Matching Rule Issue in General Topics

Mobile Access Web Portal Access Matching Rule Issue

zeromahesh — Thu, 17 Dec 2020 03:19:57 GMT

Hi All,

I have been experiencing below issue related to Mobile Access Portal.

My requirement is to just block specific Public IPs from accessing Mobile Access Portal. What I've done is, I change Mobile Access->Portal Settings->According to the firewall policy to enabled and placed an explicit security rule to block required source IPs and then below that placed an explicit security rule to allow any source IP to Mobile Access Portal.

My Observation:

My Mobile Access Portal got blocked as expected to the required blocked IP addresses. But issue is when I checked smart log it showed me that blocked requests are also matched with an implied rule and the action is accept instead of my explicit block rule. But other public IPs matched with my explicit allow rule where as I expected.

So my SIEM tool alerting us Blocked IPs are gaining access without getting blocked based on implied rule log.

Re: Mobile Access Web Portal Access Matching Rule Issue

PhoneBoy — Sat, 19 Dec 2020 03:53:02 GMT

Are you actually seeing two logs (one for the implied rule accepting and one for the block rule)?

Re: Mobile Access Web Portal Access Matching Rule Issue

zeromahesh — Sat, 19 Dec 2020 03:58:52 GMT

What I see is when I access Mobile Access Portal using non blocked IP it matches to the explicit rule which allow access to mobile portal. When I access using blocked IP using explicit block rule matches to implicit rule and action shows as accept. But portal getting denied with SSL error. Some logs shows as denied by multiportal infrastructure.

Re: Mobile Access Web Portal Access Matching Rule Issue

PhoneBoy — Sat, 19 Dec 2020 19:12:09 GMT

Multiportal allows multiple portals to share the same port (e.g. Gaia WebUI, MAB, UserCheck).
However, access (i.e. the initial TCP handshake) is generally permitted by implied rules, which is needed to determine which portal to activate.
If you don’t want multiportal to respond at all, then you have to disable multiportal functionality per: https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk165937
However, this means you will need to manually configure ALL the relevant portals to use a unique port.

Re: Mobile Access Web Portal Access Matching Rule Issue

zeromahesh — Sat, 19 Dec 2020 20:48:40 GMT

Hi,

Currently I’ve already set Gia portal (Platform) Accessibility settings to “Internal Interface only”. Mobile Access Portal Accessibility option to “ According to firewall policy”. So what are the other portals published through all the interfaces by default and how to change port or interface.

Re: Mobile Access Web Portal Access Matching Rule Issue

PhoneBoy — Sun, 20 Dec 2020 03:12:03 GMT

Off the top of my head:

Gaia Platform Portal (OS configuration)
Mobile Access Blade
Captive Portal (for Identity Awareness)
UserCheck
Visitor Mode for Remote Access

There may be a few others.
However, disabling/changing all those may not disable multiportal and the relevant implied rules.

Re: Mobile Access Web Portal Access Matching Rule Issue

zeromahesh — Sun, 20 Dec 2020 06:18:04 GMT

Hi,

Major issue that I'm facing is, when Implied rule matches for the connections from explicit rule blocked IPs even though portal is not loaded implied rule log says connection accepted. This incident is alerted by the SIEM tool. How to overcome this issue.

Re: Mobile Access Web Portal Access Matching Rule Issue

PhoneBoy — Sun, 20 Dec 2020 06:33:17 GMT

Seems like you should tune this in the SIEM.
However, if I’m understanding the macro in sk165937 correctly, where it shows you what section to comment out to entirely disable this behavior, you may be able to simply remove the following from the definition:

IMPLIED_LOG,

This will cause the gateway to still accept the connection as it’s doing now but not generate a log message.
Don’t necessarily recommend this approach, tuning the SIEM would be better.

Re: Mobile Access Web Portal Access Matching Rule Issue

zeromahesh — Sun, 20 Dec 2020 06:40:12 GMT

Hi,

Thank you for your suggestion. Please let me know what will happen if I enable separate portals in separate IPs in same interface. Will that solved the issue the way that I'm expecting...?

Re: Mobile Access Web Portal Access Matching Rule Issue

PhoneBoy — Sun, 20 Dec 2020 17:57:11 GMT

The issue is coming from Multiportal itself, not the other portals in use.
Most of the portals can be moved to a different port on the same IP if you prefer, but that doesn’t disable multiportal.