topic Re: Internet related rules in General Topics

Internet related rules

Lukasz_Pienkows — Tue, 03 Jan 2023 11:55:47 GMT

Hi,

I've been asked to provide rules for Internet traffic. Customer wants to know what is allowed towards Internet.

Is there any way to do it?

I have MDS setup with per-Customer CMAs.

Thanks

Lukas

Re: Internet related rules

Chris_Atkinson — Tue, 03 Jan 2023 12:11:17 GMT

There are a few ways to achieve this.

One option is possibly using "packet mode" and searching for a destination that is not an RFC1918 address.

Refer:

https://community.checkpoint.com/t5/Management/Search-through-your-policy-using-R80-10-new-Packet-Mode-feature/td-p/44133

Re: Internet related rules

PhoneBoy — Tue, 03 Jan 2023 16:05:13 GMT

Rules that potentially involve the Internet have a few possible characteristics:

Destination of Any (or All_Internet)
Destination of Internet
Destination involving an external Security Zone
Destination involving an IP that is not RFC-1918

I presume you can write a script to parse the output of show-rulebase and pull out the rules in a specific policy layer that meet these requirements.
If you use show-as-ranges true in the call, you'll get the IP addresses covered by the rule, which should help in identifying such rules.