topic Re: Blocking rule editing in General Topics

Blocking rule editing

Hllrdm — Wed, 12 Jul 2023 12:32:51 GMT

We need to restrict the editing of all rules from a certain section tittle for other administrators, and that they can only be edited by admin. Is it possible to do this in Check Point?

Re: Blocking rule editing

the_rock — Wed, 12 Jul 2023 12:45:40 GMT

If you can send a screenshot and circle what you want to di, I can test it in my lab.

Andy

Re: Blocking rule editing

Hllrdm — Wed, 12 Jul 2023 12:50:14 GMT

For example, administrators other than Administator cannot edit 1-13 rules

Re: Blocking rule editing

Tal_Paz-Fridman — Wed, 12 Jul 2023 12:53:17 GMT

Granting permission for a specific section of the rulebase is not feasible. However, you can explore the following alternatives:

Implement Ordered Layers and assign distinct Permission Profiles to each layer.
Transition to Multi-Domain Security Management, which allows you to utilize a Global Domain for a particular policy segment, while the Domain level administrator handles the remaining sections.

Re: Blocking rule editing

the_rock — Wed, 12 Jul 2023 12:54:05 GMT

I have an hour before my next call, so stand by, let me see if this is possible.

Cheers,

Andy

Re: Blocking rule editing

Hllrdm — Wed, 12 Jul 2023 12:56:40 GMT

Implement Ordered Layers and assign distinct Permission Profiles to each layer.

Could you describe this process in more detail?

Re: Blocking rule editing

Hllrdm — Wed, 12 Jul 2023 12:58:04 GMT

Thank you I have figured out the technology in question.

Re: Blocking rule editing

the_rock — Wed, 12 Jul 2023 13:00:11 GMT

I think what @Tal_Paz-Fridman said makes sense. I looked for any setting related to being able to possible prevent given admin from modifying regular rule(s), but it does not appear to exist anywhere.

Its definitely good candidate for RFE, in my view.

Andy

Re: Blocking rule editing

Hllrdm — Wed, 12 Jul 2023 13:01:54 GMT

Yeah, that's what I thought, too. MDS implementation is quite difficult in terms of time, while layers implementation is simple. We will try this option, thanks

Re: Blocking rule editing

the_rock — Wed, 12 Jul 2023 13:06:15 GMT

Im fairly sure this is what @Tal_Paz-Fridman was referring to.

Andy

Re: Blocking rule editing

PhoneBoy — Thu, 13 Jul 2023 22:15:04 GMT

Directly, no.
However, through use of a SmartTask like https://community.checkpoint.com/t5/Management/SmartTask-Custom-Permissions/m-p/77247#M11281, it should be possible.