https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198766#M33224 <P>Thanks and for completeness how is the "CheckPoints" object defined?</P> Thu, 23 Nov 2023 13:46:43 GMT Chris_Atkinson 2023-11-23T13:46:43Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198723#M33220 <P>Good afternoon</P><P>We have a problem with access policies<BR />We have configured Internet access for CheckPoint firewall objects.<BR />But we also see that the user network 192.168.0.0 also passes this rule and they have access to the Internet. Can you tell me why this problem might occur?</P> Thu, 23 Nov 2023 08:17:36 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198723#M33220 Oliver_222 2023-11-23T08:17:36Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198743#M33221 <P>Please share a redacted screenshot of the rules that you have created ?</P> <P>If you look at the logs for this traffic which rules does it say it has matched?</P> Thu, 23 Nov 2023 11:12:59 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198743#M33221 Chris_Atkinson 2023-11-23T11:12:59Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198749#M33222 <P>I will correct the input information: checkpoints have access to everything, but for some reason the network 192.168.0.0 when accessing our web resource passes the rule for checkpoints.<BR /><BR />log - 1 screenshot<BR />Access rule for checkpoint objects - 2 screenshot<BR />Access rule for user network- 3 screenshot<BR />NAT rule for user network - 4 screenshot</P> Thu, 23 Nov 2023 12:36:02 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198749#M33222 Oliver_222 2023-11-23T12:36:02Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198766#M33224 <P>Thanks and for completeness how is the "CheckPoints" object defined?</P> Thu, 23 Nov 2023 13:46:43 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198766#M33224 Chris_Atkinson 2023-11-23T13:46:43Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198770#M33225 <P>This group contains firewall and management server objects</P> Thu, 23 Nov 2023 14:09:35 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198770#M33225 Oliver_222 2023-11-23T14:09:35Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198781#M33227 <P>Check the logic using a 'packet mode' search of the access policy and 'fw up_excute' from the gateway CLI.</P> <P>Pending the results I would consult TAC further via a remote session to take a look without needing to censor the outputs like you might here.</P> Thu, 23 Nov 2023 15:14:42 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198781#M33227 Chris_Atkinson 2023-11-23T15:14:42Z https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198783#M33228 <P>Have you done any captures to see why traffic is failing? Zdebug, tcpdump, fw monitor?</P> <P>Andy</P> Thu, 23 Nov 2023 15:36:21 GMT https://community.checkpoint.com/t5/General-Topics/Internet-access-for-CheckPoint-firewall-objects-problem/m-p/198783#M33228 the_rock 2023-11-23T15:36:21Z