topic Re: move IKE implied from first rule to before last or disable in General Topics

move IKE implied from first rule to before last or disable

ISG-Network — Thu, 16 Jan 2025 21:53:36 GMT

I would like to disable IKE rule from implied rules and would like to manage it via access-policies or move them to the before last. Is there a way we can do that?

Re: move IKE implied from first rule to before last or disable

the_rock — Fri, 17 Jan 2025 02:31:52 GMT

Personally, unless there is a really good reason to do this, I would NOT do it. Implied rules are there for a reason. However, if you do have a totally valid case for this, I would still confirm with TAC.

Andy

Re: move IKE implied from first rule to before last or disable

AkosBakos — Fri, 17 Jan 2025 07:26:33 GMT

Hi @ISG-Network

I the past, when the implied rules weren't logged, we did this to get log of them. So it was a valid scenario. Nowadays, i don't see the purpose of do this. What is the exact reason?

Re: move IKE implied from first rule to before last or disable

PhoneBoy — Fri, 17 Jan 2025 15:02:58 GMT

Decryption actually happens before the Access Policy is applied, which is one of the reasons it is one of the first implied rules.
However, you can use rate limiting rules to control access:

https://community.checkpoint.com/t5/Security-Gateways/Block-VPN-Traffic-by-Country/m-p/172695#M31396