topic Re: Will Geo Policy affect the SIC tunnel between management on cloud and FW on premise in General Topics

Will Geo Policy affect the SIC tunnel between management on cloud and FW on premise

Firewall_Head — Sun, 26 Jan 2025 18:15:47 GMT

Hi Checkmates,

Requirement: configure a geo rule for allowing communication from only country B to public IP of the FW.

I was working with one client to configure a geo policy using updatable object, since the management server was hosted in country A, I added both country B & A to the source address thinking it would impact the SIC tunnel.

When I checked for the interface configuration, I was able to see a public IP running as a loopback interface with name maas tunnel. What is this about?

The firewall has only one public IP on it and the maas tunnel interface was a bit confusing to understand. The SIC tunnel comms should go though the public IP configured on the FW ryt? I didn't take the chance to test this, can someone please help me on this.

Thanks in advance!
======

WR,

Re: Will Geo Policy affect the SIC tunnel between management on cloud and FW on premise

the_rock — Mon, 27 Jan 2025 00:21:50 GMT

Personally, I never had that issue myself. Regardless, I would ensure 100% that if this is indeed needed to allow whatever public IP has to communicate and then block the country in the rule below.

Makes sense?

Andy

Re: Will Geo Policy affect the SIC tunnel between management on cloud and FW on premise

Chris_Atkinson — Mon, 27 Jan 2025 02:04:57 GMT

Per the FAQ the connection to Smart-1 cloud is outbound and covered by implied rules:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/FAQ.htm?tocpath=_____13#Frequently_Asked_Questions

"What ports must be open on the security gateway?"