topic Re: INSPECT code in DEF file to bypass traffic inspection? still a "thing"?? in General Topics

INSPECT code in DEF file to bypass traffic inspection? still a "thing"??

Garrett_DirSec — Tue, 22 Apr 2025 18:10:27 GMT

Hello All --

More than decade ago (10-15yrs), I recall a customer working with TAC to setup DEF file that effectively passed any/all inspection for gateway on specific traffic. In this case, the traffic of concern was backup traffic that was hammering the gateway. The traffic was very specific and could be granularly identified by specific src:dst/port rules.

Is this still a "thing"??

Alternatively, we could create a NULL Treat Prevention policy and apply to the traffic. I understand from other Tim Hall comment on related post that Null TP policy is appropriate over exception. The latter processes all traffic and simply does not apply TP.

Thanks -GA

reference other posts on lack of documentation on INSPECT code?

https://community.checkpoint.com/t5/API-CLI-Discussion/INSPECT-language/td-p/52145

also Tim Hall comment on TP exception:

https://community.checkpoint.com/t5/Management/Is-it-possibly-to-bypass-the-Threat-Prevention-Emulation-blade/m-p/86154/highlight/true#M13862

Re: INSPECT code in DEF file to bypass traffic inspection? still a "thing"??

the_rock — Tue, 22 Apr 2025 18:26:55 GMT

I had not seen that in some time, so dont believe it would be a "thing"

Andy

Re: INSPECT code in DEF file to bypass traffic inspection? still a "thing"??

PhoneBoy — Tue, 22 Apr 2025 20:38:44 GMT

Can it still be done via .def files? Quite likely.
However, we typically recommend using fast_accel these days, which doesn't require editing .def files (but does involve CLI commands on each gateway).

Re: INSPECT code in DEF file to bypass traffic inspection? still a "thing"??

the_rock — Tue, 22 Apr 2025 20:55:14 GMT

Fast accel Phoneboy mentioned is definitely your answer, so I would go with that.

Andy

https://support.checkpoint.com/results/sk/sk156672