topic Re: Time Based Rules in General Topics

Time Based Rules

Vijay_Nagaraj — Tue, 29 Aug 2017 13:58:21 GMT

Hi team,

I have a situation like am able to see lots of time based rules created in the firewall , in the overview screen am able to view 20 time based rules , due to high volume of rules am not able to scroll it and find it , I tired filtering it , but I could not do it , also I don't have any 3rd part tools to do the same, as of now I don't have the CLI access also, could any one let me know how to filter the same and see those rules in the dashboard please?

Thanks in advance

Re: Time Based Rules

Timothy_Hall — Tue, 29 Aug 2017 17:37:39 GMT

Since you mentioned the Overview screen, I assume you are referring to the R77.30 SmartDashboard.

From the Firewall tab...Policy, enter "temp" without the quotes in the search box at the top of the rulebase. This will show you all rules with a time limit (whether currently expired or not). Enter "exp" in that same search field to see only currently expired rules.

Strangely enough after a few minutes of poking around in the R80.10 SmartConsole I cannot figure out how to apply the above filters to find rules with time limits. Best I can come up with is doing a "Where Used" on each individual time-based object to clumsily approximate the same thing. Anyone know a better way?

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: Time Based Rules

PhoneBoy — Tue, 29 Aug 2017 18:00:28 GMT

I just searched on the name of the Time object I used (this was in R77.30).

I assume you can do something similar in R80.10 (though I haven't checked yet).

Re: Time Based Rules

Vijay_Nagaraj — Tue, 29 Aug 2017 19:35:14 GMT

Hi Tim,

Thanks a lot!! It worked for me!! I tried temp without quotes and I got what I wanted , exp for some reason not working for me !!

Re: Time Based Rules

Timothy_Hall — Tue, 29 Aug 2017 20:44:51 GMT

Right but what about rules themselves that have an expiration date set from the "Rule Expiration" menu accessed by right-clicking the rule number and not via the Time column? Had no problem finding these in R77.30 via the "time" and "exp" filters but can't figure out how to do it in R80.10.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: Time Based Rules

Tomer_Sole — Tue, 29 Aug 2017 22:33:21 GMT

the "temp" and "expired" rulebase search filters are not available in R80.10. This gap will be closed in our next releases.

Re: Time Based Rules

Timothy_Hall — Wed, 30 Aug 2017 12:33:52 GMT

The "exp" filter will only show something if you have rules that are currently expired.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

Re: Time Based Rules

fwmeister — Tue, 18 Feb 2020 12:57:53 GMT

Hi Tomer,

Any idea which version will support exp and temp? R80.20 seems not to have it.

In addition trying to select/filter only rules with (or without hits) also does not work on R80.20.

"mgmt_cli -r true -d CUS show access-rulebase offset 0 limit 5 name "MYPolicy Security" details-level "full" use-object-dictionary true show-hits true hits-settings.from-date "2020-02-10" hits-settings.to-date "2020-2-17T23:59" --version 1.3"

returns all rules even those without hits.

show-hits false returns the same

API doc leaves a lot to be desired.

Re: Time Based Rules

JozkoMrkvicka — Fri, 15 Jan 2021 14:45:47 GMT

Hello,

in which exact version this limitation reported in 2017 will be fixed? Not available in R81...