topic Re: R80.30SP SAM Rule in Hyperscale Firewall (Maestro)

R80.30SP SAM Rule

Simon_Macpherso — Wed, 31 Mar 2021 23:27:03 GMT

Hello,

For R80.30SP, can someone please advise the correct syntax with an example for creating a SAM rule to block a source IP address connecting to a single IP destination from a specific source port.

There appears to be a limitation in that this cannot be done from smart view monitor and must be done using gclish.

I've created a rule however I can still see new connections in the connections table.

Regards,

Simon

Re: R80.30SP SAM Rule

PhoneBoy — Sat, 03 Apr 2021 22:47:45 GMT

fw sam is not supported on Maestro or Scalable Platforms.
Which also explains why it doesn't work from SmartView Monitor.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk148074
You can use fw samp to achieve the same thing, I believe (which does support Maestro): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112454