topic Rule needed for proper SASE access in SASE and Remote Access

Rule needed for proper SASE access

the_rock — Thu, 12 Feb 2026 16:52:33 GMT

Hey guys,

Figured would share below, as this sort of rule is needed for correct SASE access.

source:

any (or whatever source appropriate)

dst:

.api.perimeter81.com*
.cws.checkpoint.com
.fonts.googleapis.com
.p81-assets.perimeter81.com
.perimeter81.com
.sdp.perimeter81.com*
.sdpv2-agent-ws.perimeter81.com
.company.perimeter81.com (example apple.perimeter81.com, whatever sase portal shows for the link)
.te.checkpoint.com
.upgrade.bitdefender.com
.url-rep.kube1.iaas.checkpoint.com
.web-rep.iaas.checkpoint.com
.yarkon-443.perimeter81.com
.yarkon.perimeter81.com
POPs as well

services:

https
tcp-50051
Wireguard_51821
Wireguard_8000
Wireguard_8055
UDP_1194
UDP_636
TCP_1195
TCP_8443
wireguard protocol

log

Re: Rule needed for proper SASE access

masher — Fri, 13 Feb 2026 14:09:43 GMT

There is also an application control object that could be used as well.

Re: Rule needed for proper SASE access

the_rock — Fri, 13 Feb 2026 14:10:51 GMT

Ah yes, excellent point @masher

Re: Rule needed for proper SASE access

the_rock — Fri, 13 Feb 2026 14:13:08 GMT

I see btw that covers all those ports/services I listed...NICE!

Re: Rule needed for proper SASE access

Chris_Atkinson — Fri, 13 Feb 2026 14:28:40 GMT

You can find similar information here:

https://support.checkpoint.com/results/sk/sk182251

Re: Rule needed for proper SASE access

the_rock — Fri, 13 Feb 2026 14:30:22 GMT

Thanks Chris!

Re: Rule needed for proper SASE access

D_TK — Fri, 13 Feb 2026 17:19:45 GMT

Is the whole whitelisting guide salient if the agent is on prem, and using the trusted network feature (with agent security disabled)?