Legacy MAB Policy Enforcement Order

JH_Ranger — Wed, 27 Mar 2024 03:47:31 GMT

Hi CheckMates,

I am curious about the policy enforcement order of the Legacy MAB policy. I understand that with the Unified Policy, it's possible to create Inline/Ordered layers and implement the MAB into that. But when is the Legacy MAB policy enforced? Before or after the Access rules?

I noticed that some MAB rules (in the SmartDashboard) allow a SNX user to a certain resource, but since there isn't a corresponding rule in the Access Rulebase (FW Blade) the traffic is dropped. The logs show a similar story, an "Accept" of the packet hitting the MAB blade, immediately followed by a default drop by the FW blade.

Is it necessary to replicate all rules from the Legacy MAB into the Access policy as well?

Thanks,

R81.10 Take130.

Re: Legacy MAB Policy Enforcement Order

Wolfgang — Wed, 27 Mar 2024 06:03:04 GMT

@JH_Ranger you should don't mix rules for MAB in the unified policy or legacy policy, use only one of them.

Is it necessary to replicate all rules from the Legacy MAB into the Access policy as well? Yes it is, move all rules from legacy to unified.

The behavior how it works with unified policy can be found in the documentation Mobile Access and the Unified Access Policy (checkpoint.com)

topic Re: Legacy MAB Policy Enforcement Order in SASE and Remote Access

Legacy MAB Policy Enforcement Order

Re: Legacy MAB Policy Enforcement Order