topic Re: Limit management access in Spark Firewall (SMB)

Limit management access

Kolobok — Wed, 23 Feb 2022 03:19:23 GMT

Hello,

I am at the beginning of my journey with CheckPoints. Starting with 1570W. The Security Gateway is very easy to understand and learn.

I have a question, which I couldn't find the answer for. The gateway is being used as default gateway for 3 subnets - 192.168.1.X, 192.168.2.X and 192.168.99.X. The third subnets is for management.

I would like to limit the management accessibility in such a way that admins will be able to access the firewall just by the management IP address. Currently, any person on these 3 subnets can access the firewall over port 4434.

I tried to make a policy, which prevents access over port 4434 to the IP address other then the management IP, but this didn't work.

Can you please advise if this is achievable?

Re: Limit management access

Danny — Wed, 23 Feb 2022 07:36:05 GMT

Can you show us your prevent configuration? What does your firewall log show?

Re: Limit management access

G_W_Albrecht — Wed, 23 Feb 2022 09:15:44 GMT

If you have fixed IPs on the internal networks, you can configure Device > System > Admin Access to let just selected users log in from these 3 subnets...

Re: Limit management access

G_W_Albrecht — Wed, 23 Feb 2022 11:48:19 GMT

@_Val_ - can you put this to SMB ?

Re: Limit management access

_Val_ — Wed, 23 Feb 2022 14:57:25 GMT

done

Re: Limit management access

the_rock — Wed, 23 Feb 2022 15:58:17 GMT

@Danny made a good point...maybe if you send us few screenshots showing how this is configured, we would get better idea to assist you.

Re: Limit management access

K_montalvo — Wed, 23 Feb 2022 21:36:08 GMT

When you said any person can access the firewall are you referring to accounts with admin permissions?

What you are trying is just that the firewall is reachable via 1 IP address only or to just permit access using the least privilege mode to only specific admins accounts?

What are your expectations, please elaborate,

Re: Limit management access

Kolobok — Thu, 24 Feb 2022 03:19:17 GMT

Here is a screenshot of the internal interfaces.

The idea is to allow manage the firewall just by accessing the 192.168.99.1 and prevent the ability to manage it through 192.168.10.1 or 192.168.20.1.

Re: Limit management access

K_montalvo — Thu, 24 Feb 2022 18:44:54 GMT

Hello,

I found this on the CP_R80.20.35_1500_1600_1800_Appliance_Series_AdminGuide_Locally_Managed starting on page 109; The Device > Administrator Access page lets you configure the IP addresses and interface sources that
administrators can use to access the Quantum Spark Appliance. You can also configure the Web and SSH
ports.

I don't know witch Embedded Gaia are you running but you can see if the above works for you,

https://sc1.checkpoint.com/documents/SMB_R80.20.35/AdminGuides/Locally_Managed/EN/Topics/Quantum-Spark-1500-1600-1800-Appliance-Series-Overview.htm

Thanks!