Checkpoint interface topology

[Prathmesh131992]

Hi team, 

Can I know difference between get interface with topology and without topology meaning. And when we use this, tell me scenario.

[PhoneBoy · Accepted solution]

One of the core security features of the product is Anti-Spoofing.
For anti-spoofing to work, topology must be defined.
The topology includes all the networks reachable from that interface.

This can either be done manually or as part of "Get Interfaces with Topology" though you should only use this option before the gateway goes into production.
This has been discussed here among other places: https://community.checkpoint.com/t5/General-Topics/Get-interface/m-p/246503 

[Martijn · Accepted solution]

When you get interfaces with topology, Check Point will automatically generate objects for the anti-spoofing settings.
They will be linked to the interfaces, but may not be visible in the Object Tree. Check:

sk126872 - Some Network objects are not visible in the SmartConsole object list

Something to be aware of if you want to use these objects in a policy.

[Vincent_Bacher · Accepted solution]

Since I encountered problems here and there a long time ago when importing with topology, I have never done it again since then, and the point mentioned that objects are automatically created that I create myself has prevented me from doing it again to this day. But for beginners, I would always recommend importing with topology first and learning how to use as feature correctly.

[the_rock · Accepted solution]

I personally never do get interface with topology, as that would reset it all to what fw "thinks" should be defined...its way safer (in my opinion) to do without topology and as long as you set it per routing option, you are good to go, since if something changes on that interface subnet, no need to do anything, it would update it for you.

Below is what Im referring to and its always good idea to assign the zone as well.

Also, in simple words, anti spoofing is there so say if interface subnet is on 10.10.10.0/24 and traffic comes from 192.x.x something, it would get dropped.

Interface - Topology Settings

 

[genisis__]

With dynamic routes, better to either turn it off, not really recommended or as you have said use "Network defined by routes", but ultimately need to keep an eye on it, and would suggest not using prevent mode straight away if you have critical services.

[the_rock]

100%