Firewall Rules "templates"

[DR_74]

Hello,

I would like to know if it is possible to create some sort of Firewall rules like templates.
I have several remote branches with a firewall on each site.
Most of the rules are similar on each sites . For example PC subnet can communicate with Printer subnet.

Is it possible to create some sort of template so that if I add a TCP port for the policy for rules "PC to Printers", it will change all the rules on all the remote branch firewalls. 

I do not have a MDS Management server

I was thinking of creating groups with all tHE PC subnet and all the Printers subnet (for the different sites) but this will push all the objects to all the fireewall.... Is there a better way to do? (inline layer? shared layer?)

Thank you for any good ideas

[Tal_Paz-Fridman]

Please look at Ordered and Inline Layers:

https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SecurityManagement_AdminGuid...

[PhoneBoy]

First of all, the same policy can be installed on multiple gateways.
Second, the policy itself can be constructed with “generic elements” (e.g. Zones, Dynamic Objects).
Using inline layers, you can create “templates”  for things like an Internet access policy.

[DR_74]

The idea woudl be to have something like this:

A singel rule that say: From "PC_Subnet" to "Printer_subnet" and the gateway woud automatically calculate the right subnet 

If on site 1: PC_subnet =1 192.168.1.0/24

If on site 2: PC_subnet =1 192.168.2.0/24

same for printers.

That way if I add a new rule with these objects all sites will be updated with the correct subnet.

[PhoneBoy]

Zones are assigned to traffic to/from specific interfaces.
If the printer and PC subnets are on different interfaces, this will work as long as the remote sites have the same topology.

The other option is Dynamic Objects, the content of which is defined on the gateway itself using the dynamic_objects CLI command.

[Bob_Zimmerman]

Dynamic objects can also be used with a tool called SmartProvisioning (formerly SmartLSM; the LSM stood for Large-Scale Management). SmartLSM let you build a gateway profile which you could use in SmartDashboard with a set of dynamic objects. Within the SmartLSM tool itself, you would then define a thousand gateway objects with the values for each of the dynamic objects. It's a big deal for retailers, for example. I know a very large gas station chain had a firewall at every station managed by LSM.

SmartProvisioning changes the tool somewhat.

[Vincent_Bacher]

In my opinion, the question here is how many locations we are talking about. If it's three or four, SmartProvisioning might not necessarily be that advantageous. However, if we're talking about 10, 20 or 100, that would be a completely different situation, and I would recommend taking a look at it.

Our colleagues in Sunnyvale have what is known as dynamic mapping, which can be useful in some use cases. Unfortunately, CP does not offer this.

[DR_74]

Yes we have around 5-6 sites, we are not going to use tools that a re used for big companies