IMPLIED RULE NUMBER 0

[Capt_Mundo]

Hi Admin,

I have a question. What does implied rule number 0 means? When a traffic is accepted and logged via Implied Rule number 0, does that mean the traffic has a session? 

Thanks

[Chris_Atkinson]

The following resources should help with your understanding:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

https://support.checkpoint.com/results/sk/sk17745

[kristen09]

---

@Capt_Mundo wrote: LiveTheOrangeLife

Hi Admin,

I have a question. What does implied rule number 0 means? When a traffic is accepted and logged via Implied Rule number 0, does that mean the traffic has a session? 

Thanks

---

Hello,

Implied Rule number 0 is a concept used in some firewall configurations. It refers to the default rule that allows traffic that doesn't match any explicit rules to be accepted and logged. When traffic is accepted and logged via Implied Rule number 0, it means that the firewall allowed the traffic because there was no specific rule to block it.

I hope this may be right answer. 

Best regard,

Kristen

[DBS]

Handy to know

[hilalwani]

I have a stealth rule in place which is blocking outside to inside unknown traffic. but yesterday morning the firewall received a traffic from an unknown malware site and accepted/passed that malware site through an implied rule. I wonder how is it possible.

[G_W_Albrecht]

The last sentence is not true - when traffic is accepted and logged via Implied Rule, no further inspection by the FW is done, no matter if there is a specific rule to block it or not. Sounds like ChatGPT to me...

[RamGuy239]

I know this is a old post. But I just wanted to correct the above statement:

When traffic is accepted and logged via Implied Rule number 0, it means that the firewall allowed the traffic because there was no specific rule to block it.

This is not the case, at least not with Check Point. Implied Rules on Check Point will match as rule 0, that is correct. But as the name implies, rule 0 comes before your explicit rules. This traffic won't get blocked by you creating rules to block it, as the traffic will always match rule 0 first.

:18190 for instance is SIC and is accepted in implied rules by default as part of "Control Connections". Unless you override and disable this, you won't be able to block TCP-18190. Even if you create rule 1 saying src:any, dst:any, service:tcp-18190, action:drop, you would still not be dropping any TCP-18190 traffic, because it's matching and being accepted in rule 0.

[_Val_]

absolutely right