Negating a specific object

[donat5]

I noticed that the option to negate a specific object is no long available in R80.xx, only available option is "negate cell"

I wonder why CheckPoint removed such a important feature.

I am simply trying to allow "any" but deny/negate "https" in the services cell, does anyone have a workaround?

[Maarten_Sjouw]

Negate the cell which in fact stops anything but what is in that cell.
It might be named a bit different but it still works the same.

[donat5]

@Maarten_Sjouw 

This even makes things more complicated; I would like to allow everything but https, how should my rule look like?

Any represents a lot of services which I cannot list.

[Ryan_Ryan]

I think your only option is two rules

top rule - service https - action - drop

second rule allow any

[donat5]

@Ryan_Ryan 

It seems so far the only option but why cp decided to get rid of such a good feature?

Now we end up with 2 rules instead of 1; I think checkpoint should reconsider putting this feature back.

[Ryan_Ryan]

No idea..

Its possible with network groups - create group with exclusion

seems there is no option to create service group with exclusion - you could have created a group containing tcp and udp 1-65535 and icmp and then exclude https.

If you wanted a really ugly solution you could create a group like above but with tcp range 1-442 and range 444-65535 group that together with udp range all ports and icmp.

[Maarten_Sjouw]

It would look just like this, it allows my home lan to anything but the RFC1918 networks on any port but HTTP/HTTPS:

 

[PhoneBoy · Accepted solution]

I've been using Check Point since version 2 and I'm pretty sure it was never allowed to negate a specific object in a cell with two or more items in it.

Here's a snapshot from R77.30 where I'm selecting a specific object and I'm being offered "Negate Cell"  

And it shows like this when negated.

Visually, it looks a little different in R80.x:

In either case, the effect is the same.

 

[donat5]

Oh...then I misunderstood @Maarten_Sjouw explaination and thought that everything in the cell is allowed and the rest dropped. This makes sense now, thanks @PhoneBoy