Problems with INTERNET object

[Matlu]

Hello, Mates

Have you ever had errors with FW rules, which have configured in the “Destination” column the object “INTERNET” that appears when we activate APPC+URL?

I have a few policies, but the FW does not respect the order of the rules, and goes to the implicit one which is “Clean UP” and blocks the traffic.

When I change the destination from “INTERNET” to an “ANY”, the FW starts to “respect” the order of all the rules.

For example:
Rule 1:
Source: 100.130.10.0/24
Destination: INTERNET
Services: News/Media

If I leave the rule as I just wrote it, the FW does not respect the traffic, and goes to the last rule, and everything is discarded.
The only solution I have found is to change the “INTERNET” to “ANY” and then everything works fine.

Any idea why this is happening?

I have a FW in R82 version, with active blades like “APPC,URFL, IPS, AV”.

Greetings.

[Chris_Atkinson]

How is your topology defined, is 100.130.10.0/24 the actual src subnet for example a DMZ?

[Matlu]

Hello
My Check Point is in bridge mode.
I am not currently working the device with 'Securitys Zones'
In the topology of my Check Point object, I only have one of the interfaces referenced as EXTERNAL and the other as THIS NETWORK.

[Chris_Atkinson]

There are existing SKs for such scenarios refer sk106319, sk152432

[Matlu]

Hi

My only doubt with the documents, is that there is no ‘listed’ version R81.20 and R82

Should I assume that this behavior, impacts all versions, despite not being in the document?

Thanks

[the_rock]

That would make sense to me bro.

Andy

[the_rock]

Ola bro,

Never had such an issue myself, you just need urlf blade enabled in the layer to use Internet object. Can you give an example? I can test it in the lab tomorrow.

Andy

[Chris_Atkinson · Accepted solution]

It's expected behavior for some topologies involving bridge mode, improperly defined topology or only a single interface.

[the_rock]

Ah ok, makes sense.

Andy