Blocking rule editing

[Hllrdm]

We need to restrict the editing of all rules from a certain section tittle for other administrators, and that they can only be edited by admin. Is it possible to do this in Check Point?

[the_rock]

If you can send a screenshot and circle what you want to di, I can test it in my lab.

Andy

[Hllrdm]

For example, administrators other than Administator cannot edit 1-13 rules

[the_rock]

I have an hour before my next call, so stand by, let me see if this is possible.

Cheers,

Andy

[Tal_Paz-Fridman · Accepted solution]

Granting permission for a specific section of the rulebase is not feasible. However, you can explore the following alternatives:

1. Implement Ordered Layers and assign distinct Permission Profiles to each layer.

2. Transition to Multi-Domain Security Management, which allows you to utilize a Global Domain for a particular policy segment, while the Domain level administrator handles the remaining sections.

[Hllrdm]

1. Implement Ordered Layers and assign distinct Permission Profiles to each layer.

Could you describe this process in more detail?

[Hllrdm]

Thank you I have figured out the technology in question.

[the_rock]

I think what @Tal_Paz-Fridman said makes sense. I looked for any setting related to being able to possible prevent given admin from modifying regular rule(s), but it does not appear to exist anywhere.

Its definitely good candidate for RFE, in my view.

Andy

[Hllrdm]

Yeah, that's what I thought, too. MDS implementation is quite difficult in terms of time, while layers implementation is simple. We will try this option, thanks

[the_rock]

Im fairly sure this is what @Tal_Paz-Fridman was referring to.

Andy

 

[PhoneBoy]

Directly, no.
However, through use of a SmartTask like https://community.checkpoint.com/t5/Management/SmartTask-Custom-Permissions/m-p/77247#M11281, it should be possible.