Check point "Internet" object

[Mikula83]

Hello,

I have found in logs that Check Point doesn't include all public ip addresses when using "Internet" object in policy.

Can you give me explanation about this behaviour.

Instead of using "Internet" object I have made a workaround using public IP address ranges:

1.0.0.0 - 9.255.255.255

11.0.0.0 - 126.255.255.255

128.0.0.0 - 169.253.255.255

169.255.0.0 - 172.15.255.255

172.32.0.0 - 192.167.255.255

192.169.0.0 - 223.255.255.255

[Tal_Paz-Fridman · Accepted solution]

Please look at this SK

https://support.checkpoint.com/results/sk/sk64543

[Timothy_Hall]

Exactly, one quirk with object Internet is that traffic entering a VPN tunnel will not match it, even if the traffic is leaving on the External interface.

[Chris_Atkinson]

How are you using this object in your policy and what is the topology of the gateway defined like?

More information will assist us in clarifying the behavior for you, further to the resource provided by @Tal_Paz-Fridman 

[_Val_]

As @Tal_Paz-Fridman already mentioned, the "Internet" object is a function of your GW topology. 

[Mikula83]

I have attached to you "Topology" and "Policy" picture for better understanding. When I used "Internet" object as destination in Internet inline layer instead of public IP ranges (on picture red rectangle) some ntp services were dropped although rule 6.4 says "Permit all" so I have to create rule id 7 and permit ntp service.

Where is mistake?

It works before but not for all public ip addresses.

[PhoneBoy]

The various ways to describe the Internet are discussed in this thread: https://community.checkpoint.com/t5/Management/Properly-defining-the-Internet-within-a-security-poli...

The object "Internet" can only be used with App Control/URL Filtering rules.
The rules you showed in the screenshots below can all be matched on simple TCP/UDP services.