Checkpoint Policy

[handiansudianto]

Hello..

For checkpoint network and application policy ist should be paired, example i want to allow traffic from LAN to Azure Site2Site so should i make like attached picture?

[the_rock]

If its traffic via s2s vpn, then forst picture example is good enough. What is the 2nd one for? (CP2)

[handiansudianto]

2nd pc is policy for application, should be paired also?

[the_rock]

Ok, if its totally seperate rule for app control, then yes. But if you wanted to add 2nd rule for s2s vpn tunnel, you dont need it, just 1st rule is good.

[handiansudianto]

hello, so for Network Policy i can remove 2nd rule and for Application policy both rule is used, am i right?

[the_rock · Accepted solution]

For vpn, rule 1 is fine in network layer. If you have another ordered layer with urlf+appc blades enabled, then rule 2 would belong in that layer.