How layered policies are matched | FW, APP, URL

[Firewall_Head]

Hi Mates,

I was testing the layered policy approach and got confused a bit. I have created separate layers for FW and APP blade. In my admin access I have allowed SSH access to the FW but I was unable to do so.

When I checked it was hitting the cleanup in the APP layer policy, can somebody help me out with this.

1> How are the policies matched?

2> If the FW layer rule 1 allows the access then why is it coming to the APP layer.

Please help me on this!!!

====

WR,

FH

[the_rock · Accepted solution]

Hey brother,

Remember what I said on the remote sesison about this? Traffic HAS TO match on ALL ordered layers. So say you have 2 layers and its accepted on first layer, but dropped on 2nd layer, it will not work. If you need more help, we can do another remote as well. In your case, if it is indeed 2 layers, I would do any any allow at the bottom of 2nd layer  and then block whatever needed above.

1) They are match top to bottom, left to right

2) Thats how it works for layered rules, traffic has to traverse all layered rules to be accepted

https://community.checkpoint.com/t5/Partner-Community/Layered-rules-approach/m-p/242051

Andy

[the_rock]

If you wish to do another quick zoom remote, Im good till 7.30 pm your time, or between 10.30-11.30

Andy

[Firewall_Head]

Hi @the_rock ,

Thank you sm for the reply, let's do a remote at 10.40 PM IST.

====

WR,

FH

[the_rock]

Sounds good, will send you zoom for that time 10 mins before.

Andy

[the_rock]

Sent you link directly.

[the_rock]

Just to update, had quick remote with the guys and I explained that traffic has to be accepted on EVERY ordered layer and whatever is dropped on the network (1st layer), wont need to go through any other layer.

Andy

[Firewall_Head]

Thank you so much Andy @the_rock  !

========
WR,

FH

[the_rock]

No problem! Now that I had some garlic naan bread, I feel better, haha.

Cheers mate.

Andy

[PhoneBoy · Accepted solution]

Suggest you read the following community posts (they're older, but still relevant)

• https://community.checkpoint.com/t5/Management/Unified-Policy-Column-based-Rule-Matching/m-p/9888#M1...
• https://community.checkpoint.com/t5/Management/Policy-Layers-in-R80-x/td-p/1717 

TL;DR: If you have multiple ordered layers, traffic must match an accept rule in each layer, otherwise the traffic will not pass.

[the_rock]

Thats pretty much what I showed the guys in my lab, so Im 100% sure they are clear now 🙂

Andy