Internet access for CheckPoint firewall objects problem

[Oliver_222]

Good afternoon

We have a problem with access policies
We have configured Internet access for CheckPoint firewall objects.
But we also see that the user network 192.168.0.0 also passes this rule and they have access to the Internet. Can you tell me why this problem might occur?

[Chris_Atkinson]

Please share a redacted screenshot of the rules that you have created ?

If you look at the logs for this traffic which rules does it say it has matched?

[Oliver_222]

I will correct the input information: checkpoints have access to everything, but for some reason the network 192.168.0.0 when accessing our web resource passes the rule for checkpoints.

log - 1 screenshot
Access rule for checkpoint objects - 2 screenshot
Access rule for user network- 3 screenshot
NAT rule for user network - 4 screenshot

[Chris_Atkinson]

Thanks and for completeness how is the "CheckPoints" object defined?

[Oliver_222]

This group contains firewall and management server objects

[Chris_Atkinson]

Check the logic using a 'packet mode' search of the access policy and 'fw up_excute' from the gateway CLI.

Pending the results I would consult TAC further via a remote session to take a look without needing to censor the outputs like you might here.

[the_rock]

Have you done any captures to see why traffic is failing? Zdebug, tcpdump, fw monitor?

Andy