Internet related rules

[Lukasz_Pienkows]

Hi,

I've been asked to provide rules for Internet traffic. Customer wants to know what is allowed towards Internet.

Is there any way to do it?

I have MDS setup with per-Customer CMAs.

Thanks

Lukas

[Chris_Atkinson]

There are a few ways to achieve this.

One option is possibly using "packet mode" and  searching for a destination that is not an RFC1918 address.

Refer:

https://community.checkpoint.com/t5/Management/Search-through-your-policy-using-R80-10-new-Packet-Mo...

[PhoneBoy]

Rules that potentially involve the Internet have a few possible characteristics:

• Destination of Any (or All_Internet)
• Destination of Internet
• Destination involving an external Security Zone
• Destination involving an IP that is not RFC-1918 

I presume you can write a script to parse the output of show-rulebase and pull out the rules in a specific policy layer that meet these requirements.
If you use show-as-ranges true in the call, you'll get the IP addresses covered by the rule, which should help in identifying such rules.