Will Geo Policy affect the SIC tunnel between management on cloud and FW on premise

[Firewall_Head]

Hi Checkmates,

Requirement: configure a geo rule for allowing communication from only country B to public IP of the FW.

I was working with one client to configure a geo policy using updatable object, since the management server was hosted in country A, I added both country B & A to the source address thinking it would impact the SIC tunnel.

When I checked for the interface configuration, I was able to see a public IP running as a loopback interface with name maas tunnel. What is this about?

The firewall has only one public IP on it and the maas tunnel interface was a bit confusing to understand. The SIC tunnel comms should go though the public IP configured on the FW ryt? I didn't take the chance to test this, can someone please help me on this.

Thanks in advance!
======

WR,

FH

[the_rock]

Personally, I never had that issue myself. Regardless, I would ensure 100% that if this is indeed needed to allow whatever public IP has to communicate and then block the country in the rule below.

Makes sense?

Andy

[Chris_Atkinson]

Per the FAQ the connection to Smart-1 cloud is outbound and covered by implied rules:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-...

"What ports must be open on the security gateway?"