move IKE implied from first rule to before last or disable

[ISG-Network]

I would like to disable IKE rule from implied rules and would like to manage it via access-policies or move them to the before last. Is there a way we can do that?

[the_rock]

Personally, unless there is a really good reason to do this, I would NOT do it. Implied rules are there for a reason. However, if you do have a totally valid case for this, I would still confirm with TAC.

Andy

[AkosBakos]

Hi @ISG-Network 

I the past, when the implied rules weren't logged, we did this to get log of them. So it was a valid scenario. Nowadays, i don't see the purpose of do this. What is the exact reason? 

A

[PhoneBoy]

Decryption actually happens before the Access Policy is applied, which is one of the reasons it is one of the first implied rules.
However, you can use rate limiting rules to control access:

https://community.checkpoint.com/t5/Security-Gateways/Block-VPN-Traffic-by-Country/m-p/172695#M31396