A way for local domain policies to get checked first when global rules are also configured
My starting point was:
"Checkpoint MDS provides the option of using Global Rules and a place holder for Domain rules."
Unfortunately, I ran into this issue that a local subnet would still get access to whatever the first half of the global policy allowed (above the local domain rules).
In other words, securing a local subnet with local domain policies can be tricky when Checkpoint global policies are assigned to domains because often a section of the global policies precedes the local rules and so, an isolated subnet will still get access to whatever the preceding global rules allow.
A possible workaround may be:
As per the documentation: "Global rules can be set above and below the placeholder."
I wonder:
If you put all your global rules below the local domain policies, can you get secure a local subnet fully?
This is the documentation pertaining to this:
"When the security gateway evaluates the rules in the local policy, if there was no match for the global rules at the top of the rulebase, it starts to evaluate the rules from the domain layer. If there was still no match for those rules, the global rules that were created below the domain layer are evaluated."
My question:
What if we do NOT put global rules at the top of the rulebase?
(Would the local rules take precedence and be checked first?)
Please see attached screenshot.
