Does CheckPoint have a tool simlar to Palo Alto's Policy Optimizer?

[Dale_Lobb]

We recently acquired another organization which uses Palo Alto firewalls.  The other org also uses firewalls to control internal traffic between vlans, which my main org would like to do, but has not yet implemented.

The Palo engineer has been telling me how easy it is to create internal rules in the Palo Alto by initially opening up the traffic between required vlans, and then after some elapsed time running the Policy Optimizer to narrow down the rules to just the communication that has been logged.

Does CheckPoint have anything similar to Palo Alto's Policy Optimizer?

Bets Regards,

Dale

[Danny]

Check Point has all of this integrated as well. Did you check out Check Point's Security Compliance?
Regarding the specs of that EA product the functions in question are:

• identify unused objects -> integrated in objects explorer
• auto-clean up rules with zero hit count -> github.com/CheckPointSW/PolicyCleanUp
• log traffic analyzation of VLAN-to-VLAN traffic for opimization -> use SmartEvent, filter the specific VLANs in question, check the top sources, destinations, traffic, users etc. and adjust your rule(s) according to your needs (also works directly in SmartLog by using the top-filters on the right side)
• identify overly permissive rules (i.e. any definitions) -> use the packet mode search and identify rules with 'Any' definitions easily
• want to add hosts from the VLANs automatically to your object database to use within your rulebase? here is a solution.

[Dale_Lobb]

Hello Danny; thanks for the reply.

  Yes, I have looked at Security Compliance.  I'm just glad I don't have to use it, at least, not yet.  Not that it's a bad tool, just looks like a ton of work.

  I did learn several new things here that I was not aware of, but will come in handy: specifically, the unused objects and packet search mode.

  But, to the gist of the matter, the policy rule optimization: yes, I was aware I could do it manually using these tools.   So, checkpoint has nothing similar to the new Palo tool?  Any plans in that direction? 

  I'm just looking at what it would take to put a checkpoint firewall in an east-west position in my network when I do not have all the info on what each application requires.  Yes, I know it's possible to use a tap/span and a checkpoint in monitor mode or to put checkpoint in place with a wide open policy and manually harvest the data to narrow the policy.  All those are a lot of work compared to what the Palo tool looks to offer.

Best Regards,

Dale

[Chris_Atkinson · Accepted solution]

SmartOptimize (with log analysis) is something offered as a service by Check Point PS currently, not aware of specific plans to add this as a feature to the console further to what Danny has outlined above but never say never.