Hi Checkpoint community,
We were wondering if there is a way to create the Management Access and Stealthrule rules on a global Layer.
Our use-case:
We are using a R80.30 MDS to manage our (mostly R80.20) firewalls, using Global Layer and Domain Layer for Rules. So our rulebase consists of Global Rules then Domain Rules then again Global Rules (inlcuding the Cleanup-Rule).
We split our quite big corporate network into different zones (using VLANs and IP-Ranges to seperate them).
Hosts within the same zone can communicate via Any Port with each other, hosts in different zones can only communicate by a predefined set of allowed directions and Ports.
Due to amount of connections covered by this rulebase, these rules are the ones with the most hits by far. Therefore we would like to have these rules at the beginning of each rulebase => on the Global Layer above the Domain layer.
Since the Firewalls are the Gateways for all DMZ-networks and necessarily have IP addresses in these ranges, this rulebase would allow every host of a zone to reach every Gateway IP-Address ( = Firewall) of the same zone.
As DMZ networks do not count as secure networks, this is a security risk we do not want to face.
Currently we solved this problem by having the Management- and Stealth rule on top of each Domain Layer rulebase and the zone-rulebase in the Global Layer below the Domain Layer. Of course his is not ideal for performance.
My question therefore is:
Is it possible, to create a global Management and Stealth Rule above this zone-ruleset?
For example by using some object/trick to
- tell the gateways that theyself are the destination
- use the Policy Installation Target as destination in these rules
Or by any other possible way?
BR Marcus