Understanding Checkpoint Policy Packages

[khineminn]

Could someone explain the details regarding policy packages? Let's assume we have two policy packages: 1. Standard and 2. HQ_Policy.

1. The HQ_Policy is installed on a specific gateway.
2. The Standard policy is installed on all gateways.

In this case, how do both rules interact, and what is the order in which the policy packages are applied?

Thanks in advance!

[AkosBakos]

Hi @khineminn 

One gateway or cluster can have only one policy.

Let me explain with my words:

You can install Standard policy to any gateways or clusters in your domain. The HQ_Policy can be installed on a specifix gateway. You can set the installation target under Manage Policy packages,

There is no such way one gateway has 2 polices in one time (no merged, mixed, union). If you installed HQ_Policy to eg.: GW_HQ_clu then you want to install Standard to GW_HQ_clu, you will get a message -> HQ_Policy is installed, do you really want to install Standard?

Otherwise If you want to create an union of two policies -> simply copy them into a new policy package.

Akos

[khineminn]

Hi @AkosBakos 

It makes sense. I'm confused about the following, and please let me know how it will work. There is only one gateway and which policy package will pick?

Manage Policy Layers

!

Standard _ Policy Target > All Gateways

HQ_Policy _ Policy Target > All Gateways

Each Policy Package

!

Standard _ Install On > HQ Gateway

HQ_Policy _ Install On > HQ Gateway

[AkosBakos]

Hi @khineminn 

That policy will picked, which will be pushed to the gateway first time. Gateway with no policy has an "initial" policy which will allow only the necessary port, GAIA portal, SSH, PING tot the MGMT address. Nothing more.

It is clear now? 🙂

Akos

[khineminn]

Hi @AkosBakos 

Thanks for your explanation. It is clear now.