Rule needed for proper SASE access

[the_rock]

Hey guys,

Figured would share below, as this sort of rule is needed for correct SASE access.

source:

any (or whatever source appropriate)

dst:

.api.perimeter81.com*
.cws.checkpoint.com
.fonts.googleapis.com
.p81-assets.perimeter81.com
.perimeter81.com
.sdp.perimeter81.com*
.sdpv2-agent-ws.perimeter81.com
.company.perimeter81.com (example apple.perimeter81.com, whatever sase portal shows for the link)
.te.checkpoint.com
.upgrade.bitdefender.com
.url-rep.kube1.iaas.checkpoint.com
.web-rep.iaas.checkpoint.com
.yarkon-443.perimeter81.com
.yarkon.perimeter81.com
POPs as well

services:

https
tcp-50051
Wireguard_51821
Wireguard_8000
Wireguard_8055
UDP_1194
UDP_636
TCP_1195
TCP_8443
wireguard protocol

log

[masher]

There is also an application control object that could be used as well. 

[the_rock]

Ah yes, excellent point @masher 

[the_rock]

I see btw that covers all those ports/services I listed...NICE!

[Chris_Atkinson]

You can find similar information here:

https://support.checkpoint.com/results/sk/sk182251

[the_rock]

Thanks Chris!

[D_TK]

Is the whole whitelisting guide salient if the agent is on prem, and using the trusted network feature (with agent security disabled)?