Limit management access

[Kolobok]

Hello,

I am at the beginning of my journey with CheckPoints. Starting with 1570W. The Security Gateway is very easy to understand and learn. 

I have a question, which I couldn't find the answer for. The gateway is being used as default gateway for 3 subnets - 192.168.1.X, 192.168.2.X and 192.168.99.X. The third subnets is for management.

I would like to limit the management accessibility in such a way that admins will be able to access the firewall just by the management IP address. Currently, any person on these 3 subnets can access the firewall over port 4434.

I tried to make a policy, which prevents access over port 4434 to the IP address other then the management IP, but this didn't work.

Can you please advise if this is achievable? 

[Danny]

Can you show us your prevent configuration? What does your firewall log show?

[G_W_Albrecht]

If you have fixed IPs on the internal networks, you can configure Device > System > Admin Access to let just selected users log in from these 3 subnets...

[G_W_Albrecht]

@_Val_  - can you put this to SMB ?

[_Val_]

done

[the_rock]

@Danny made a good point...maybe if you send us few screenshots showing how this is configured, we would get better idea to assist you.

[Kolobok]

Here is a screenshot of the internal interfaces. 

The idea is to allow manage the firewall just by accessing the 192.168.99.1 and prevent the ability to manage it through 192.168.10.1 or 192.168.20.1.

[K_montalvo]

Hello,

I found this on the CP_R80.20.35_1500_1600_1800_Appliance_Series_AdminGuide_Locally_Managed starting on page 109; The Device > Administrator Access page lets you configure the IP addresses and interface sources that
administrators can use to access the Quantum Spark Appliance. You can also configure the Web and SSH
ports.

I don't know witch Embedded Gaia are you running but you can see if the above works for you,

https://sc1.checkpoint.com/documents/SMB_R80.20.35/AdminGuides/Locally_Managed/EN/Topics/Quantum-Spa...

Thanks!

[K_montalvo]

When you said any person can access the firewall are you referring to accounts with admin permissions?

What you are trying is just that the firewall is reachable via 1 IP address only or to just permit access using the least privilege mode to only specific admins accounts?

What are your expectations, please elaborate,