External Gateway 80/443 and Implied Rules

[VikingsFan]

We're building a new R81.20 Take 76 cluster and have moved to the newer way of geo blocking and using the access rules instead of using the old geo block module.  What we've noticed is that countries we're wanting to block are getting to 80/443 due to implied rules.  I've dug through the forums and have tried everything I can find and I'm still seeing implied rules allowing traffic to our gateway IPs.  What am I missing?  Here are the things I've tried/done so far:

1. Went into the Global Properties and unchecked Accept Control Connections.

2. Went into the SAML Portal cluster property and set to 'According to Firewall Policy'

3. Followed sk180808 which I found from this other post and felt like would be the winner but it didn't work.  It doesn't say I have to restart gateways but when I grep IMPLIED_RULES_SET_BEFORE_LAST $MDS_FWDIR/conf/cpmEnvVars.conf I get the proper value returned.  Post: https://community.checkpoint.com/t5/Security-Gateways/Implied-rule-0-for-external-gw-interface-IP/m-...

Thanks!

[Chris_Atkinson]

Did you also try the other SK referenced there in the same thread.

Which kernel parameters did you set where - mgmt vs gw?

How does the policy look, using any layers etc?

[VikingsFan]

Which SK, SK105740 ?  I did follow that one up to changing the GUI settings.  I did not play with the fw_ignore_before_drop_rules mentioned near the bottom.

On SK180808 I ran the two commands on the Mgmt and installed policy afterwards.

$MDS_FWDIR/scripts/reload_env_vars.sh -e "IMPLIED_RULES_SET_BEFORE_LAST=1"
$MDS_FWDIR/scripts/override_server_setting.sh -e IMPLIED_RULES_SET_BEFORE_LAST 1

Policy is simple.  Single Security layer and first rule is the country geo block.

So recommended to try the fw_ignore_before_drop_rules kernel change on the two gateways in the cluster?  If that works, do I need to back out the change made in SK180808?