How to exclude IP from SAM rules

[demirdag]

Hello everybody,

Following a big outage we noticed that our main gateways had put their own public IP subnet in the SAM ruleset. How can I prevent this from happening? Is there any way to exclude a subnet from being monitored for suspicious activity?

[Tal_Paz-Fridman]

I would look at https://support.checkpoint.com/results/sk/sk112061 

How to create and view Suspicious Activity Monitoring (SAM) Rules

Try to see if -b flag with IP of Security Gateway works.

[the_rock]

I agree with @Tal_Paz-Fridman . I would double check what you have as per short video I uploaded.

Andy

bandicam 2024-12-20 09-05-59-543.mp4

Video Player is loading.

Play Video

Play

Mute

Current Time 0:00

/

Duration 0:00

Loaded: 0%

0:00

Stream Type LIVE

Seek to live, currently behind liveLIVE

Remaining Time -0:00

1x

Playback Rate

Chapters

• Chapters

Descriptions

• descriptions off, selected

Captions

• captions settings, opens captions settings dialog
• captions off, selected

Audio Track

Picture-in-PictureFullscreen

This is a modal window.

Beginning of dialog window. Escape will cancel and close the window.

Text

ColorWhiteBlackRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-Transparent

Background

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentTransparent

Window

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyTransparentSemi-TransparentOpaque

Font Size

50%75%100%125%150%175%200%300%400%

Text Edge Style

NoneRaisedDepressedUniformDropshadow

Font Family

Proportional Sans-SerifMonospace Sans-SerifProportional SerifMonospace SerifCasualScriptSmall Caps

Reset restore all settings to the default valuesDone

Close Modal Dialog

End of dialog window.

Close Modal Dialog

This is a modal window. This modal can be closed by pressing the Escape key or activating the close button.

[PhoneBoy]

As far as I know, there shouldn’t be anything automatically creating SAM rules against your gateway IP.
There is nothing preventing you from doing so via the fw sam command, however.

[HeikoAnkenbrand]

To prevent your main gateways from including their own public IP subnet in the SAM ruleset, you can exclude specific subnets from being monitored for suspicious activity by configuring exceptions in the SAM rules. Here's how you can do it:

1. Access the Security Management Server:

   • Open SmartConsole and connect to your Security Management Server.

2. Navigate to SAM Settings:

   • Go to "Logs & Monitor" and open the SmartView Monitor.

3. Open Suspicious Activity Rules:

   • Click on the "Suspicious Activity Rules" icon in the toolbar to open the Enforced Suspicious Activity Rules window.

4. Add an Exception:

   • Click on "Add" to create a new rule.
   • In the "Block Suspicious Activity" window, specify the source and destination IP addresses or networks you want to exclude. Use the IP and subnet mask fields to define the subnet you wish to exclude.

5. Configure the Rule:

   • Set the action to "Notify" instead of "Block" for the specific subnet you want to exclude.
   • Set an expiration time for the rule to ensure it doesn't affect performance unnecessarily.

6. Enforce the Rule:

   • Click "Enforce" to apply the rule to the selected Security Gateway(s)