Implied rule 0 for external gw interface IP

[Kid555]

Hi All,

We have an issue where external IPs are allowed to access my gateway.

We tried the KB below, where we change it to "Through internal interfaces" but the traffic is still allowed.

https://support.checkpoint.com/results/sk/sk105740

We also tried the sk105740, we have followed this alternative solution to adding the IOC IP address into the SAM rule but however, the issue is not resolved. 

Refer to the attached log that shows external IP allowed to my external Gateway IP via port 443

[PhoneBoy]

How precisely did you “add the IOC IP address into the SAM rule”?
Did you try setting fw_ignore_before_drop_rules?
Instead of a SAM rule, you can use: https://support.checkpoint.com/results/sk/sk112454

[Kid555]

fw_ignore_before_drop_rules

Does this cause any impact to my production or require any reboot? 

[PhoneBoy]

Should not, but as with any change, you may want to test it in a maintenance window. 

[Kid555]

As per https://support.checkpoint.com/results/sk/sk105740. I don't see the steps to change the setting fw_ignore_before_drop_rules. Do you have the steps?

[PhoneBoy]

In the SK I linked, it says: to configure the parameter to survive reboot - refer to sk26202.
It also provides instructions to change on the fly.

[Tal_Paz-Fridman]

Please also look at sk180808 https://support.checkpoint.com/results/sk/sk180808

Security Gateway accepts HTTP traffic by an implied rule for its HTTP Web Portals, although there is an explicit rule that drops this HTTP traffic

[Kid555]

Hi, how about https traffic coming from the outside? From the sk, I see this is only for http

[Tal_Paz-Fridman]

I will ask the relevant owner to see what they can add.

[Kid555]

Hi, I check through. 

Based on this: https://support.checkpoint.com/results/sk/sk180808

What is the different between value 0 and 1. Seems like it is the same meaning

[Tal_Paz-Fridman]

Adding @YosiHavilo to answer

[YosiHavilo · Accepted solution]

Regarding sk180808

It can be http or https , i will ask to fix the Sk .

i will explain a bit about the 2 options :

Currently there are 2 "before drop" implied rules, both implied rules can allow connections to the Security Gateway on port 443 or 80

1. enable_portal_http (MULTIPORTAL)
2. enable_tcpt (TCP_TUNNELING)

it mean that in case we have a drop we check if we match the implied rule 

in  sk180808 , you can change the before drop to before last 

it mean that in case this connection is drop on the rulebase (except the cleanup rule)  , GW will drop the connection , in case the connection hit the cleanup rule,  we will  see if it match the implied rule .

when you use the fw_ignore_before_drop_rules , this is like you disable both rules 

in this case you must create an implicit rule instead of the implied rule .

[Kid555]

Hi Yosi,

for my understanding, am i right on the below,

Based on sk180808 , you can change the before drop (“0”) to before last (“1”).

If the value is “1”, when traffic hit onto one of the explicit drop rules (NOT the default cleanup rule), gateway will drop the connection.

If the value is “0”, when the traffic hit onto the default cleanup rule,  then it match the implied rule (multiportal).

[YosiHavilo]

If the value is “1”, when traffic hit onto one of the explicit drop rules (NOT the default cleanup rule), gateway will drop the connection ,when the traffic hit onto the default cleanup rule,  then it match the implied rule (multiportal)..

If the value is “0”, when the traffic drop rule,  then it match the implied rule (multiportal).

[Kid555]

"when the traffic hit onto the default cleanup rule,  then it match the implied rule (multiportal).."

For the above added, this only happens if I do not have an explicit drop rule (not the cleanup rule) right?

[YosiHavilo]

correct 

[Kid555]

Understand! Can i also check if those commands work on R80.30 Take 251?

[_Val_]

Do you use any of the multi-portal features, including MAB? It might be, your features require HTTP/HTTPS access on the external interfaces.

[Kid555]

No I don't think so. But I tried follow this sk105740 to change the accessibility to "through internal interface" but I still see traffic allowed coming from external traffic to my external gateway.