Network & Application policy

[handiansudianto]

Hello,

On the checkpoint how network policy and application work? Is the network policy will take precedence  than application policy?

On the network policy i have 2 rule (CP1 picture) :

• Rule number 17 INTERNET_DC_VLAN301 is to allowing some server under VLAN301 accessing to the internet
• Rule number 18 DC_VLAN301 is to drop rest the server under VLAN301

On the application policy i have rule to allowing all servers (all hosts under DC_VLAN301) access to some specific application such as sophos-update.

With both policy only hosts under group INTERNET_DC_VLAN301 can access to sophos-update even on the source on the application policy set to DC_VLAN301 which contains all host under subnet 301 (10.103.248.0/24)

So i want to know how to make network policy and application policy can work together?

[Chris_Atkinson]

With ordered layers traffic must match (accept) in both layers to be allowed, please refer:

Ordered Layers and Inline Layers (checkpoint.com)

[PhoneBoy]

You only need to maintain a separate Firewall and App Control policy if you manage any gateways running R77.x (or earlier) code.
Your best bet is to combine them, though that will require manual effort.

In general, if you have multiple policy layers, traffic must match an Accept rule in each ordered layer.