Policies in Traditional and Simplified mode

[Jones_Jardel_Po]

Is it possible to copy all firewall, QoS rules from a simplified policy to a traditional policy?

[PhoneBoy]

Traditional Mode policies have been discouraged since at least NG (R5x) versions.

In R80, the ability to create new Traditional Mode policies was removed and isn't coming back.

What's the real problem you're trying to solve?

Let's find a way to solve that in a way that doesn't involve Traditional Mode policies.

[Jones_Jardel_Po]

Hello Dameon,

Thank you first.

I have a IPsec VPN established and I need to forward all Internet traffic to this tunnel, but only one internal subnet must be affected on tihs.

How can I do this using communities?

[PhoneBoy · Accepted solution]

This exact problem (and solution) is here: Excluding subnets in encryption domain from accessing a specific VPN community 

[Jones_Jardel_Po]

Thank you Dameon.

I want to send to that tunnel only requests from 192.168.1.0/24 going to the Internet (example);

Thinking on that, I will need to exclude all my internal subnets going to the Internet, example:

// // User defined INSPECT code //  vpn_exclude_src={<192.168.1.1,192.168.1.254>}; vpn_exclude_dst={<I need to put all Internet IPs here?>};  #ifndef IPV6_FLAVORipv #define NON_VPN_TRAFFIC_RULES ((src in vpn_exclude_src) and (dst in vpn_exclude_dst)) #else #define NON_VPN_TRAFFIC_RULES 0 #endif

So, I'll need to put all Internet IPs on vpn_exclude_dst?

[PhoneBoy]

Correct.

All IPs can be represented using the range specified in the All_Internet object, which is <0.0.0.0,255.255.255.255>.

[Jones_Jardel_Po]

Thanks

[Jones_Jardel_Po]

And a curious thing: why Check Point does not put this kind of configuration in the Smart Dashboard?

[PhoneBoy]

If I had to guess, it's because it's not a common use case.

I personally hadn't heard of this specific use case before.

[Jones_Jardel_Po]

Uhmmm... but this case does not sounds like a not common case.

If it was a common case, we will not have a SK to this kind of situation...

[PhoneBoy]

SKs exist for both common and uncommon issues.