R81 location of implied_rules.def

[Michael_Horne]

Hello All,

I am looking for the location of the implied_rules.def on a Management  sever running R81. I am looking to remove RADIUS from the implied rules so that it can travel over a site to site VPN.

sk92281 mentions that for R81 you should refer to the Security Management Administration Guide, except that a search of this for the word "implied_rules", does not show any mention of the location for implied_rules.def

I did find the versions of the file in $FWDIR/lib directory and updated them:

This has not changed the list of implied rules when I view them in SmartConsole. We did do a "cpstop" before changing the files and did a "cpstart" after updating the files as per sk31692.

Also a test of RDAIUS traffic does not show in the logs, so I assume the the implied rules are still being match.

Can anyone point me in the location of the implied_rules.def for R81?

Many thanks,

Michael

[G_W_Albrecht]

I gave feedback for sk92281 as no location is given in the Admin Guides, but it also says: 

The "implied_rules.def" file is a placeholder for implied security rules.

All the changes made in this file are transferred to the managed Security Gateway / Cluster during policy installation.

[Michael_Horne]

Hello,

I can confirm that a policy installation was done after following the process for updating the "implied_rules.def" file.  It was an assumption, that once the restart of the management services using "cpstop" then "cpstart" as per the RADIUS SK sk31692, that listed implied rules visible in SmartConsole would reflect the fact that RADIUS rules were removed.  If not, it woudl be very confusing.

It does seem that the implied_rules.def in $FWDIR/lib is the correct location of this file, although it did not have the expected result. So that is why I was looking for confirmation of the correct location as it is not specifically mentioned in sk92281 

Many thanks,

Michael

[_Val_]

Yes it is. $FWDIR/lib/

However, it seems the lines you grep-ed are commented out, aren't they?

[Michael_Horne]

Hello,

I followed the instructions in sk31692 and it only mentioned to remove the one line: 

I am not sure exactly how the management server uses this file or the syntax, but it looks similar to the syntax used in C programing files with the # denoting commands that are specific to the compiling process. They also use #define and #if. 

I am not sure that the lines starting with # are comments

Many thanks,

Michael

[_Val_]

You are right, it is not commented, my bad. With R81, I think you need to reboot the management so the file is pulled properly. If it still does not work for you, please open a TAC case

[G_W_Albrecht]

$FWDIR/lib is the correct place for R81 gateways.

[Chris_Atkinson · Accepted solution]

Which version gateway is targeted?

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Multi-DomainSecurityManagement_Adm... 

[G_W_Albrecht · Accepted solution]

I have a response to my feedback - the information has just recently been added, also for simple SMS: This is a link to the relevant section:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

[Michael_Horne]

Hello,

I believe you have found the root cause of my problem, as the target gateways are still running R80.40. I have only updated the files for the R81 gateways.

This table is not in my PDF version of the R81 Admin guide.

Many thanks,

[G_W_Albrecht]

That his table is not in my PDF version of the R81 Admin guide also was my issue !  Solution:

- open the Admin Guide on page 3 Important Information

- click Download the latest version of this document in PDF format

- look if the date on the cover page is later as the one of  your PDF

😎

[G_W_Albrecht]

If it works now, i would appreciate a Kudo 😎

[Michael_Horne]

Both the table and also how to download the latest version using the link in the PDF, both earn Kudo points.