Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Michael_Horne
Collaborator

R81 location of implied_rules.def

Jump to solution

Hello All,

I am looking for the location of the implied_rules.def on a Management  sever running R81. I am looking to remove RADIUS from the implied rules so that it can travel over a site to site VPN.

sk92281 mentions that for R81 you should refer to the Security Management Administration Guide, except that a search of this for the word "implied_rules", does not show any mention of the location for implied_rules.defScreenshot 2021-10-13 090115.png

I did find the versions of the file in $FWDIR/lib directory and updated them:

Screenshot 2021-10-13 090541.png

This has not changed the list of implied rules when I view them in SmartConsole. We did do a "cpstop" before changing the files and did a "cpstart" after updating the files as per sk31692.

Screenshot 2021-10-13 090230.png

Also a test of RDAIUS traffic does not show in the logs, so I assume the the implied rules are still being match.

Can anyone point me in the location of the implied_rules.def for R81?

Many thanks,

Michael

2 Solutions

Accepted Solutions
Chris_Atkinson
Employee
Employee
G_W_Albrecht
Legend
Legend

I have a response to my feedback - the information has just recently been added, also for simple SMS: This is a link to the relevant section:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

CCSE CCTE SMB Specialist

View solution in original post

12 Replies
G_W_Albrecht
Legend
Legend

I gave feedback for sk92281 as no location is given in the Admin Guides, but it also says: 

The "implied_rules.def" file is a placeholder for implied security rules.

All the changes made in this file are transferred to the managed Security Gateway / Cluster during policy installation.

CCSE CCTE SMB Specialist
Michael_Horne
Collaborator

Hello,

I can confirm that a policy installation was done after following the process for updating the "implied_rules.def" file.  It was an assumption, that once the restart of the management services using "cpstop" then "cpstart" as per the RADIUS SK sk31692, that listed implied rules visible in SmartConsole would reflect the fact that RADIUS rules were removed.  If not, it woudl be very confusing.

It does seem that the implied_rules.def in $FWDIR/lib is the correct location of this file, although it did not have the expected result. So that is why I was looking for confirmation of the correct location as it is not specifically mentioned in sk92281 

Many thanks,

Michael

0 Kudos
_Val_
Admin
Admin

Yes it is. $FWDIR/lib/

However, it seems the lines you grep-ed are commented out, aren't they?

0 Kudos
Michael_Horne
Collaborator

Hello,

I followed the instructions in sk31692 and it only mentioned to remove the one line: 

SK.png

I am not sure exactly how the management server uses this file or the syntax, but it looks similar to the syntax used in C programing files with the # denoting commands that are specific to the compiling process. They also use #define and #if. 

I am not sure that the lines starting with # are comments

 

Many thanks,

Michael

_Val_
Admin
Admin

You are right, it is not commented, my bad. With R81, I think you need to reboot the management so the file is pulled properly. If it still does not work for you, please open a TAC case

0 Kudos
G_W_Albrecht
Legend
Legend

$FWDIR/lib is the correct place for R81 gateways.

CCSE CCTE SMB Specialist
0 Kudos
Chris_Atkinson
Employee
Employee
G_W_Albrecht
Legend
Legend

I have a response to my feedback - the information has just recently been added, also for simple SMS: This is a link to the relevant section:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

CCSE CCTE SMB Specialist

View solution in original post

Michael_Horne
Collaborator

Hello,

I believe you have found the root cause of my problem, as the target gateways are still running R80.40. I have only updated the files for the R81 gateways.

This table is not in my PDF version of the R81 Admin guide.

Many thanks,

0 Kudos
G_W_Albrecht
Legend
Legend

That his table is not in my PDF version of the R81 Admin guide also was my issue !  Solution:

- open the Admin Guide on page 3 Important Information

- click Download the latest version of this document in PDF format

- look if the date on the cover page is later as the one of  your PDF

😎

CCSE CCTE SMB Specialist
G_W_Albrecht
Legend
Legend

If it works now, i would appreciate a Kudo 😎

CCSE CCTE SMB Specialist
Michael_Horne
Collaborator

Both the table and also how to download the latest version using the link in the PDF, both earn Kudo points.