Smartview

[Dmitriy_K]

Hi all!
Please help me solve the problem. I can log into the Smartview Console using my external IP address from anywhere. At the same time, I don’t have a single rule on the gateway that allows this action. I would not like access to Smartview of my gateway to be opened from the Internet. I want this to be possible only from the local network.
How can I block access to Smartview via a public address?
I will be grateful for your help

OS Gaia
Version R81.20 

[PhoneBoy]

The only way this would be possible is if you have a Standalone gateway (i.e. no external management).
This traffic is being accepted on implied rules.
This can be fixed with: https://support.checkpoint.com/results/sk/sk105740 

[Dmitriy_K]

Thanks a lot for your hint. Yes, I have a Standalone gateway. The decision was right

[Lesley]

As extra you can make ACL here for SmartConsole access:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/GUI-Cli...

The IP's you put here, only those IP's are allowed to use SmartConsole.

Extra, you can do the same for portal access and SSH: 

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/Host-Ac...

This called host access. It look's similar as GUI client ACL but it is different. 

[Dmitriy_K]

Your tips helped me. Thank you for sharing your knowledge

[the_rock · Accepted solution]

That should be simple to solve...just create a rule that allows ONLY access from trusted IPs/locations/networks and then right below that rule that blocks access to the IP listening for smartview log in page.

Andy

[the_rock]

Also, forgot to mention, easiest way to block any subnet/IP via smart console is SAM rule through SV monitor.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_LoggingAndMonitoring_AdminGuide/To...

Andy