Variables in Snort Rules to identify Networks

[Moosa]

Hi Everyone,

It seems like a very basic question, but I cannot find an answer for it.

In Snort Rules there are two variables commonly used: $EXTERNAL_NET and $HOME_NET

In Cisco FMC there is something called variable sets, where we define these variables and include the subnets in the variables.

Where do we do that in Check Point? I am not aware of any variables I can create in Check Point. Will it be identified by a Network Object if I create them by exact name as variables in Snort Rule? 

Thanks in advance.

[PhoneBoy · Accepted solution]

Those variables are automatically converted to “any” and cannot be set.
I presume this also applies in later versions than R80.30 as well.
See: https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ThreatPrevention_AdminGuide/...

[Moosa]

Thank you. I went through that document yet missed that point, it is mentioned there.