I asked the support centre AI - it has impressed me more than once lately..
"To properly manage an on-premises gateway using MaaS (Management as a Service) and configure the correct management and stealth rules, follow these steps:
Management Rule
Allow Management Traffic:
Ensure that the gateway can communicate with the MaaS service. This typically involves allowing outbound HTTPS traffic to the MaaS service endpoints.
Example rule:
Source: Gateway
Destination: <Service-Identifier>.maas.checkpoint.com
Service: HTTPS (TCP/443)
Action: Allow
Stealth Rule
Configure Stealth Rule:
A stealth rule is used to protect the gateway itself from unauthorized access. It should be placed at the top of the rule base to drop any traffic that is not explicitly allowed.
Example rule:
Source: Any
Destination: Gateway
Service: Any
Action: Drop
Additional Considerations
Bidirectional Rules:
Ensure that the rules are bidirectional if necessary, especially for management traffic that requires responses.
NAT Configuration:
If the gateway is behind a NAT device, ensure that the NAT configuration allows the necessary traffic to pass through.
Example Configuration
Here is an example of how the rules might look in a simplified format:
Rule No. Source Destination Service Action
1 Any Gateway Any Drop
2 Gateway .maas.checkpoint.com HTTPS (TCP/443) Allow
3 ... ... ...
Verifying Configuration
Check MaaS Tunnel:
Ensure the MaaS tunnel is up and running by using the following commands in Expert mode:
maas status
show security-gateway cloud-mgmt-service
Check Interface:
Verify the
maas_tunnel
interface is configured correctly:
ifconfig
By following these steps, you can ensure that your on-premises gateway is properly managed by MaaS and protected by a stealth rule.
BE AWARE
Important - To prevent negative impact on your production environment, double-check the provided information in the Administration Guide for the involved product."
