Let's discuss!
There are various methods of defining the Internet within your firewall security policy.
I've showcased the five most common methods in the screen shot below.
The proper firewall definition of the Internet depends on your needs!
This discussion shall raise your awareness that it's required to evaluate your specific demand to avoid using * Any or All_Internet by default.
Method 1: Using the default * Any definition
Pro: Allows for proper Security Policy verification checks.
Con: Any is not the Internet. In an ideal security world, you shouldn't use * Any in any of your firewall rules.
Method 2: Using the default IP Address range: All_Internet (0.0.0.0-255.255.255.255)
Pro: While Hide-NAT on "Any" source doesn't work, using All_Internet as the source will do the job.
Con: The Internet consists of various networks, public, private and other ones. In a security environment you operate all kind of corporate networks, DMZs, VPNs, Remote Users, Office Modes and many more entities using IP addresses. From a firewall security point of view the Internet definition means everything that is not internally, branch office, Site-to-Site or Remote Access VPN connected. For a firewall the Internet is everything else, public, untrusted, external. A simple IP Address range object with the name All_Internet provokes many misunderstandings. A security reviewer, like me, would be happy that * Any was replaced with an object someone hopefully took care of properly defining what the Internet for that specific firewall implementation is. Only when looking deeper into the object it gets clear that this definition is even more worse than * Any because it might supersede the automatic validation checks Check Point does. Please see the Global Properties for Non Unique IP Adresses shown below.
Method 3: Using a Group with Exclusion (Any except all corp. networks, branch office networks, VPN encryption domains, office mode networks, RFC 1918 networks and so on)
Pro: Easy to use and understandable for humans within normal firewall administration.
Con: Groups with Exclusion are very complex for automatic firewall validation checks, hard to troubleshoot for humans, known to sometimes cause issues when used in VPN encryption domains and therefore have many limitations (sk97246, sk101506, sk107543, sk107417, ..). Also, what is * Any from a firewalls perspective? How does a firewall define * Any? Are there exclusions from * Any? For Services everyone knows that Check Point per default excludes X11 from Any. How about Networks?
Method 4: Using the Application and URL Filtering object 'Internet'
Pro: Only applies to traffic heading outside the corporate network - to the DMZ and external interfaces. The object distinguishes between internal and external addresses.
Con: This is only the default destination for Application and URL Filtering rules so you can only use this object in the destination column of Application and URL Filtering enabled rules and layers.
Method 5: Negating a group that contains all your networks (similar to Method 3 without using a Group without Exclusion)
Pro: Perfect definition of the Internet for the firewall and all of its automatic verification and validation mechanisms. Simple negation of all networks that your firewall 'knows' not to be part of the public, untrusted, external Internet.
Con: Harder to understand for humans, especially in security policies with advanced complexity.
Appendix:
Menu > Global Properties > Non Unique IP Addresses
In the above window you can see the non-unique IPv4 and IPv6 address ranges.
Security Management considers addresses that are routable on the Internet as unique, and private, non-routable addresses as being non-unique (duplicated). It is possible to add address ranges to the default list. There is normally no need to change the default addresses.
This list is used by SmartDashboard to perform automatic validity checks on addresses.
IPv4 Addresses
RFC 1918 documents private address spaces which may be used on internal networks that will not have hosts directly connected to the Internet. The Internet assigned Numbers authority (IANA) has set aside the following three blocks of IP addresses for internal (private) network use:
In an intranet that uses private addresses, a Check Point Security Gateway NAT gateway is put in place to connect the intranet to the Internet and translate the private addresses, to routable addresses. The default list of non-unique addresses are the three ranges specified in RFC 1918.
IPv6 Addresses
There are so many IPv6 public addresses that is not usually necessary to assign private IPv6 addresses for an internal network. There is a "Unique Unicast" IP range of fc00::/7 that can be used for private IPv6 addresses as specified in RFC4193.
