AnsweredAssumed Answered

Anonymizer matches all traffic

Question asked by Benjamin Hofstetter on Jan 25, 2018
Latest reply on Feb 4, 2018 by Kosin Usuwanthim

I am a bit struggling with an Anonymizer drop Rule. A rule basically like this 

 

internal to external Anonymizer drop

 

This rule matches any traffic from inside to outside. This rule starts to create 'accept' logs. The accept logs are logs were Application Control was not able to finish Application classification because of insufficient data transmitted. This is also happening for traffic that should be dropped by the cleanup rule. 

 

Does Check Point really accept / forward packets until the Classification did finish or not finish, even the traffic should be dropped by another Rule below this "internal to external Anonymizer drop" Rule (like the clean up rule). 

 

The Anonymizer App Group matches TCP Port 1-65535 and UDP 1-65535. I think this is the reason it matches "almost" all my traffic from inside to external. But i don't like it when the Firewall Accepts Traffic until the classification is done for Traffic that should be dropped by the cleanup Rule. 

 

Can I do something against that?

 

 

Regards

 

 

Outcomes