Checkpoint Firewall Policy: Rules & Configuration

A firewall policy outlines the way an organization’s firewalls should handle the traffic that comes into and out of the specified IP addresses and address ranges, protocols, applications and content types governed by the organization’s security policies. Organizations should carry out a risk assessment to come up with a list of the types of traffic they need and how to secure them, such as which types of traffic can be allowed to pass through the firewall under certain conditions.

Checkpoint has multiple types of security policy to allow or Deny traffic from source to destination. 

Types of Rules in a Firewall

1. Implicit Rules – Default rules allowed/deny by firewall. For example, any-any traffic is by default dropped by all firewalls. It’s a general behaviour of a firewall. These rules are not visible in the security policy dashboard.
2. Explicit Rule – The rule which are created/configured by admin in firewall. 
3. Stealth Rule – It stops or denied access of any user to connect with Security Gateway
4. Cleanup Rule – Rules which are created to deal with unmatched traffic.

Moreover, make sure you understand the order of the rule enforcement to maximise the security of the firewall.

The firewall always enforces the first rule that matches a connection. It cannot enforce the last rule that can be more applicable.

The Order of Policy is:

• First Implied Rule – You cannot delete or edit rule and no explicit rules can be replaced before it. Implied Rule means which are already available in firewall by-default.
• Explicit Rule – These are rules that you create
• Before Last Implied Rule – These implied Rules are applied before the last explicit rule.
• Last Explicit Rule – We recommend that you use the Cleanup rule as the last explicit rule.

Let’s discuss the best practices to create Security Policy in Checkpoint Firewall.

Checkpoint Firewall Policy: Management Rule

Management Rule means policy allows access to specific IP addresses to take SSH/HTTPs access to Checkpoint Gateway.

1 Go to Left Most Tab -> Select Rule -> Add Rule ->Select Top

2 Give Name to the Security Policy -> Management_Rule ( As policy Created for Management Access )

3 Now Add Source Address by Clicking + sign in Source Address Tab and similarly add Destination address in Policy.

Here, we have selected Source Address -> 10.0.0.99 (Any Client Machine)

Destination Address -> Gateway IP address of the Firewall 

4 Add List of Services like SSH, HTTPS & HTTP in the Security Policy by clicking + sign on right most corner of the Service Tab.

5 Add Action -> Accept from the + of Action tab

6 Add Track -> Log, every traffic generated by Client access will be logged

7 Install the Policy.

Checkpoint Firewall Policy: Deny Rule | Stealth Rule

Here we will deny access to unauthorised users for Management Gateway.

1 Add new Rule below Management_Rule

2 In this rule we will use below values to stop access to unauthorised access

Rule name -> Stealth Rule

Source Address -> Any

Destination Address -> GWMGMT

Service -> Any

Action -> Drop

Checkpoint Firewall Policy: Internet Access

In this policy we will allow users to access Internet from Inside network

1. Add Policy Name-> Internet Rule
2. Add Source Address/Network -> Inside_hosts-> 192.168.1.0/24
3. Destination Address -> Any (Internet)
4. Service -> Internet Ports which are HTTP (port 80) and HTTPs (port 443)
5. Action -> Accept

Checkpoint Firewall Policy: Allow Specific Port

Here we will allow access to specific ports.

1. Source Address is any user machine-> Cli02
2. Destination Address -> RDP_Host-> Server
3. Service -> RDP
4. Action->Accept 

Checkpoint Firewall Policy: Inside to DMZ

To allow access from Inside network to DMZ network below policy will be used.

1. Policy Name ->Inside_to_DMZ_Access
2. Source -> Any source IP which needs to be access DMZ network
3. Destination Address -> DMZ_Network
4. Service -> DNS and Https
5. Action -> Accept

Checkpoint Firewall Policy: Cleanup Rule

Last Rule is a cleanup rule in which we deny all other traffic and apply it at the BOTTOM of all the firewall rules.

1. 1. Rule Location -> Bottom
   2. Rule Name -> Cleanup_Rule
   3. Source -> Any
   4. Destination -> Any
   5. Service -> Any
   6. Action -> Drop

Checkpoint Firewall Policy: Install Policy

Once all rules are configured, it’s time to install policy on the Gateways.

Select -> Install Policy

Once you select Install Policy it will prompt Gateway options 

Select Firewall Gateway -> Click OK

Installation done

Continue Reading:

FortiGate Firewall Policy: Rules, Types & Configuration

Checkpoint NAT Policy: Types & Configuration