Check Point R80.20 - Best Practices for Access Control Rules

Creating an Access Control Policy
Next Generation Security Gateway Guide R80.20 | 142
Optimize the Rule Base matching.
Look for the first rule that matches:
• Rule 1 – Match.
• Rule 2 – No match.
• Rule 3 – Match.
Final match (accept on rule
1).
Shows in the log.
The matching examples show that:
• The Firewall sometimes runs the Rule Base more than one time. Each time it runs, the
Firewall optimizes the matching, to find the first rule that applies to the connection.
• If the rule includes an application, or a site, or a service with a protocol signature (in the
Application and Services column), or a Data Type (in the Content column), the Firewall:
• Turns on one or more inspection engines.
• Postpones making the final match decision until it has inspected the body of the
connection.
• The Firewall searches for the first rule that applies to (
matches ) a connection. If the Firewall
does not have all the information it needs to identify the matching rule, it continues to inspect
the traffic.
Best Practices for Access Control Rules
1.
Make sure you have these rules:
• Stealth rule that prevents direct access to the Security Gateway
• Cleanup rule that drops all traffic that is not allowed by the earlier rules in the policy.
2.
Use Layers to add structure and hierarchy of rules in the Rule Base.
3.
Add all rules that are based only on source and destination IP addresses and ports, in a
Firewall/Network Ordered Layer at the top of the Rule Base.
4.
Create Firewall/Network rules to explicitly accept safe traffic, and add an e xplicit cleanup rule
at the bottom of the Ordered Layer to drop everything else.
5.
Create an Application Control Ordered Layer after the Firewall/Network Ordered Layer. Add
rules to explicitly drop unwanted or unsafe traffic. Add an explicit cleanup rule at the bottom of
the Ordered Layer to accept everything else.
Alternatively, put Application Control rules in an Inline Layer as part of the Firewall/Network
rules. In the parent rule of the Inline Layer, define the Source and Destination.
6.
Share Ordered Layers and Inline Layers when possible.
7.
For R80.10 Gateways and higher: If you have one Ordered Layer for Firewall/Network rules,
and another Ordered Layer for Application Control - Add all rules that examine applications,
Data Type, or Mobile Access elements, to the Application Control Ordered Layer, or to an
Ordered Layer after it.
8.
Turn off XFF inspection, unless the gateway is behind a proxy server. For more, see: sk92839
http://supportcontent.checkpoint.com/solutions?id=sk92839.
9.
Disable a rule when working on it. Enable the rule when you want to use it. Disabled rules do
not affect the performance of the Gateway. To disable a rule, right click in the No. column of
the rule and select Disable.