CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


I'd like to thank everyone involved for making "The CPUG Challenge" a great success.
We helped a lot of people see and learn a bit more about R80.10, while having some fun.
We will be using this success to try and bring more events to more locations soon. -E

 

Results 1 to 4 of 4

Thread: SAM rules exception

  1. #1
    Join Date
    2015-10-21
    Posts
    32
    Rep Power
    0

    Default SAM rules exception

    Hello,

    From time to time some legitimate hosts/networks falls into SAM :-(. Is it possible to enter SAM rules exception (the same idea as in IPS network exceptions)?

    Best regards
    Mariusz

  2. #2
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    937
    Rep Power
    12

    Default Re: SAM rules exception

    It is better to not use SAM at all. However, you can create an indefinite SAM rule allowing traffic for your legitimate hosts. Main issue here, it sits before any other policy rule. I would avoid that by any mean if I were you
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  3. #3
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,002
    Rep Power
    12

    Default Re: SAM rules exception

    Suspicious Activity Rules were originally intended to be used temporarily in an IDS intruder shunning situation and to be fast-acting (i.e. a policy install is not required to enforce them). There is no way to define an exception to these that I can see.

    If you ever want to play a joke on your arrogant colleague who claims to know everything about Check Point (and lets you know about it daily), add a SAM rule via SmartView Monitor for his workstation address source IP, set the Action to Drop, and Track to None. :-) Nothing short of a "fw ctl zdebug drop" can uncover why the heck he can't seem to pass any traffic through the firewall. And even the zdebug saying "SAM drop" or whatever may not mean anything to your colleague if he is not aware of the SAM mechanism...
    --
    My book "Max Power: Check Point Firewall Performance Optimization"
    now available via http://maxpowerfirewalls.com.

  4. #4
    Join Date
    2005-08-14
    Location
    Gig Harbor, WA, USA
    Posts
    2,303
    Rep Power
    14

    Default Re: SAM rules exception

    Who needs to use SmartView Monitor for this when you can use "fw sam" to do this?
    http://phoneboy.com
    Unless otherwise noted, views expressed are my own

Similar Threads

  1. IPS Exception for particular domain.
    By m_1607 in forum IPS Blade (Formerly SmartDefense)
    Replies: 1
    Last Post: 2012-05-07, 06:52
  2. Mobile Access BLade (R75.10) - Downloaded-from-GW JavaRDP Exception
    By gahanpa in forum Mobile Access Blade (Formerly Connectra)
    Replies: 2
    Last Post: 2011-07-25, 08:29
  3. Unable to put exception or be granular
    By switzer in forum IPS Blade (Formerly SmartDefense)
    Replies: 2
    Last Post: 2010-09-21, 13:29
  4. Replies: 2
    Last Post: 2006-03-17, 16:05
  5. NAT with exception
    By ganoderma in forum NAT (Network Address Translation)
    Replies: 1
    Last Post: 2006-03-06, 03:05

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •