CHECK POINT · TROUBLESHOOTING

Troubleshoot Check Point: the policy won’t install, and nothing works

Someone built this and went home. Install Policy fails, and PC1 can’t reach anything. There are three faults: a rule that hides another, interfaces with their topology swapped, and changes never published.

Check Point-style track · Check Point-style, Buddy Security Console, Cisco router · 4 objectives

Open in simulator More Check Point-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Install fails: rule DROP-ALL (any, any, any, Drop) sits above INSIDE-OUT, and hides it. Move INSIDE-OUT to the top. Verification names both rules.
eth1 is set external and eth2 internal, the wrong way round. Automatic NAT hides on the external side, so PC1 would leave untranslated and R1 could not answer. Set eth1 internal and eth2 external.
show changes lists what you have done so far, and none of it counts until it is published. Publish, and install.
PC1 reaches 198.51.100.1, and show gateways says Installed.

Start this lab

Before you start

Read the installation’s error, then the ping’s reason: each names the fix. A gateway runs what was installed, the manager’s database holds what was published, and your session holds the rest. fw unloadlocal on the gateway removes its policy in an emergency, and it passes everything until the next install.

Concept

Change, publish, install

A Check Point-style manager has three steps. A change is private in your session. Publish moves it into the manager’s database. Install Policy verifies it and sends it to a gateway. The gateway runs what was installed, so three places can disagree.

Concept

Anti-spoofing: a packet must come from the right side

Each interface is internal or external. An internal interface accepts only source addresses from its own network, and an external one refuses addresses that belong inside. A wrong topology therefore looks like a broken network. The reason names the interface and the address.