The ticket
Network layer Accepts Priya to 10.20.30.41. Application/URL layer still drops category “Uncategorized.” The junior says “rule 40 accepted it.” He never opened layer 2.
Ordered layers run top to bottom. A connection must be allowed by each ordered layer that applies. Inline layers are a sub-policy: the parent rule matches, then child rules decide. Shared layers reuse the same rules in more than one package.
SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.
Ordered vs inline
Official R81 Security Management: right-click a layer → Edit Policy; plus sign adds an Access Control layer. Ordered layers are sequential. Inline layers hang under one rule (the action is the inline layer).
Typical design: Layer 1 Network/Firewall (RFC1918, stealth, servers). Layer 2 Application Control / URL Filtering. Threat Prevention is a different policy you install separately.
Accept in layer 1 is a ticket to layer 2, not a free pass to the internet.
Which layer design
| Design | Use when | Risk |
|---|---|---|
| One ordered Network + one App layer | Most enterprises | People stop reading after layer 1 Accept |
| Inline under “HR servers” | Only that parent should see 30 child rules | Parent too wide (Any-Any jump) |
| Shared layer | Same stealth/cleanup in every package | Edit once, surprise every gateway |
Policy package Standard
How you add a layer
Side A — decide
New application checks for everyone? New ordered layer. Only HR? Inline under the HR parent.
Side B — SmartConsole
Access Control section → plus / Edit Policy → add layer or set rule Action to Inline Layer.
Side C — install
Publish. Install Policy → Access Control (and Threat Prevention only if that policy changed). Prove in logs which layer dropped.
Four layer failures
1 · Layer 1 Accept, layer 2 Drop
Log blade / column shows Application layer. Junior only screenshots Network.
2 · Inline parent is Any-Any
The whole company falls into a 5-rule HR sandbox.
3 · Shared layer edit
You tightened stealth in one package and broke a lab package that reused it.
4 · Forgot to install Access Control
Layer exists in SmartConsole. Gateway still has yesterday’s single layer.
How to prove it
1) You can name which layer dropped or accepted. 2) Install of Access Control succeeded. 3) A test browse matches the intended child/ordered rule. 4) Shared-layer impact is reviewed.
Traps
| Symptom | Layer story | First proof | Wrong fix |
|---|---|---|---|
| Network accept, user fail | App/URL or TP | Log layer name | Add another Network accept |
| Unexpected hosts in inline | Parent too wide | Parent source/dest | Disable the layer |
| All packages changed | Shared layer | Layer properties Shared | Clone SMS |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview
Sources
- R81 Ordered Layers and Inline Layers.
- R81 / R81.20 Security Management — Installing the Access Control Policy; Installing the Threat Prevention Policy.
Related: Check Point evidence desk · session factory · next lesson in the series above.