The ticket
Rule 40 allows HR_Users to hr.techclick-lab.in HTTPS. Traffic log shows rule 8 temp-lan-any Accept — or cleanup Drop if someone “fixed” rule 8 later. Nobody reads below the first match.
Check Point Access Control evaluates top to bottom. The first rule that matches source, destination, service, and time wins. Later more-specific rules never run. Cleanup should drop and log. Implied rules still exist — do not assume your row 1 is the first packet check.
SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.
Objects then first match
You never type 10.20.30.80 in twenty rules. You create host_priya_hr or put her in Access Role / group, then reuse the object. Change the IP once.
First match is the whole game: Source + Destination + VPN + Service + Time. Action is Accept, Drop, or jump to an inline layer (next lesson).
Every healthy policy ends with an explicit cleanup drop+log. If you delete it, implied cleanup still drops — but you lose a clear log story.
Rule 40 is correct and unused. The log will not show it.
Object types
| Object | Example in this lab | Use |
|---|---|---|
| Host | host_hr_app 10.20.30.41 | One IP |
| Network | net_lan 10.20.30.0/24 | Subnet |
| Group | grp_hr_servers | Reuse lists |
| Service | HTTPS, custom TCP 8443 | Never Any unless you mean it |
| Time | time_business | Optional extra match |
Rule 40 · HR to HR app
How you write a rule
Side A — objects first
Objects menu → New Host / Network / Group. Name them for humans (
host_hr_app).Side B — rule
Access Control → Policy → add above cleanup, never below. Source / Dest / Service / Accept / Log / comment.
Side C — publish + install + log
Publish session. Install Policy. Browse. Log must show this rule number, not cleanup and not a wide accept above.
# SmartConsole → Logs & Monitor # Origin: cp-gw-01 # Source: 10.20.30.80 # Destination: 10.20.30.41 # Service: https # Action: Accept # Rule: 40 Name: HR_to_HR_app # If Rule is 8 temp-lan-any — first match ate your design.
Four rulebase failures
1 · Shadowed rule
Wide rule above a specific rule. Log never shows the specific one.
2 · Object IP wrong
Host still has 10.20.30.42. Rule looks perfect. Packet does not match.
3 · Service Any vs HTTPS
You allowed HTTPS. App uses 8443. Cleanup drop. Create the service or a group.
4 · Unpublished session
You see the rule. Other admins and the gateway do not. Publish, then install.
How to prove it
1) Object IPs are correct. 2) No wide accept above the intended rule. 3) Published + installed. 4) Log shows that rule name/number for Priya’s 5-tuple.
Traps
| Symptom | Likely story | First proof | Wrong fix |
|---|---|---|---|
| Cleanup drop, rule “exists” | Shadow or unpublished | Log rule number | Add another duplicate at the bottom |
| Accept but wrong app | Any-Any above | Log rule 8 | Disable Threat Prevention |
| Works for IP, not for user | Identity lesson 7 | Source user empty | More host objects |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview
Sources
- R80.20+ SmartConsole help — Creating a Basic Access Control Policy; cleanup rule; layers.
- R81 Security Management Administration Guide — objects, Rule Base first-match enforcement.
Related: Check Point evidence desk · session factory · next lesson in the series above.