# Objects and rulebase: first match wins Source: https://ai.techclick.in/blog_checkpoint_objects_rulebase_first_match Markdown: https://ai.techclick.in/blog_checkpoint_objects_rulebase_first_match.md Publisher: Techclick Infosec Pvt Ltd Policy is objects plus first-match action. Cleanup rule, implied rules, and why a stealth allow above HR breaks production. Dummy Standard policy. ## The ticket Rule 40 allows HR_Users to hr.techclick-lab.in HTTPS. Traffic log shows rule 8 temp-lan-any Accept — or cleanup Drop if someone “fixed” rule 8 later. Nobody reads below the first match. Quick interview answer Check Point Access Control evaluates top to bottom. The first rule that matches source, destination, service, and time wins. Later more-specific rules never run. Cleanup should drop and log. Implied rules still exist — do not assume your row 1 is the first packet check. Hero · first card wins A wide accept above a precise allow makes the precise allow dead ink. Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## Objects then first match You never type 10.20.30.80 in twenty rules. You create host_priya_hr or put her in Access Role / group, then reuse the object. Change the IP once. First match is the whole game: Source + Destination + VPN + Service + Time. Action is Accept, Drop, or jump to an inline layer (next lesson). Every healthy policy ends with an explicit cleanup drop+log. If you delete it, implied cleanup still drops — but you lose a clear log story. Packet vs rule list First match Packet Implied R8 Any-Any R40 HR (never) Action wins - Rule 40 is correct and unused. The log will not show it. ## Object types Object Example in this lab Use Host host_hr_app 10.20.30.41 One IP Network net_lan 10.20.30.0/24 Subnet Group grp_hr_servers Reuse lists Service HTTPS , custom TCP 8443 Never Any unless you mean it Time time_business Optional extra match smartconsole://sms-lab/policy/standard Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Security Policies → Access Control → Policy ### Rule 40 · HR to HR app No. 40 Source HR_Users (Access Role) Destination host_hr_app Services HTTPS Action Accept Track Log Cancel OK Security Management — creating a basic Access Control policy; first-match enforcement. Training mock. ## How you write a rule #### Side A — objects first Objects menu → New Host / Network / Group. Name them for humans ( host_hr_app ). - #### Side B — rule Access Control → Policy → add above cleanup, never below. Source / Dest / Service / Accept / Log / comment. - #### Side C — publish + install + log Publish session. Install Policy. Browse. Log must show this rule number, not cleanup and not a wide accept above. What the log must say · dummy # SmartConsole → Logs & Monitor # Origin: cp-gw-01 # Source: 10.20.30.80 # Destination: 10.20.30.41 # Service: https # Action: Accept # Rule: 40 Name: HR_to_HR_app # If Rule is 8 temp-lan-any — first match ate your design. ## Four rulebase failures ### 1 · Shadowed rule Wide rule above a specific rule. Log never shows the specific one. ### 2 · Object IP wrong Host still has 10.20.30.42. Rule looks perfect. Packet does not match. ### 3 · Service Any vs HTTPS You allowed HTTPS. App uses 8443. Cleanup drop. Create the service or a group. ### 4 · Unpublished session You see the rule. Other admins and the gateway do not. Publish, then install. ## How to prove it Close the ticket only when 1) Object IPs are correct. 2) No wide accept above the intended rule. 3) Published + installed. 4) Log shows that rule name/number for Priya’s 5-tuple. ## Traps Symptom Likely story First proof Wrong fix Cleanup drop, rule “exists” Shadow or unpublished Log rule number Add another duplicate at the bottom Accept but wrong app Any-Any above Log rule 8 Disable Threat Prevention Works for IP, not for user Identity lesson 7 Source user empty More host objects ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Two rules match a packet. Which one wins? The more specific one anywhere in the list The first match from the top The cleanup rule The one with Log off Correct: b . First match. Q2 Why create host_hr_app instead of typing 10.20.30.41 in ten rules? Objects reuse one IP definition NAT requires it only Gaia forbids raw IPs It disables implied rules Correct: a . Objects then first match. Q3 Log shows rule 8 Any-Any Accept. Rule 40 is the “real” HR allow. What is true? Rule 40 still ran Rule 8 shadowed rule 40 Cleanup is broken SIC is down Correct: b . Failure 1. Q4 You added a rule but the gateway log does not show it. Likely? Forgot Publish and/or Install Policy Need fwaccel off forever Need a new SMS HTTPS Inspection is mandatory Correct: a . Failure 4. Q5 What should the last explicit Access rule usually be? Accept Any Any Drop/cleanup with Log Encrypt Empty layer Correct: b . Cleanup. Q6 Implied rules mean… Your row 1 is always the first check The gateway also has built-in control/system rules around your list NAT is off First match is disabled Correct: b . Quick answer. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - R80.20+ SmartConsole help — Creating a Basic Access Control Policy; cleanup rule; layers. - R81 Security Management Administration Guide — objects, Rule Base first-match enforcement. Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt