# Policy layers: not one giant rule list Source: https://ai.techclick.in/blog_checkpoint_policy_layers_not_one_list Markdown: https://ai.techclick.in/blog_checkpoint_policy_layers_not_one_list.md Publisher: Techclick Infosec Pvt Ltd Ordered layers and inline layers replace one giant rulebase. Network layer then Application layer, or an inline jump. Dummy Standard package. ## The ticket Network layer Accepts Priya to 10.20.30.41. Application/URL layer still drops category “Uncategorized.” The junior says “rule 40 accepted it.” He never opened layer 2. Quick interview answer Ordered layers run top to bottom. A connection must be allowed by each ordered layer that applies. Inline layers are a sub-policy: the parent rule matches, then child rules decide. Shared layers reuse the same rules in more than one package. Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## Ordered vs inline Official R81 Security Management: right-click a layer → Edit Policy; plus sign adds an Access Control layer. Ordered layers are sequential. Inline layers hang under one rule (the action is the inline layer). Typical design: Layer 1 Network/Firewall (RFC1918, stealth, servers). Layer 2 Application Control / URL Filtering. Threat Prevention is a different policy you install separately. Ordered layers Ordered layers Layer 1 Network Accept HR → HR app - Layer 2 App/URL still inspects Allowed or dropped both layers must allow Accept in layer 1 is a ticket to layer 2, not a free pass to the internet. ## Which layer design Design Use when Risk One ordered Network + one App layer Most enterprises People stop reading after layer 1 Accept Inline under “HR servers” Only that parent should see 30 child rules Parent too wide (Any-Any jump) Shared layer Same stealth/cleanup in every package Edit once, surprise every gateway smartconsole://sms-lab/policy/standard/layers Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Security Policies → Access Control → Policy → Layers ### Policy package Standard Ordered layer 1 Network — Firewall Ordered layer 2 Application / URL Filtering Inline HR_Servers (under rule 20) Shared Stealth_Shared Cancel OK R81 Security Management — Ordered Layers and Inline Layers. Training mock. ## How you add a layer #### Side A — decide New application checks for everyone? New ordered layer. Only HR? Inline under the HR parent. - #### Side B — SmartConsole Access Control section → plus / Edit Policy → add layer or set rule Action to Inline Layer. - #### Side C — install Publish. Install Policy → Access Control (and Threat Prevention only if that policy changed). Prove in logs which layer dropped. ## Four layer failures ### 1 · Layer 1 Accept, layer 2 Drop Log blade / column shows Application layer. Junior only screenshots Network. ### 2 · Inline parent is Any-Any The whole company falls into a 5-rule HR sandbox. ### 3 · Shared layer edit You tightened stealth in one package and broke a lab package that reused it. ### 4 · Forgot to install Access Control Layer exists in SmartConsole. Gateway still has yesterday’s single layer. ## How to prove it Close the ticket only when 1) You can name which layer dropped or accepted. 2) Install of Access Control succeeded. 3) A test browse matches the intended child/ordered rule. 4) Shared-layer impact is reviewed. ## Traps Symptom Layer story First proof Wrong fix Network accept, user fail App/URL or TP Log layer name Add another Network accept Unexpected hosts in inline Parent too wide Parent source/dest Disable the layer All packages changed Shared layer Layer properties Shared Clone SMS ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Layer 1 Network Accepts. What happens in a two-ordered-layer policy? Traffic is done The next ordered layer still inspects NAT is skipped SIC resets Correct: b . Concept. Q2 When do you pick an inline layer? Always instead of ordered layers When only the parent match should enter a sub-policy For Gaia routes For SIC only Correct: b . Choose table. Q3 Threat Prevention lives where? Always inside the Network layer A separate policy you install separately Only on SmartConsole PC Inside Hide NAT Correct: b . R81.20 Installing the Threat Prevention Policy. Q4 Shared layer risk? One edit hits every package that uses it It disables logs It breaks Gaia It turns off first match Correct: a . Failure 3. Q5 Official place to add an ordered layer? clish set layer Access Control Policy section → Edit Policy / plus cpconfig fw monitor -p all Correct: b . R81 Ordered Layers topic. Q6 User fails, Network rule Accept. First proof? Reboot SMS Read which layer the log cites Delete cleanup fwaccel off Correct: b . Failure 1. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - R81 Ordered Layers and Inline Layers . - R81 / R81.20 Security Management — Installing the Access Control Policy; Installing the Threat Prevention Policy. Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt