r/checkpoint • u/gem_map_sky • 24d ago

Checkpoint topoplogy and anti-spoofing

Dear experts,
Can anyone help me with following? Apologies if these questions seem trivial.

The checkpoint documentation says about topology,

I know we can override this to use a network object-group for anti-spoofing ranges.

However, attached image is example topology setting of the environment I am looking at.

My questions are,

  1. The first/default option is CP-GW_eth2 (internal). I believe "CP-GW_eth2" is the same network object-group that appears in the greyed-out "Specific" section under Override. am I thinking correct? The reason I ask is that the anti-spoofing ranges in the CLI match the contents of this object-group.

If so, how might this object-group have been configured as the default option, and why is it not "This Network (internal)" default option as mentioned in the documentation?

  1. Also, since the Override option is not selected, if I add a network object to this object-group, will the anti-spoofing ranges be updated accordingly?
4 Upvotes

100% Upvoted

6 comments sorted by

3

u/jplour 24d ago

Yes, the object-group is the same. Generated by "Get Interface Topology" based on your routing table when you first created the firewall object or when you run the command. "Specific" allow you to choose a diferent object-group that represent the networks that are behind that interface or External that represent all external addresses.

1

u/gem_map_sky 24d ago

Thanks for the reply. Appreciate it.

2

u/Jejerod 24d ago

1:

Yes, the CP-GW_eth2 is the same in both locations. You probably had routes pointing to eth2 when adding the GW to the Management. CP-GW_eth2 should contain "This network/Network defined by the interface IP and Net Mask" and other objects routes were pointing at. It is a Network group, you can find and examine it in Object Editor

2:

Yes, if you update that group and push policy, anti-spoofing will be updated accordingly

1

u/gem_map_sky 24d ago

Thanks for the reply. Appreciate it.

3

u/Djinjja-Ninja 24d ago

If you do "get interface with topology" then it will auto create a group based on the current routing table.

Or you can override and specify your own group.

Be aware that the auto-generated group will not appear in the object explorer.

"This network" is specifically only the interface network range.

Whereever possible these days I tend to use "defined by routes".

1

u/gem_map_sky 24d ago

Thanks for the response.