How to Manage Security Policies in Check Point SmartConsole

Effective security policy management is critical for maintaining both security and operational efficiency in Check Point environments. This guide covers advanced policy management techniques including layers, policy packages, role-based administration, and best practices for organizing large rule bases.

Prerequisites

Before you begin, ensure you have:

• SmartConsole installed with administrator credentials
• Understanding of basic firewall rules (see our firewall rules guide)
• Knowledge of your network topology and security requirements
• Policy design document outlining your security zones and access requirements
• Change management process for policy modifications

Understanding Policy Architecture

Check Point R80.x introduced a modern policy architecture with several key concepts:

Step 1: Create a Policy Package

Policy packages organize your security policies and determine which gateways they apply to:

1. Open SmartConsole and connect to your Management Server
2. Navigate to Security Policies
3. Click the + button or go to Menu > New Policy Package
4. Configure the package:
   • Name: Use a descriptive name (e.g., "Corporate_HQ_Policy")
   • Installation Targets: Select gateways this policy applies to
   • Policy Types: Select Access Control and/or Threat Prevention
5. Click OK to create the package

Policy Package Best Practices

Step 2: Understand and Configure Ordered Layers

Ordered Layers allow you to segment your policy into logical sections:

How Ordered Layers Work

1. Traffic is evaluated against each layer in order (top to bottom)
2. Each layer can have its own rules and blades enabled
3. Layers can have different actions: Accept, Drop, or Inline Layer
4. A layer can pass traffic to the next layer or make a final decision

Creating an Ordered Layer

1. Navigate to Security Policies > Access Control
2. Click Actions > Add Layer
3. Configure the layer:
   • Name: Descriptive name (e.g., "Network_Layer")
   • Blades: Select which blades are active (Firewall, App Control, URL Filtering)
   • Shared: Enable "Multiple policies can use this layer" if reusing across packages
4. Click OK

Recommended Layer Structure

Layer 1: Network Layer (Firewall only)

• Drop unwanted traffic based on IP/port
• Stealth rules
• Management access rules
• Simple, fast processing

Layer 2: Application Control Layer

• Application-based access control
• URL filtering rules
• Content filtering

Layer 3: Cleanup Layer

• Final default rules
• Explicit drop all with logging

Step 3: Implement Inline Layers

Inline Layers create sub-policies within rules for granular control:

When to Use Inline Layers

• Departmental policies: Different rules for HR, Finance, IT
• Location-based policies: Rules specific to branch offices
• Complex access requirements: Multi-tier decision making
• Delegation: Allow teams to manage their own rules

Creating an Inline Layer

1. In your Access Control policy, create a rule
2. In the Action column, right-click and select Inline Layer
3. Select New Layer to create a new inline layer
4. Configure the inline layer rules
5. The inline layer becomes a sub-policy that is evaluated when the parent rule matches

Inline Layer Example

Parent Rule:

• Source: Finance_Department
• Destination: Any
• Action: Inline Layer "Finance_Policy"

Inline Layer "Finance_Policy":

• Rule 1: Allow Finance to Banking_Applications
• Rule 2: Allow Finance to Internal_ERP
• Rule 3: Drop Finance to Social_Media
• Rule 4: (Implicit cleanup)

Step 4: Configure Layer Sharing

Shared layers can be reused across multiple policy packages:

1. Double-click a layer to edit its properties
2. Enable Multiple policies can use this layer
3. This layer can now be added to other policy packages
4. Changes to the shared layer affect all packages using it

Shared Layer Use Cases

Step 5: Implement Role-Based Administration

Control who can view and modify different parts of the policy:

Configuring Layer Permissions

1. Double-click a layer to edit properties
2. Go to the Permissions section
3. Click Add to assign permissions
4. Select an administrator or administrator group
5. Assign permission level:
   • Read Only: Can view but not modify
   • Write: Can modify the layer
   • None: Cannot see the layer

Creating Administrator Roles

1. Go to Manage & Settings > Permissions > Administrators
2. Click New > Administrator
3. Configure:
   • Name, email, authentication method
   • Permission profile (predefined or custom)
4. Assign to appropriate groups

Permission Scenarios

Step 6: Optimize Rule Organization

Efficient rule organization improves both security and performance:

Use Sections for Visual Organization

1. Right-click in the rule base
2. Select Add Section Title
3. Enter a descriptive section name
4. Drag rules into appropriate sections

Recommended Section Structure

=== Stealth and Management ===
- Stealth rule
- Management access rules

=== Inbound Traffic ===
- DMZ access rules
- Published services

=== Internal Traffic ===
- Server to server
- User to server

=== Outbound Traffic ===
- Internet access rules
- SaaS application access

=== Cleanup ===
- Log and drop all

Rule Ordering Best Practices

1. Most specific rules first - Exact matches before ranges
2. Frequently matched rules near top - Improves performance
3. Drop rules before accept rules - Security principle
4. Group related rules - Easier management
5. Cleanup rule last - Catch-all logging

Step 7: Manage Policy Packages Across Gateways

Assigning Policies to Gateways

1. Navigate to Security Policies
2. Select your policy package
3. Go to Installation Targets
4. Add gateways or gateway groups
5. Publish and install

Using Gateway Groups

1. Go to Objects > New > Group > Simple Group
2. Name the group (e.g., "Branch_Office_Gateways")
3. Add gateway objects to the group
4. Use the group as an installation target

Multi-Policy Considerations

Step 8: Version Control and Change Management

Using Policy Revisions

1. Go to Manage & Settings > Permissions > Revision Control
2. View policy history
3. Compare revisions to see changes
4. Rollback if needed (requires new install)

Exporting Policy Configuration

# From Management Server CLI
clish -c "show configuration"

# Export specific policy
clish -c "show access-control-policy <policy_name>"

Change Documentation

For each policy change, document:

• Change request number
• Business justification
• Rules added/modified/deleted
• Rollback procedure
• Approval chain

Step 9: Policy Analysis and Optimization

Using Policy Analysis Tool

1. Go to Security Policies > Access Control
2. Click Actions > Policy Analysis
3. Simulate traffic:
   • Enter source, destination, service
   • View which rules would match
4. Identify shadowed or redundant rules

Finding Unused Rules

1. Enable rule hit counts in SmartConsole preferences
2. After a sufficient time period, review rules with zero hits
3. Investigate and consider disabling or removing unused rules

Performance Optimization

Step 10: Security Zone Implementation

Security Zones simplify policy management:

Creating Security Zones

1. Go to Objects > New > Security Zone
2. Name the zone (e.g., "Internet_Zone", "DMZ_Zone", "Internal_Zone")
3. Configure zone members:
   • By interface (automatic based on topology)
   • By network objects

Using Zones in Rules

Instead of:

• Source: [List of 50 internal networks]

Use:

• Source: Internal_Zone

Benefits:

• Shorter rule base
• Easier maintenance
• Automatic topology updates
• Better performance

Troubleshooting Common Issues

Policy Installation Fails

Symptoms: Error during policy install.

Solutions:

1. Check gateway connectivity
2. Verify SIC trust between management and gateway
3. Review error messages in Tasks panel
4. Check for conflicting objects or circular references
5. Verify license validity

Unexpected Traffic Blocking

Symptoms: Traffic blocked that should be allowed.

Solutions:

1. Use Policy Analysis to trace the traffic
2. Check rule order (specific before general)
3. Verify object definitions are correct
4. Check for implicit deny in layer structure
5. Review Threat Prevention policies if enabled

Slow Policy Performance

Symptoms: High CPU, slow installs, latency.

Solutions:

1. Reduce number of rules per layer (keep under 100)
2. Consolidate similar rules
3. Use Security Zones instead of large groups
4. Move high-traffic rules up in the rule base
5. Disable unnecessary logging on high-volume rules

Best Practices Summary

Next Steps

After implementing advanced policy management:

1. Automate with API - Use Check Point Management API for automation
2. Implement CI/CD - Version control and automated testing
3. Regular Audits - Schedule periodic policy reviews
4. Train Team - Ensure all admins understand layer architecture
5. Disaster Recovery - Test policy restore procedures

Additional Resources

• Check Point Policy Management Admin Guide
• Ordered Layers and Inline Layers
• Access Control Best Practices
• Check Point CheckMates Community

Need help optimizing your Check Point security policies? Inventive HQ provides expert policy review, optimization, and managed security services. Contact us for a free consultation.