Policy Auditor

Introduction

Policy Auditor is a policy analysis and auditing tool designed to enhance security posture. It aligns Access Control policies with organizational intent, enabling you to identify policy violations and improve policy consistency. Use Policy Auditor to make sure your organization's security policies Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. are correctly implemented and comply with company guidelines.

Policy Auditor Workflow

1. The administrator defines network segments.

   The administrator first selects the network segments in which to audit the traffic. Each segment represents a distinct part of the network. For example: DMZ, branch offices, data center, and so on.

   After the administrator selects the networks to audit, Policy Auditor creates a table with the selected network segments. Each cell in the table represents a traffic flow between two segments or within a segment.

2. The administrator sets the guidelines

   For each cell in the table, the administrator specifies whether the traffic is allowed between the source and destination segments. By default, all traffic within a network segment is allowed.

   You can create multiple sets of guidelines, each focusing on a different network area, based on your needs and the required level of granularity.

   For example:

   One set of guidelines focuses on the traffic flow between key segments, such as: Data Center, DMZ, Public Cloud, Branch Offices, User Networks, and OT Network.

   Another set of guidelines focuses exclusively on the traffic between the Branch Offices, with selected segments including for example, the New York Office, Tokyo Office, London Office, and Paris Office.

3. Policy Auditor analyzes the Rule Base

   Policy Auditor evaluates the rules in each table cell against the guidelines:

   • For each rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session., it determines whether the rule complies with the guidelines or not.

   • A rule that does not comply with the guidelines is marked as a violating rule.

   Violation logic:

   • An Accept rule is presented as a violating rule if there is no Drop rule above it within the scope of the cell that fully covers its source, destination and services.

   • An Accept rule is not presented as a violation only if a single Drop rule above it fully covers its source, destination, and services.

   • If coverage is split across multiple rules above it, the Accept rule is not marked as a violation.

4. The administrator audits the rules

   For each violating rule, the administrator can decide whether to:

   1. Approve the violation.

   2. Change the rule to comply with the guidelines.

   3. Change the guidelines.

Known Limitations

• You can include up to 12 segments in one set of guidelines.

• In a network group, supported objects include network objects with IPv4 addresses and hosts with IPv4 addresses.

• Inspection of globally assigned rules in a Multi-Domain environment is not supported.

• Policy Auditor does not preserve calculations after an upgrade to another version or migration to another server. After an upgrade or a migration, you must recalculate all sets of guidelines. Calculations are preserved when installing a Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior..

• An Accept rule is not presented as a violation only if a single Drop rule above it fully covers its source, destination, and services. If coverage is split across multiple rules above it, the Accept rule is not marked as a violation.

Prerequisites

• R82.10 Jumbo Hotfix Accumulator Take 19 or higher.

• R82.10 SmartConsole Releases Build 424 or higher.

• A valid Policy Auditor license. For more information, contact Account Services.

Creating Policy Auditor Guidelines

To create Policy Auditor guidelines

1. In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., go to the Security Policies view > Access Control policy > Policy Auditor.

2. Click Create guideline.

   The Policy Auditor editor window opens.

   

3. Enter a name for your set of guidelines.

4. In the General tab:

   1. Click the plus sign (+).

   2. From the drop-down list, add the relevant segments to include in the set of guidelines.

   Each segment is represented by a Network Group object, which is a collection of IP addresses and networks.

   

5. Optional: To create a new group, click the icon.

6. In the Assigned to tab, select the Policy Layer Layer (set of rules) in a Security Policy. to which the guidelines apply.

   Note - You can assign the same set of guidelines to multiple Policy Layers.

7. Click OK.

   Policy Auditor creates a table in which each cell represents traffic between two segments.

   By default, all traffic within a segment is approved (cells marked in green).

   

8. Right-click each cell and select one of these options from the drop-down menu:

   • All traffic is allowed - Allow all traffic between these segments. Do not flag any rule as a violation.

   • All traffic is not allowed - Do not allow traffic between these segments. Flag all Accept rules as violations.

   • Decide later - Do not evaluate rules for this cell.

   

   The set of guidelines is created.

9. To edit the set of guidelines, click Edit in the top-right corner of the screen.

Auditing Policy Rules Based on the Policy Auditor Guidelines

To audit the policy rules based on the Policy Auditor guidelines:

1. In the Policy Layer field above the guidelines, click the drop-down menu to select the Policy Layer you want Policy Auditor to audit.

2. In the top toolbar of Policy Auditor, click Calculate.

   

   Policy Auditor calculates the rules based on the guidelines that you created.

   Note - If you have unpublished changes, Policy Auditor prompts you to Publish $ Calculate.

3. Select a cell in the calculated results.

   Note - You can use the Services search box to filter the results by service

   For each selected cell, the bottom pane of the Policy Auditor window shows these tabs:

   • All rules - All rules associated with the selected cell.

   • Violating rules - Rules that are not according to the guidelines for a specific cell.

   • Approved violations - Violating rules that the administrator approved.

   

4. In the Violating rules tab, to approve a violation:

   1. Select the rule and click Approve violation in the toolbar.

   2. In the window that opens, enter the reason for the approval, and select the scope of approval:

      • This cell only

      • All cells in the guideline from now on

   3. Click OK.

   

5. To modify a rule:

   • You can edit the Source or Destination columns of a rule from the Policy Auditor page. Double-click the applicable network object in the Source or Destination cell and change its value as needed.

     

   • For all other changes, select Go to rule to open the Access Control Rule Base All rules configured in a given Security Policy. Synonym: Rulebase., where you can make the required changes.

Notes: Policy Auditor supports simultaneous changes made by multiple administrators.

Policy Auditor Scheduler

Policy Auditor scheduler automatically recalculates guidelines once every 24 hours. It recalculates all sets of guidelines according to the order in which they were most recently calculated. Each scheduled run operates within a defined time frame that you set. There is a cool down period (the default is 5 minutes) between each calculation of a set of guidelines. In a Multi-Domain environment, Policy Auditor scheduler processes one set of guidelines per Domain at a time.

Configuration Parameters

Parameter	Default value	Description
NGM_MATRIX_SCHEDULER_CRON	01-00 AM	Sets the time when the scheduler runs
NGM_MATRIX_SCHEDULER_DURATION_HOURS	6	Maximum duration of a scheduler run in hours (the maximum value is 23 hours).
NGM_MATRIX_SCHEDULER_WAIT_TIME	300000	Pause between calculations of each set of guidelines in milliseconds (the default is 5 minutes)
NGM_MATRIX_SCHEDULER_MAX_CONCURRENT	3	In a Multi-Domain environment, the maximum number of parallel recalculation tasks
NGM_MATRIX_SCHEDULER_KILL_SWITCH	false	Stops or starts the Policy Auditor scheduler. Set to true to stop the scheduler immediately

Applying Changes

To apply immediate and temporary changes:

Note - These changes take effect immediately, but are lost when the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. restarts.

1. Open an SSH connection to the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

2. Switch to Expert mode.

3. Run:

   /opt/CPsuite-<version_of_management_server>/fw1/scripts/reload_env_vars.sh -e "VARIABLE=value"

To apply persistent and permanent changes:

Note - These changes survive restart of the Security Management Server, but require a reboot to take effect.

1. Open an SSH connection to the Security Management Server.

2. Switch to Expert mode.

3. Run:

   • For a Security Management Server, run:

     $FWDIR/scripts/override_server_setting.sh -e VARIABLE value

   • For a Multi-Domain Server, run:

     $MDS_FWDIR/scripts/override_server_setting.sh -e VARIABLE value

Note - For urgent changes (for example, an emergency stop), use both methods together to apply the changes immediately and make sure they persist.

Examples

Goal	Command
Schedule Policy Auditor calculation to 02:00 AM	reload_env_vars.sh -e "NGM_MATRIX_SCHEDULER_CRON=02-00"
Set the calculation window to 4 hours	reload_env_vars.sh -e "NGM_MATRIX_SCHEDULER_DURATION_HOURS=4"
Emergency stop	reload_env_vars.sh -e "NGM_MATRIX_SCHEDULER_KILL_SWITCH=true"
Resume after stop	reload_env_vars.sh -e "NGM_MATRIX_SCHEDULER_DKILL_SWITCH=false"

Troubleshooting

Symptom	Likely Cause
Scheduler not running	Kill switch is on or invalid the cron expression
Scheduler stops before completing the calculations of all sets of guidelines	The time window is too short. Increase DURATION_HOURS
Tasks are queued but not starting	All slots are occupied, increase MAX_CONCURRENT
Configuration change has no effect	DURATION_HOURS, WAIT_TIME, and MAX_CONCURRENT apply only to the next scheduled run