FireWall-1 FAQ: Single Rulebase for Multiple Firewalls?
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
Having one rulebase for all your firewall versus a single rulebase have their plusses and minuses.
If each firewall has a different rulebase file, it is fairly easy to see what security policy is on an individual firewall. Also, it is far easier to specify whether or not a rule is enforced inbound, outbound, or eitherbound. On the other hand, it is possible to install the wrong rulebase on the wrong firewall, thus causing an outage on an individual firewall. Also, if you have to make global changes, you have to change each individual security policy file.
A single rulebase is slightly more difficult to maintain. On the other hand, you can see your entire site’s security policy at a glance and it does prevent snafus that occur from installing the wrong rulebase on the wrong firewall. Only the rules that apply to a specific gateway will be installed there. On the downside, when you list specific gateways in the Install-On field, rules are enforced in the eitherbound direction (i.e. they must pass through the rulebase twice). This is only usually noticable with large rulebases on heavily-loaded systems.
If you are going to go with a single security policy file for multiple firewalls, here are my hints:
- Rules that apply to “all” firewalls should have the install-on be listed as gateways (e.g. any any any drop)
- Potentially busy rules on all firewalls should be installed on gateways to increase performance (even if a particular firewall can’t enforce the rule).
