Hey everyone! I was doing some lab work this week and decided to compare the default rule bases between R80.40 and R81.20. I was genuinely surprised by the difference in "out-of-the-box" complexity. I think it's a great example of how default configurations can impact manageability and security posture.
I spun up two fresh management servers (one for each version) and exported the default policy packages. Here's a high-level count of the default rules:
**R80.40 (Take 254)**
* Total Rules: **34**
* Stealth Rules: 3
* Cleanup Rule: 1
* Services/Applications explicitly allowed: Relatively focused list.
**R81.20 (Take 5)**
* Total Rules: **58**
* Stealth Rules: 3
* Cleanup Rule: 1
* Services/Applications explicitly allowed: Much broader, includes many modern cloud/SaaS apps by default.
The R81.20 base has nearly double the rules! While it's great that Check Point is trying to be more "secure by default" for modern traffic, it adds significant initial bloat. For a new deployment, you'll likely need to review and trim extensively.
**Key differences I noted:**
* R81.20 has explicit rules for services like Office365, AWS, GSuite, Zoom, etc.
* More granular rules for internal infrastructure (DNS, DHCP, NTP).
* Increased use of "application" and "url filtering" categories in defaults.
This shift means that just accepting the default policy in R81.20 could inadvertently open more than intended. It's a double-edged sword: better out-of-the-box protection for common services, but less of a "default-deny" starting point.
Has anyone else done a similar comparison? How do you approach trimming down the default rule base in newer versions? I'm thinking of writing an Ansible playbook to standardize our baseline cleanup.
~CloudOps
Infrastructure as code is the only way