> Source: [sk1000095](https://support.checkpoint.com/results/sk/sk1000095) # sk1000095 - Centralized .def Settings Management Using SmartConsole and the Management API | Property | Value | |----------|-------| | Solution ID | sk1000095 | | Date Created | 2026-09-01 | | Last Modified | 2026-11-03 | | Technical Level | General | | Products | Security Management Server, Multi-Domain Security Management Server | | Versions | R82.20 | | OS | Gaia | ## Solution **Table of Contents:** * Overview * Procedure for Web SmartConsole * Procedure for Desktop SmartConsole * Concepts * Available Data Types for Def Settings * Predefined Def Settings * Limitations * Important Notes * Converting Customizations Documented in SK Article to new Def Settings ### Overview {#TOC01} An administrator configures Security Policy and other inspection settings in SmartConsole or with the Management API. During a policy installation, the Management Server creates the applicable files and transfers them to the target Security Gateways. The Management Server creates these files based on: * Security Policy in SmartConsole. * Global properties in SmartConsole. * Security Gateway properties. * Multiple configuration files on the Management Server that control the inspection of various network protocols. It is possible to modify these inspection configuration files on the Management Server to fine-tune the inspection in your network. **In versions R82.10 and lower:** > An administrator can override the default inspection configuration files only by editing the relevant `*.def` files on the Management Server. **Starting in the R82.20 version:** > An administrator can override the default inspection settings directly in SmartConsole and with the Management API. > > These settings are stored centrally in the Management Server database. > > This enables full auditing and revision history, centralized management, and seamless persistence across upgrades and backups. > > When you publish the session, the relevant `*.def` files are updated automatically on the Management Server. For more information about the `*.def` files, refer to the Security Management Administration Guide / Multi-Domain Security Management Administration Guide \> section "Configuring Implied Rules or Kernel Tables for Security Gateways". ### Procedure for Web SmartConsole {#TOC02} **Prerequisite:** Web SmartConsole Take 180 and higher (see [sk170314](https://support.checkpoint.com/results/sk/sk170314)). 1. With a web browser, connect to the Web SmartConsole on the Security Management Server / relevant Domain Management Server: `https:///smartconsole` 2. On the left navigation panel, click **Manage \& Settings**. 3. In the left panel, click **Blades**. 4. Click the **.def Overrides** button. ![SmartConsole - Security Gateway object - Device Status - Logging](https://static.checkpoint.com/apps/sk/1000095/f9cbe635-0abe-4285-9a57-aea9b20459f5.png) 5. Configure the applicable settings. See the section "Concepts" below. 6. Publish the session. 7. Install the Access Control Policy. 8. Install the Threat Prevention Policy. ### Procedure for Desktop SmartConsole {#TOC03} **Prerequisite:** [R82.20 SmartConsole Releases](https://support.checkpoint.com/results/sk/sk170314) - Build 200 and higher. 1. Connect with SmartConsole to the Security Management Server / relevant Domain Management Server. 2. On the left navigation panel, click **Manage \& Settings**. 3. In the left panel, click **Blades**. 4. In the **General** section, click **.def Overrides**. 5. Configure the applicable settings. See the section "Concepts" below. 6. Publish the session. 7. Install the Access Control Policy. 8. Install the Threat Prevention Policy. ### Concepts {#TOC04} The feature introduces two related object types: #### (A) Def Setting - the "key" | Field (API) | Description | |-----------------|----------------------------------------------------------------------------------------------------------------------| | **name** | The definition key. It matches the historical variable name in a `*.def` file. For example: `tcp_urgent_ports_user`. | | **data-type** | One of: `boolean`, `integer`, `string`, or `list`. | | **comments** | A human-readable description. For predefined settings, it is pre-filled. | | **custom** | `true` for user-defined keys. `false` for predefined settings supplied with the product. | | **assignments** | One or more assignments, as described below. | #### (B) Assignment - the "value" applied to a target | Field (API) | Description | |-------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **value** | The value to apply. It must match the Def Setting's "`data type`". | | **description** | A free-text note describing the assignment. | | **targets** | One or more names of the Security Gateway objects. Omit this field for a **global** assignment that applies to all Security Gateways. | | **model** | * `all` (default) * `quantum` (all Check Point Firewalls except Spark Firewall) * `spark` (only Spark Firewall) Restricts the assignment to a specific gateway family. | | **from-version / to-version** | The software version range to which the assignment applies. Example 1: `R80`--`R82` Example 2: `EARLIEST--LATEST` It determines which generated files contain the setting. | | **position** | The assignment priority, similar to a rule number in a rulebase. **Position 1 has the highest priority and takes precedence.** | | **enabled** | Determines whether the assignment is active. The default assignment of a predefined setting is **disabled** . Enable it or add an assignment to activate the behavior. | ### Available Data Types for Def Settings {#TOC05} | Data Type | Accepted Value | Example | |-----------|-----------------------------------------------------------------------------------|--------------------------------| | `boolean` | `true` or `false` | `true` | | `integer` | A whole number | `25000` | | `string` | Free text | `sync expires 60` | | `list` | One or more `<...>` tuples, separated by commas and optionally enclosed in `{ }`. | `{ <514;URGENT_DATA_INLINE> }` | ### Predefined Def Settings {#TOC06} The following **Def Settings** are predefined. #### (A) Predefined Def Settings based on the "`user.def`" file | Def Setting | Description | Data Type | Default Value | SK Article | |-----------------------------------|-----------------------------------------------------------------------------------|-----------|------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------| | `DISABLE_CPMI` | Disables CPMI management traffic from implied rules to force encryption over VPN. | `boolean` | `false` | [sk105719](https://support.checkpoint.com/results/sk/sk105719) | | `DISABLE_LDAP_SERVER` | Disables the implied rule for LDAP server traffic. | `boolean` | `false` | [sk26059](https://support.checkpoint.com/results/sk/sk26059) | | `DISABLE_RADIUS_SERVER` | Disables the implied rule for RADIUS/SecurID traffic. | `boolean` | `false` | [sk31692](https://support.checkpoint.com/results/sk/sk31692) | | `ENABLE_MGMT_HA_OVER_VPN` | Enables Management High Availability traffic over VPN. | `boolean` | `false` | [sk43091](https://support.checkpoint.com/results/sk/sk43091) | | `DISABLE_FWD_LOG` | Disables the implied rule for forwarding logs. | `boolean` | `false` | [sk111954](https://support.checkpoint.com/results/sk/sk111954) | | `DISABLE_PORTAL_HTTP_REDIRECT` | Disables the Mobile Access HTTP portal redirect. | `boolean` | `false` | [sk165937](https://support.checkpoint.com/results/sk/sk165937), [sk105740](https://support.checkpoint.com/results/sk/sk105740) | | `DISABLE_TACACS_SERVER` | Disables the implied rule for TACACS+ traffic. | `boolean` | `false` | [sk92262](https://support.checkpoint.com/results/sk/sk92262) | | `EXCLUDE_TRAFFIC_FROM_SecureXL` | Excludes selected traffic from SecureXL acceleration. | `list` | `{ <10.0.0.0, 10.0.0.255>, <192.168.0.0, 192.168.0.255> }` | [sk104468](https://support.checkpoint.com/results/sk/sk104468) | | `DNS_REVERSE_CACHE_TBL_SIZE` | Increases the reverse DNS cache table size. | `integer` | `25000` | [sk157493](https://support.checkpoint.com/results/sk/sk157493) | | `FW_UDP_REMATCH_SERVICES` | Refreshes UDP connections for selected services. | `list` | `{ <5060>, <5063> }` | [sk121933](https://support.checkpoint.com/results/sk/sk121933) | | `SITE_TO_SITE_GRE_TUNNEL` | Enables GRE over a Site-to-Site VPN. | `boolean` | `false` | [sk90060](https://support.checkpoint.com/results/sk/sk90060) | | `NO_MISP_SERVICES_PORTS_TABLE` | Excludes selected services from ISP Redundancy balancing. | `list` | `{ <500,17>, <259,17> }` | [sk97968](https://support.checkpoint.com/results/sk/sk97968), [sk32225](https://support.checkpoint.com/results/sk/sk32225) | | `no_misp_incoming_services_ports` | Excludes selected incoming services from ISP Redundancy routing decisions. | `list` | `{ <5060,17> }` | [sk89320](https://support.checkpoint.com/results/sk/sk89320) | #### (B) Predefined Def Settings based on the "`table.def`" file | Def Setting | Description | Data Type | Default Value | SK Article | |--------------------------------------|----------------------------------------------------------------------------------------------|-----------|-----------------------------------------------------------|----------------------------------------------------------------| | `NO_FOLD_SERVICES_PORTS_TABLE` | Excludes selected services from NAT port folding. | `list` | `{ <4500,17>, <500,17>, <259,17>, <1701,17> }` | [sk98839](https://support.checkpoint.com/results/sk/sk98839) | | `NO_HIDE_SERVICES_PORTS_TABLE` | Exempts selected VPN UDP ports from NAT Hide translation. | `list` | `{ <4500,17>, <500,17>, <259,17>, <1701,17>, <5500,17> }` | [sk98839](https://support.checkpoint.com/results/sk/sk98839) | | `FW_DCERPC_MAP_PORTS_TABLE` | Defines the DCE-RPC endpoint mapper control ports. | `list` | `{ <135> }` | [sk66605](https://support.checkpoint.com/results/sk/sk66605) | | `CLIENT_AUTH_TABLE` | Tracks authenticated client connection state entries. | `string` | `sync expires 60` | [sk40731](https://support.checkpoint.com/results/sk/sk40731) | | `ALLOWED_IPOPTS_PROTO_TABLE` | Defines the protocol and IP-option pairs explicitly permitted for IGMP/PIM and Router Alert. | `list` | `{ <2,148>, <103,148> }` | [sk62082](https://support.checkpoint.com/results/sk/sk62082) | | `HIDE_BEHIND_LOW_PORTS_TABLE` | Defines services that use low source ports during Hide NAT. | `list` | `{ <512,514>, <515,515> }` | [sk120481](https://support.checkpoint.com/results/sk/sk120481) | | `DYNAMIC_IPSEC_SOURCE_ADDRESS_TABLE` | Maps an inbound IKE peer IP address to the receiving local Security Gateway IP address. | `string` | `sync keep expires EX_INFINITE` | [sk160672](https://support.checkpoint.com/results/sk/sk160672) | ### Limitations {#TOC07} * Predefined Def Settings can be assigned only to "All Gateways", not to specific Security Gateways. * A Def Setting assigned to a specific Security Gateway cannot also be assigned to "All Gateways". * Defining the `NON_VPN_TRAFFIC_RULES` setting through SmartConsole or the Management API is currently unsupported because of its unique syntax. * The following settings cannot currently be defined as custom settings through SmartConsole or the Management API: xlate_use_dport_services, allowed_ipv6_extension_headers, dcerpc_static_ports, dcerpc_static_ports_uuid, vs_management_list, voip_codecs_length_tab. Support for these settings will be added in a future Jumbo Hotfix Accumulator. ### Important Notes {#TOC08} * Always publish the session after a change. The `*.def` files are regenerated only during the "Publish" action. * Do not edit the generated files (`UI_config.def`, `UI_config.def.*CMP`) manually. Changes are overwritten during the next Session Publish. * On a Multi-Domain Security Management Server, you configure the settings in the context of each Domain. * Custom keys that have no predefined object can still be created as custom Def Settings. This is the exact replacement for the historical "write it into user.def" instruction. ### Converting Customizations Documented in SK Article to new Def Settings {#TOC09} The **Predefined Def Settings** tables above cover the settings supplied as predefined objects. There are SK articles that describe customizations that historically required an administrator to manually edit the `*.def` files. These customizations can use the same Def Setting workflow. If the setting is not predefined: 1. Create the key once as a custom Def Setting 2. Add an **Assignment** with the required value and targets. 3. **Publish** the changes. The corresponding configuration is automatically written to the applicable "`UI_config.def`" files. On a Multi-Domain Security Management Server, the configuration is generated separately for each Domain. **Note** - Some SK articles also include steps that are not related to the `*.def` files on the Management Server, such as configuring kernel parameters in the `fwkern.conf` file, making changes in Database Tool (GuiDBedit Tool), or installing a hotfix. These steps remain unchanged and are outside the scope of Def Settings. Only the manual configuration of the `*.def` files is replaced. #### Example 1 - Custom "`list`" with a per-target assignment > Show / Hide this section > This example is based on [sk30919](https://support.checkpoint.com/results/sk/sk30919). > > In the previous `user.def` format, the prefix "`all@`" applied the setting to a specific Security Gateway. > > With new Def Settings: > > * To apply the configuration to a specific Security Gateway: > > Specify the Security Gateway object as the "**targets** " in the "**Assignment**". > * To apply the configuration to all Security Gateways: > > Omit the "**targets** " in the "**Assignment**". > > **Previous configuration in the `user.def` file:** > > `all@gw1 om_per_src_range={ <10.10.5.0, 10.10.5.129; 1.1.1.5, 1.1.1.87> };` > > **New configuration with the Management API:** > > 1. Configure the required settings: > > `mgmt_cli add def-setting name "om_per_src_range" data-type "list" \` > ` > assignments.1.targets.1 "gw1" \` > ` > assignments.1.value "<10.10.5.0, 10.10.5.129; 1.1.1.5, 1.1.1.87>" \` > ` > --format json` > 2. Publish the session: > > `mgmt_cli publish` > 3. Install the Access Control policy on the Security Gateway "`gw1`": > > `mgmt_cli install-policy policy-package "MyPolicy" access true threat-prevention true targets.1 "gw1"` > > **New configuration in SmartConsole:** > > 1. Click "**Add custom def setting**": > > > ![](https://static.checkpoint.com/apps/sk/1000095/82310d85-77d3-43fb-828a-a3ffed67a466.png) > 2. In the "**New Setting**" window: > > 1. Enter the name "**om_per_src_range**". > > 2. In the "**Type** " field, select "**Inspect List**". > > 3. Click "**Add gateway assignment**". > > > ![](https://static.checkpoint.com/apps/sk/1000095/18d9b816-d74d-4207-a61e-af540558e628.png) > 3. In the "**New Gateway assignment**" window: > > 1. In the "**Value** " field, enter: `<10.10.5.0, 10.10.5.129; 1.1.1.5, 1.1.1.87>` > > 2. Select "**Specific Gateways**". > > 3. Click "**+**" and select the relevant Security Gateway objects. > > 4. Click "**Save**". > > > ![](https://static.checkpoint.com/apps/sk/1000095/abe6c79e-3df8-4932-b80e-1518aa6cfe78.png) > 4. In the "**New Setting**" window: > > Click "**OK**". > 5. Publish the session. > > 6. Install the Access Control policy. #### Example 2 - Pre-defined "`list`" with "All Gateways" assignment > Show / Hide this section > This example is based on [sk98839](https://support.checkpoint.com/results/sk/sk98839). > > **Previous configuration in the `table.def` file:** > > `no_hide_services_ports = { <4500,17>, <500,17>, <259,17>, <1701,17>, ..., <68,17>, <67,17> };` > > **New configuration with the Management API:** > > 1. Configure the required settings: > > `mgmt_cli set def-setting name "no_hide_services_ports_table" \` > ` > assignments.add.enabled true \` > ` > assignments.add.value "<4500,17>,<500,17>,<259,17>,<1701,17>,<5500,17>,<514,17>" \` > ` > --format json` > 2. Publish the session: > > `mgmt_cli publish` > 3. Install the Access Control policy on the relevant Security Gateways > > `mgmt_cli install-policy policy-package "MyPolicy" access true threat-prevention true targets.1 "gw1" targets.2 "gw2"` > > **New configuration in SmartConsole:** > > 1. Click "**Add an assignment**": > > ![](https://static.checkpoint.com/apps/sk/1000095/4b12e796-fe98-4180-b769-214c086ec090.png) > 2. In the "**New Setting**" window: > > 1. Name and type are already selected. > > 2. Click "**Add gateway assignment**". > > ![](https://static.checkpoint.com/apps/sk/1000095/4540a411-1dba-4b76-a867-bd468e68bb81.png) > 3. In the "**New Gateway assignment**" window, the default "Name", "Comments" and "Value" fields are loaded automatically : > > ![](https://static.checkpoint.com/apps/sk/1000095/db0160ab-e10f-42ee-b445-a4989fcad40c.png) > 4. Click "**OK**". > > 5. Publish the session. > > 6. Install the Access Control policy. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content