> Source: [sk184933](https://support.checkpoint.com/results/sk/sk184933)

# sk184933 - Implied Rule Allows Web and SSH Access from Internet to Spark Firewall

| Property | Value |
|----------|-------|
| Solution ID | sk184933 |
| Date Created | 2026-05-08 |
| Last Modified | 2026-05-16 |
| Technical Level | Advanced |
| Products | Spark Firewall (Locally Managed) |
| Versions | R82.00.X, R81.10.X |
| Platform | 1500, 1900 |

## Symptoms

- * Spark Firewall accepts SSH and HTTPS management connections from external IP addresses.

* Firewall logs show HTTP, HTTPS, or SSH traffic allowed by the implied rule.

* Management portals are reachable from the internet even when a stealth rule exists.

## Cause

This behavior occurs due to the following configuration combination:

1. A public IP address is assigned to a LAN interfance in the appliance WebUI.

   The appliance classifies this interface as *internal*.
2. Administrator access is allowed only on LAN interfaces

   (**Device** \> **System** \> **Administrator Access**).
3. The Spark Firewall implied administrative rule is enabled in SmartConsole

   (**Global Properties** \> **Firewall** \> **Implied Rules**).

The implied rule allows HTTP, HTTPS, and SSH access from networks considered internal.

This rule is evaluated **before** user-defined Firewall rules, including stealth rules.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content