> Source: [sk39623](https://support.checkpoint.com/results/sk/sk39623)

# sk39623 - Why does a rule allowing "Any" service not actually allow every service?

| Property | Value |
|----------|-------|
| Solution ID | sk39623 |
| Date Created | 2009-04-14 |
| Last Modified | 2018-07-01 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.20 |

## Solution

**Match for Any** option in the Advanced tab of each service indicates whether this service is used when 'Any' is set as the rule's service and there are several service objects with the same source port and protocol.

When there is a rule whose Service cell contains Any, and a connections protocol and source port match more than one service object, then the service object with the selected 'Match for Any' option will be used and its properties will be taken for handling this connection

When a rulebase contains a single security rule that allows any traffic between any source and destination, all traffic will go through (unless dropped or rejected by some advanced security checks like IPS, or failures in chain modules other than FireWall-1).

*Example of such security rule from R80.x SmartDashboard*:
>
> |-----|---------|-------------|---------|--------------------------|---------|----------|--------|-----------------------------------|-------|
> | No. | Source  | Destination | VPN     | Services \& Applications | Data    | Action   | Track  | Install On                        | Time  |
> | 1   | `* Any` | `* Any`     | `* Any` | `* Any`                  | `* Any` | `Accept` | `None` | Security Gateway / Cluster object | `Any` |

*Example of such security rule from R77.x SmartDashboard*:
>
> |-----|--------|-------------|---------------|---------|----------|--------|-----------------------------------|-------|
> | No. | Source | Destination | VPN           | Service | Action   | Track  | Install On                        | Time  |
> | 1   | `Any`  | `Any`       | `Any Traffic` | `Any`   | `Accept` | `None` | Security Gateway / Cluster object | `Any` |

When a rulebase contains more than one security rule, the definition for "`Any`" service is different.

When there is a rule whose "Service" column contains "`Any`", and a connections protocol and source port match more than one service object, then the service object with the enabled "`Match for Any`" option will be used, and its properties will be taken for handling this connection.

* The connection will get the timeout defined for this service, and not the default TCP / UDP timeout.
* The connection will be handled by this service handler, and not as a simple TCP / UDP connection.
* The connection will be registered with this service's match flags, and not default match flags.

For example: If the "`Match for 'Any'`" option is enabled in the service "`ftp`", then TCP connections on port 21 that are accepted by such security rule will be treated as FTP connections, and not as 'simple' connections on TCP port 21. These connection will get the timeout and the advanced properties defined the "`ftp`" service, and not the ones in the "Global Properties" -\> "Stateful Inspection". These connections will be inspected as FTP - i.e., looking for PORT / PASV command, etc.

**Related solution:** [sk65200 - How to list all services with enabled "Match for Any" option](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk65200)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content