What happens to packets if Explicit Default Rule is missing?

In Check Point Access Control policies, security rules are evaluated sequentially from top to bottom. If an administrator does not configure an Explicit Default Rule (frequently referred to as a cleanup rule) at the very end of the policy layer, any network packet that fails to match the preceding explicit rules will not simply be ignored. Instead, it will automatically be processed by the system's built-in Implicit Cleanup Rule. By default, this implicit rule is strictly configured to drop all unmatched traffic and log the event. This mechanism ensures that the firewall maintains a secure "default deny" posture, preventing unauthorized traffic from passing through if no specific allow rule exists.

B: Post NAT rules handle network address translation after the routing decision, not the fundamental allow or drop decision of unmatched access control packets.

C: The Implicit Cleanup Rule is an integral part of the Access Control policy itself, not a separate feature located after the policy evaluation.

D: Packets are never ignored by the firewall; if no explicit rule matches, the Implicit Cleanup Rule acts as a safety net to enforce a drop action.

1. Check Point R82 Security Management Administration Guide, "Access Control Policy" chapter, Section: Implicit Rules.

2. Check Point R82 CoreXL and Firewall Architecture Guide, "Rule Base Evaluation".