Understanding TPH Checkpoints In Practice
TPH checkpoints come up when people try to audit their threat prevention layer configurations at scale. I first ran into them while reviewing a client's environment that had layered IPS signatures, vulnerability protection policies, and gateway-level inspection all running simultaneously. The real problem wasn't configuring a single rule — it was tracing which checkpoint was actually dropping traffic versus which one was letting it through for logging purposes. Most documentation treats TPH checkpoints as a theoretical concept. The reality is they're implementation artifacts inside your firewall or security gateway policy. When you open a threat prevention profile in Check Point or a similar enterprise platform, each inspection stage gets assigned a checkpoint number. Traffic hits checkpoint one, then checkpoint two, and so on. A rule might block at checkpoint three while another only triggers at checkpoint six.
Unlocking The Secrets Of Thp Checkpoints The Key To Mastering Network Security
The trick most people miss is that checkpoint order matters more than the individual rules themselves. I learned this the hard way during a migration where I copied a threat prevention policy verbatim from one gateway to another. The logs looked clean on the destination, but external scanners kept finding exploitable services. I spent three days chasing false positives before I realized the checkpoint numbering had shifted between the two gateway versions. The same rule that previously blocked at checkpoint four was now evaluating at checkpoint seven, after the service detection layer had already classified the traffic as allowed. To work with TPH checkpoints effectively, start by pulling the full inspection order for your specific gateway version. The order varies between major releases. Check Point R80.40 handles them differently than R81.20, and R81.30 changed the sequence again for certain exploit prevention categories. Here is what actually works in a real audit:
Export your current threat prevention policy using cpstat -f fwver to confirm your build, then pull the inspection order table from the vendor documentation specific to that build. Cross-reference every enabled rule against the checkpoint it fires at. Rules that sit after service classification checkpoints are almost always too late to stop an initial exploitation attempt. They catch the payload, but the connection is already established. I use a Python script that parses the exported policy XML, maps each rule to its checkpoint number, and flags any blocking rules that appear after checkpoint six in the standard inspection pipeline. This catches misordered rules in about ten minutes for a medium-sized policy. Doing it by hand takes most engineers a full day and they still miss something. There are edge cases where the checkpoint approach breaks down entirely. Stateless threat prevention profiles don't track connections across checkpoints the way stateful ones do. If you're running stateless inspection on a high-throughput link, checkpoint ordering becomes mostly theoretical because the engine evaluates each packet in isolation. You will see elevated CPU usage from repeated signature matching and your actual blocking effectiveness drops significantly. In those environments, I recommend switching to a stateful baseline or offloading threat inspection to a dedicated inline device before the traffic reaches the checkpoint-heavy gateway.
Get the Full Details
Another issue: some third-party integrations, like custom threat intelligence feeds or SIEM forwarding rules, attach additional checkpoints outside the main pipeline. These don't appear in the standard inspection order table. I once had a rule silently bypassing a vulnerability protection checkpoint because a custom integration had registered at a later stage and marked the traffic as trusted based on an outdated reputation score. The fix was removing the custom integration checkpoint and rebuilding the trust chain with explicit allow-lists instead of reputation-based shortcuts. If you want a practical starting point for auditing your own environment, pull your threat prevention logs filtered by action=allowed and inspect the checkpoint field in each entry. Look for patterns where multiple checkpoints evaluate the same connection with different verdicts. Those are the spots where your policy has conflicting rules, and usually the later checkpoint wins because of how the evaluation loop terminates. The checkpoint numbering system is not intuitive and it changes between releases. That is the actual secret behind TPH checkpoints — not that they are complex, but that most people configure them once and never revisit the ordering when they upgrade. A policy that worked fine at checkpoint level three can become partially invisible at checkpoint level five after a patch. Schedule a checkpoint order review every time you apply a major version update. It takes roughly an hour and catches the kind of silent misconfiguration that shows up later as a breached service you can't explain.
