Re: checkpoint authentication on external interface
Francois Yang <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.wizards |
|---|---|
| Message-ID | <[email protected]> |
It is accepting the packets. I can get to the page from the outside world. I don't see any logs for bad attempts. I can sit here all day and put in bad passwords. Frank On Tue, Aug 25, 2009 at 6:28 AM, Jacson Querubin<[email protected]> wrote: > Frank, > > The Checkpoint FW1 Gateways don't accept to apply the rule base from > external interface. > > you can always do a fw monitor to see if it is droping or accepting the packets. > > cheers > > Jacson > > On Mon, Aug 24, 2009 at 13:21, Francois Yang<[email protected]> wrote: >> I have looked at the implied rules and I do have an explicit rule to >> deny all and I don't see anything that would allow this connection. >> I even created a rule to block this and put it at the top and still >> don't see any changes. >> >> To answer the other emails, Yes, I'm sure I could put an ACL in the >> front router to block access, but I was hoping to find a better >> solution. >> >> Frank >> >>>> >>>> >>> >>> Hi Frank, >>> Even if the daemon is listening on the port, you still have to go through >>> the rulebase to be able to connect. >>> You should verify if the ports are allowed either in implied or explicit >>> rules. (try to enable the logs on the implied rules >>> for a short time to get some logs about the auth). >>> >>> I recommend to use explicit rules and allow only from explicit sources. >>> >>> I agree it's better if the daemon accepts connections only on internal IPs, >>> but for this you have to ask checkpoint how to do. >>>> >>>> thanks >>>> >>>> Frank >>>> _______________________________________________ >>>> firewall-wizards mailing list >>>> [email protected] >>>> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards >>>> >>>> >>> >>> >>> _______________________________________________ >>> firewall-wizards mailing list >>> [email protected] >>> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards >>> >> >> >> >> -- >> If you spend more on coffee than on IT security, you will be hacked. >> What's more, you deserve to be hacked. — White House Cybersecurity >> Advisor, Richard Clarke >> _______________________________________________ >> firewall-wizards mailing list >> [email protected] >> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards >> > _______________________________________________ > firewall-wizards mailing list > [email protected] > https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards > -- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. — White House Cybersecurity Advisor, Richard Clarke _______________________________________________ firewall-wizards mailing list [email protected] https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards