David Strom wrote:
Not quite, with X11. I had a long, drawn-out discussion about this new
"feature" with Checkpoint support, even got bumped back to Israel for
in-depth explanation. Checking the "Match for Any" box is the default
for X11, iirc, and it won't help in NG FP3 and later.
Basically, new with NG FP3, X11 protocol is *blocked* when you have a
rule for allowing "Any" service. Yes, this is totally different from
anything else that FW-1 does. This is documented in the release notes
for NG FP3. If you want to allow services in the 6000 range of ports
(overlapping the X11 range), you must add a rule *above* the "allow any"
services rule. Note that there is a pretty good description in the
Tracker (Log Viewer) when packets are blocked, but no reference to the
rule number associated with this block (the allow any rule).
The rule number given in the log entry is the "Any" rule which blocked
the connection.
One
argument I had with Checkpoint was that the Log should show the rule
number which caused the X11 block, even though unintended by the FW
administrator, so that if the FW admin WANTS X11 ports to be allowed,
he/she would see what rule number to put the allow X11 (or other
6000-range ports) *above*. Lost the argument, but they may have added
it to the RFE list.
In the R55 Tracker, it's in the "Rule" column just like any other log
entry.
This new X11 "feature" is actually not sane behavior, IMO, but I suspect
there aren't too many FW-1 customers who really want to allow X11 traffic.
Probably because so many FW-1 administrators do not understand how X11
works. The machine that you are sitting at is the SERVER and the remote
machine is the CLIENT. If you telnet into a remote machine, you have a
telnet client at your desk connecting to the remote telnet server. When
you then start an xterm on the remote machine, the xterm is the CLIENT
and your machine's X server is the SERVER. It's the reverse of the
telnet situation and too much for many sysadmins-stuck-being-network-
security-admin-too to wrap their head around.
--
Crist J. Clark [EMAIL PROTECTED]
Globalstar Communications (408) 933-4387
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
