In R54, the "drop" log entry did not display any rule number (blank), so thanks for the update that R55 fixed this.
Crist Clark wrote:
David Strom wrote:
Not quite, with X11. I had a long, drawn-out discussion about this new "feature" with Checkpoint support, even got bumped back to Israel for in-depth explanation. Checking the "Match for Any" box is the default for X11, iirc, and it won't help in NG FP3 and later.
Basically, new with NG FP3, X11 protocol is *blocked* when you have a rule for allowing "Any" service. Yes, this is totally different from anything else that FW-1 does. This is documented in the release notes for NG FP3. If you want to allow services in the 6000 range of ports (overlapping the X11 range), you must add a rule *above* the "allow any" services rule. Note that there is a pretty good description in the Tracker (Log Viewer) when packets are blocked, but no reference to the rule number associated with this block (the allow any rule).
The rule number given in the log entry is the "Any" rule which blocked the connection.
One argument I had with Checkpoint was that the Log should show the rule number which caused the X11 block, even though unintended by the FW administrator, so that if the FW admin WANTS X11 ports to be allowed, he/she would see what rule number to put the allow X11 (or other 6000-range ports) *above*. Lost the argument, but they may have added it to the RFE list.
In the R55 Tracker, it's in the "Rule" column just like any other log entry.
This new X11 "feature" is actually not sane behavior, IMO, but I suspect there aren't too many FW-1 customers who really want to allow X11 traffic.
Probably because so many FW-1 administrators do not understand how X11 works. The machine that you are sitting at is the SERVER and the remote machine is the CLIENT. If you telnet into a remote machine, you have a telnet client at your desk connecting to the remote telnet server. When you then start an xterm on the remote machine, the xterm is the CLIENT and your machine's X server is the SERVER. It's the reverse of the telnet situation and too much for many sysadmins-stuck-being-network- security-admin-too to wrap their head around. -- Crist J. Clark [EMAIL PROTECTED] Globalstar Communications (408) 933-4387
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
