Thanks to all those who responded. Yes, I was aware that topology download is supposed to require authentication. But was have now had two audits done on this system and on both occasions they have claimed they can access topology information via the FW1_topo port - without me having supplied them with any authentication details.
I am happy to follow their recommendation and block this port (I don't need it for SecuRemote) - but there seems no way to do this without disabling all "VPN-1 and Firewall-1 Control Connections" via the global properties. Is there a list anywhere of which ports are included in this global properties setting? Or advice on how to disable it while ensuring IPSEC "site-to-site" VPNs continue to work? For reference, the peer devices for these VPNs are Draytek Vigor 2600-series ADSL routers, using IKE with DES3 encryption. Any further advice gratefully received... Simon Ashford. -- Simon J. Ashford, Email: [EMAIL PROTECTED] IT Support Unit Tel: +44 (0)20 8943 7032 National Physical Laboratory, Fax: +44 (0)20 8943 7093 Teddington, Middlesex, UK. WWW: http://www.npl.co.uk/ > -----Original Message----- > From: Simon Ashford [mailto:[EMAIL PROTECTED] > Sent: 05 February 2004 21:26 > To: [EMAIL PROTECTED] > Subject: [FW-1] Disabling certain Firewall-1 "control connections" > ports. > > > Hello, > > In a recent security audit, I was advised to disable external > access to TCP port 264 (FW1_topo) because it could be used to > extract detailed network topology information from my firewall. > > So far the only way I found to do this was to disable "Accept > VPN-1 & Firewall-1 control connections" in the Global Properties > pane. But if I do this, then all my IPSEC VPNs also stop working. > > I tried adding a rule to allow specific IKE and IPSEC packets > through, but this didn't appear to work. In the log it says > "encryption failure: received a cleartext packet within an > encrypted connection" at the start of any IKE negotiation. > Ths is logged against the rule I created specifically to allow > IKE. > > Can anyone suggest a way to make this work? > > > Thanks in advance for any help. > > > Simon Ashford. > > > -- > Simon J. Ashford, Email: [EMAIL PROTECTED] > IT Support Unit Tel: +44 (0)20 8943 7032 > National Physical Laboratory, Fax: +44 (0)20 8943 7093 > Teddington, Middlesex, UK. WWW: http://www.npl.co.uk/ > > ------------------------------------------------------------------- > This e-mail and any attachments may contain confidential and/or > privileged material; it is for the intended addressee(s) only. > If you are not a named addressee, you must not use, retain or > disclose such information. > > NPL Management Ltd cannot guarantee that the e-mail or any > attachments are free from viruses. > > NPL Management Ltd. Registered in England and Wales. No: 2937881 > Registered Office: Teddington, Middlesex, United Kingdom TW11 0LW. > ------------------------------------------------------------------- > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ------------------------------------------------------------------- This e-mail and any attachments may contain confidential and/or privileged material; it is for the intended addressee(s) only. If you are not a named addressee, you must not use, retain or disclose such information. NPL Management Ltd cannot guarantee that the e-mail or any attachments are free from viruses. NPL Management Ltd. Registered in England and Wales. No: 2937881 Registered Office: Teddington, Middlesex, United Kingdom TW11 0LW. ------------------------------------------------------------------- ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
