Gary,
Outlook is designed to communicate with Exchange Server through LAN, not
Internet... If you want to extend your LAN by means of Secure Client, this
won't leave you exposed just for letting "any" in the Service field of the
desktop security policy. Anyway, hacking into mail server seldom passes
through RPC (apart from Blaster vulnerability), but would normally take
place by means of SMTP vulnerabilities. Another point: blaming Microsoft for
copying a poorly designed UNIX scheme seems unfair... This time, it's a UNIX
fault (ported under Windows).
The two ports you registered are, indeed, random ports above 1023 ("high"
ports).thus, they might change on a per-session basis.
there are tricks to force the use of a narrower range of ports, tweaking the
registry on the server. It will have drawbacks, since it's a way to force a
protocol to operate under constraints that weren't there at design time.
----- Original Message -----
From: "Brett, Gary" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, March 10, 2004 2:04 PM
Subject: Re: [FW-1] SecureClient - Outlook and Exhange
> Thanks NA, so what youre saying is, the tcp 1053 and tcp 1068 that I keep
> getting are RANDOM ports and will inevitably change at some point to other
> random ports ? If thats the case then I am shocked that microsoft have
> designed it like this, and they wonder why there mail products are subject
> to so much hacking !
>
>
>
> -----Original Message-----
> From: Not Available [mailto:[EMAIL PROTECTED]
> Sent: 10 March 2004 12:52
> To: [EMAIL PROTECTED]
> Subject: Re: [FW-1] SecureClient - Outlook and Exhange
>
>
> Well, try sniffing the traffic between client (outlook) and server
> (exchange) and you will discovre in horror what RPC is.
> There are two main "flavors" of RPC: the UNIX (named RPC) and the Windows
> (DCE-RPC). The basic idea is the same: use a fixed port (111/UDP and
111/TCP
> for UNIX, 135/TCP for Windows) to negotiate a random, high port onto which
> perform the true data connection.
> Yes, RANDOM port. Checkpoint somehow handles RPC and DCE-RPC, but I have
> NEVER been able to set it up reliably. In those cases, I'd rather stick to
> "any".
>
> For the naming resolution of services, Checkpoint uses its internal
database
> as well as the /etc/services file.
>
> Hope this helps
>
> NA
>
>
> ----- Original Message -----
> From: "Brett, Gary" <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Sent: Wednesday, March 10, 2004 12:56 PM
> Subject: [FW-1] SecureClient - Outlook and Exhange
>
>
> > Hi there
> >
> > I am attempting to get outlook 2000 clients connecting to a exchange 5.5
> > server over SecureClient (NG FP3). If i create an outbound `Desktop
> Policy`
> > rule that says - -
> >
> > [EMAIL PROTECTED] ---> Exchange_box_internal_address - Service=Any
> >
> > ...then every thing works no problem at all. But I have been asked to
get
> > rid of rules with "Any" in the service column and lock it down to the
> > required tcp/udp ports/services only.
> >
> > Has anybody configured this to work already? if so which ports do i need
> to
> > keep open to get this working, so far i have
> >
> > tcp 135
> > tcp 1053
> > tcp 1068
> >
> > Can anyone think of any more that outlook potentially might want to use
?
> >
> > PS: Why, when TCP-135 appears in the log, it resolves to the name
"epmap"
> > but when i look in services listing in NG there is no "epmap" or in
fact
> no
> > service at all for TCP-135 ???, im very confused by this, I want to add
> the
> > service to a rule but it doesnt exist , but it does ..! if you see what
i
> > mean. Would i have to create the service and call it something else ??
> >
> > any help would be greatly appreciated
> >
> > Cheers
> > Gary
> > This electronic message contains information from Halifax Cetelem Credit
> Ltd
> > which may be privileged or confidential. The information is intended to
be
> > for the use of the individual(s) or entity named above. If you are not
the
> > intended recipient be aware that any disclosure, copying, distribution
or
> > use of the contents of this information is prohibited. If you have
> received
> > this electronic message in error, please notify us by telephone or email
> (to
> > the numbers or address above) immediately.
> >
> > =================================================
> > To set vacation, Out-Of-Office, or away messages,
> > send an email to [EMAIL PROTECTED]
> > in the BODY of the email add:
> > set fw-1-mailinglist nomail
> > =================================================
> > To unsubscribe from this mailing list,
> > please see the instructions at
> > http://www.checkpoint.com/services/mailing.html
> > =================================================
> > If you have any questions on how to change your
> > subscription options, email
> > [EMAIL PROTECTED]
> > =================================================
> >
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
> This electronic message contains information from Halifax Cetelem Credit
Ltd
> which may be privileged or confidential. The information is intended to be
> for the use of the individual(s) or entity named above. If you are not the
> intended recipient be aware that any disclosure, copying, distribution or
> use of the contents of this information is prohibited. If you have
received
> this electronic message in error, please notify us by telephone or email
(to
> the numbers or address above) immediately.
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
>
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
