True, but the point of "if it isn't broke don't fix it" really shouldn't
apply to security.
Anything that could be a vulnerability, such as a legacy code on a
firewall, should be
assessed, audited, and acted on appropriately.
The thing that baffles me the most is that Check Point told one customer to
roll back to a previous version,
yet provided another customer with a fix above HFA08. The emails did
provide all the information, such as the OS, but
I would think that with the architecture of FW-1 that it wouldn't matter.
This gives me worries about communication within CP support.
-Matt
|---------+-------------------------------------------->
| | Hal Dorsman <[EMAIL PROTECTED]> |
| | Sent by: Mailing list for |
| | discussion of Firewall-1 |
| | <[EMAIL PROTECTED]|
| | KPOINT.COM> |
| | |
| | |
| | 08/12/2004 03:58 PM |
| | Please respond to Mailing list |
| | for discussion of Firewall-1 |
| | |
|---------+-------------------------------------------->
>----------------------------------------------------------------------------------------------|
|
|
| To: [EMAIL PROTECTED] |
| cc:
|
| Subject: Re: [FW-1] Beware R55 HFA08!
|
>----------------------------------------------------------------------------------------------|
An interesting footnote to the 'approach to hotfixes'
discussion.
Hal
> -----Original Message-----
> From: Joe Pope [mailto:[EMAIL PROTECTED]
> Sent: Thursday, August 12, 2004 9:48 AM
> To: [EMAIL PROTECTED]
> Subject: [FW-1] Beware R55 HFA08!
>
>
> Warning if use VPN with R55, especially SecuRemote/SecureClient!
>
> After upgrading from HFA04 to HFA08 we started having
> decryption errors (VPN
> error code 03) with our SecureClient users. Somehow the
> logged IP address
> of the VPN Peer Gateway is getting changed (by the firewall) and then
> decryption fails. It does not affect all SecureClient users
> at the same
> time, and after
> a few hours the problem goes away! I checked my SecureClient while
> monitoring my firewall logs, and my SecureClient IP address
> was not being
> reported
> in the firewall logs correctly.
>
> I submitted a trouble ticket with Check Point and they know about this
> problem, and they suggested I roll back to HFA04.
> They said HFA09 is suppose to fix this problem, but no word on when to
> expect this fix.
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
>
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
