Hi !

- A very good explanation BUT

* What is the difference between a Service definition (eg SMTP port 25 with protocol 
type NONE and one with protocol type SMTP)

Is this a stateful check of the content (SMTP port 25 with protocol type SMTP) ?
That should the resource represent - I think.


Thanks in advance

Arno Hechenberger
citydata


> -----Urspr�ngliche Nachricht-----
> Von: Colmer, Philip [mailto:[EMAIL PROTECTED]]
> Gesendet: Freitag, 15. November 2002 09:53
> An: [EMAIL PROTECTED]
> Betreff: Re: [FW-1] Manage Service and Manage Resource
>
>
> >    I would like to understand what is the difference between Manage
> > Service and Manage Resources?
>
> A service is the definition of the actual protocol that you
> want to permit or deny in a rule. The service definition
> explains to the firewall how to match packets and determine
> that they fit that protocol.
>
> A resource is a further refinement on what you can do with
> the rules, through the use of FW-1's understanding of certain
> protocols. It allows you to apply additional restrictions
> and/or perform virus checks, etc.
>
> > For eg I can see FTP as the service and as the
> > resource?
>
> So to take FTP as the example, FTP as a service is pure and
> simple the protocol - you use this in the rulebase if you
> want to permit FTP access or deny FTP access to a given
> server or servers.
>
> If you define an FTP resource, it allows you to restrict what
> the user actually *does* with that FTP access. For example,
> you might want to ensure that they can only get files from a
> certain directory, or you might want to ensure that any files
> that are PUT are virus-checked first through a CVP server.
>
> > And what is the difference between add service and add service with
> > resource?  When do we need to add service with resource.
>
> The key here is that you cannot use a resource on its own -
> you have to "bind" it to a service. That is why you have a
> choice of add service, or add service with resource.
>
> Hopefully the explanations I've given above should now make
> it clear as to when you might want to use "add service with resource".
>
> > Besides, I found we can define the protocol type for all the TCP
> > service. For eg we can define the following protocol type
> for FTP tcp
> > service 1)None 2)URI 3)SMTP 4)FTP ?  Any difference???
>
> You aren't really defining the protocol type for the service
> - you are defining the sort of resource you want. Since it
> doesn't make sense to associate an SMTP resource with an FTP
> service, it is best not to confuse either yourself or the
> firewall, and stick with like-with-like.
>
> Hope that helps.
>
> --Philip
>
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.htm> l
>
> =================================================
> If you
> have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
>

=================================================
To set vacation, Out Of Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================

Reply via email to