Hi there
I have administered NT Firewall-1 4.0 under a remote management model
using Compaq 5500 FW modules. I was not using something like PcAnywhere
or PCDuo to connect to the modules as I wanted to keep security as tight
as possible. I'm not sure on the latest release of PCAnywhere but maybe
there is some sort of encryption in use for the connection. So in my
scenario I had to get help at the remote site or even visit it. No
joyful tools such as SSH !
A lot depends on whether you will be doing a lot of routing related
maintenance as to the headaches you will have.
For instance:
Adding routes in NT will not mean reboots, but changing an interface
subnet mask will
Using NAT, particularly static may mean adding routes. You'll need to be
in front of the box to do this. Coupled with this may mean adding
entries to local.arp
As far as using a primary management module is concerned, there should
be no issue administering the rulebase from here. It's when the time
comes to troubleshoot issues e.g. security policy won't install that
you'll run into headeaches.
For instance, you may need someone to look in the Event Viewer on the
FW-1 Module to check for FW-1 error messages, you may need to run the
'fw fetch' command from the module, etc.
As for Microsoft Security issues, with a correctly patched NT4.0 release
and properly configured box (see Lance Spitzner's site for the Armoring
NT document) I don't see any issues.
Out of all this experience, I have to say I'm a happy NOKIA user .. :o)
Andrew
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
