Re: [FW1] ports on Firewall-1

[Fabiola Mayorca]

Title: open ports

Hi Chi-Lien,   Well, the ports FireWall-1 uses for communication are these (I made a table of them....):   Name of service Description TCP or UDP Port number FW1 Check Point VPN-1 & FireWall-1 Service TCP 256 FW1_log Check Point VPN-1 & FireWall-1 Logs TCP 257 FW1_mgmt Check Point Management TCP 258 FW1_clntauth_telnet Check Point VPN-1 & FireWall-1 Client Authentication (Telnet) TCP 259 FW1_snmp Check Point VPN-1 & FireWall-1 SNMP Agent UDP 260 FW1_snauth Check Point VPN-1 & FireWall-1 Session Authentication TCP 261 FW1_top Check Point VPN-1 SecuRemote Topology Requests TCP 264 FW1_key Check Point VPN-1 Public Key Transfer Protocol TCP 265 FW1_clntauth_http Check Point VPN-1 & FireWall-1 Client Authentication (HTTP) TCP 900 FW1_cvp Check Point OPSEC Content Vectoring Protocol TCP 18181 FW1_ufp Check Point OPSEC URL Filtering Protocol TCP 18182 FW1_sam Check Point OPSEC Suspicious Activity Monitor API TCP 18183 FW1_lea Check Point OPSEC Log Export API TCP 18184 FW1_ela Check Point OPSEC Event Logging API TCP 18187 FW1_ipslogon Policy Server Logon protocol TCP 18207 FW1_CPRD Check Point Remote Installation Protocol TCP 18208 FW1_netso NetSO Authority protocol TCP 19190   Some of these are included in implicit pseudo-rules you can view choosing View from the menu, and then click on Implied pseudo-rules. Pay attention to the fact that you're maybe not using all of them.... I suggest you to harden you operating system in order to close unnecesary ports. For hardening SO I suggest the following whitepapers:   Armoring Solaris        http://www.enteract.com/~lspitz/armoring.html Armoring NT            http://www.enteract.com/~lspitz/nt.html   About training in CheckPoint Fw-1.... Well I can say that when I began with the product documentation it was a headache for me to understand the product architecture. Too many terms: inspect engine, fw module, inspection module, enterprise security console, fw management console. Some of them refer to the same but I don't know why the CKP Software Technologies documentation team like to have many, many names to designate exatly the same thing. It was a great challenge for me. But you can acquire the concepts and terms if you have a little patience. You will maybe have to read the docs many times. I can't tell you if CCSA or CCSE student material were better than product documentation because I had access to them when I was more experienced with Fw-1. But I think they're easier to read. If you or your company can afford for a CCSA or CCSE course, welcome.... I hope this can help you. Best regards,   Fabiola Mayorca   ----------------------------------------------------- Fabiola Daniela Mayorca Arellano CCSE  & CCSA CheckPoint Certified Security Engineer / Administrator Telef�nica Sistemas, sucursal Per�.  Los Sauces 374 Piso 10/11 Edificio La Torre Roja.  San Isidro - Lima 27 Latin America ----- Original Message ----- From: Chi-Lien Lee To: '[EMAIL PROTECTED]' Sent: Monday, November 06, 2000 2:05 PM Subject: [FW1] open ports Dear All, I am a beginner trying to use this product.  Two simple questions about the FW: 1. What ports number does FW use?  Should I close most of the "listening" ones?  And how?  2.  Any recommandation about what books I should start with (except the manuals) or should I just go to the class and get trained that way? Thanks for any advice. Best, Chi-lien Lee