Re: [FW-1] FW-1 Mail Archive

Subject: Re: [FW-1] FW-1 Mail Archive What ? - Original Message - From: "Chris McGill" <[EMAIL PROTECTED]> To: Sent: Saturday, July 22, 2006 12:27 PM Subject: [FW-1] FW-1 Mail Archive > Hi, > > Thought this may be useful for

[FW-1] FW-1 Mail Archive

Hi, Thought this may be useful for some members of the list. Christopher McGill CCSE, CCSA, CCNA, MCP This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal

Re: [FW-1] SPLAT R60 or R61 - Mount USB Pen Drive

1. Log in to expert mode. 2. Verify that you have the needed kernel modules loaded. type lsmod | more 3. By default, Red Hat loads usb-uhci and usbcore on startup. But you'll need to load an additional module called usb-storage in order to get a flash drive working. To do this, simp

Re: [FW-1] ConnectControl

What have you set the logical server type to for http traffic (http or other)? HTTP type requires you to setup a static NAT tranlation for each web server as after inital connection and additional communication is direct from the web client to the web server. Where as other uses NAT to mediate

Re: [FW-1] IPSO 4.0.1

Hi, I really appreciate you sharing this with me. Could I ask a last favour do you have IPSO 3.8.1 Build 29, I would really appreciate a copy of this also. I have a CCSE Accelerated NGX courseware book, which I used to complete the exam, if this would be of any use to you as a return guesture

[FW-1] IPSO 4.0.1

Hi, I am in urgent need of a copy of IPSO 4.0.1 and documentation. If anyone could please help, I am more than willing to share anything that is Check Point related for our software subscription. Thanks [EMAIL PROTECTED] Christopher McGill CCSE, CCSA, CCNA, MCP This e-mail and any atta

Re: [FW-1] Common knowledge question

VLANing is a good idea not only does t provide a additional level of security by separating the networks into logical segments, using ACL's to dictate access control, but it also reduces the broadcast domain increasing performance. VLAN Jumping like most attacks is only possible is the implente

Re: [FW-1] NGX, dynamic object resolution problem

I use a dynamic object which contains blocklist address blocks to block all traffic from ip ranges known to be a danger, this is a more scalible solution than StormCenter. A dynamic object is a "logical" object that will be resolved to an IP address differently on each VPN-1/FireWall-1 Module

Re: [FW-1] Session Authentication Agent

Drive Letter\Windows\CPSessionAgt-50\ From: Mailing list for discussion of Firewall-1 on behalf of Michel Lapointe Sent: Wed 08/02/2006 21:43 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: [FW-1] Session Authentication Agent Hello, I wou

Re: [FW-1] SmartDashboard to SmartCenter Server over VPN fails to connect

The CMPI resource which is used to connect the SMARTConsole to the SMARTCenter is an implcit rule in Global Properties, which is applied before the encryption rule, hence will be presented to the peer gateway will be unencrypted. You can edit the implied_rules.def on the SMARTCenter, then cre

Re: [FW-1] SmartDashboard to SmartCenter Server over VPN fails to connect

From: Mailing list for discussion of Firewall-1 on behalf of Michael Kelly (HRG) Sent: Wed 08/02/2006 18:07 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: [FW-1] SmartDashboard to SmartCenter Server over VPN fails to connect When I try to connect to

[FW-1] IPSO - Urgent

Hi Guys, My company has recently been inactive with Nokia and our account has not been renewed. I use a IP330 at home with NGX, would any one in the list please be able to share IPSO 4.0 and associated documentation with me please. If there is anything you need in return Check Point relat

[FW-1] VPN Extranet Question

Hi, I am setting up a Extranet VPN with a partner to colaberate using a call logging system. Check Point VPN-1/Firewall-1 is being used at each location with seperate dedicated SMARTCenter's. However, both locations VPN domain is 192.168.1.0. What are the issues this will cause, I assume t

[FW-1] Group Permissions Error

Hi, Getting error message when trying to set group permissions for the $FWDIR folder using NGX on IPSO 3.9. This has happened on two deployments now, when running cpconfig , option 5. Error "unable to use -R and -h on directory". I can get round this manually by changing directory to $FWDIR

Re: [FW-1] Check Point & Enhanced Alert Functions

e aforementioned uglyness. good luck! -r On Tue, Aug 30, 2005 at 12:37:25AM +0100, Chris McGill said at one point in time: > Hi, > > I am currently running Check Point NGX (R60), on IPSO 3.9. What I wish to > achieve is connect a MODEM into the IP330 (dial-out only) and find some

[FW-1] Check Point & Enhanced Alert Functions

Hi, I am currently running Check Point NGX (R60), on IPSO 3.9. What I wish to achieve is connect a MODEM into the IP330 (dial-out only) and find some OPSEC or Linux paging software I can use on the box, to page me when a serious alert is tripped. I know this would be easy to do with SNMP or

[FW-1] UFP Mode

Hi, For performance issues using Enhanced UFP Performance mode speeds up access times. However, do to the nature of the Internet I require CVP inspection was can't be used in this mode. I am considering the use of a BlueCoat Proxy (CacheFlow), do the inspection features provide the necessary

[FW-1] SecurePlaform Installation

Hi, I wish to run SPLAT inside VMWare on my laptop, does anyone know of a way to customise the partitioning of a SPLAT install it seems to want to use the entire disk space, and yes this is a good security design. Christopher McGill CCSA, CCNA, MCP This e-mail and any attachment is for aut

Re: [FW-1] License Smartcenter

Each SMARTCenter server requires a local licence which you enter into cpconfig or import to the licence repository of SMARTUpdate. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Christian Franke Sent: Fri 27

Re: [FW-1] Digitaly sign every outgoing smtp mail

No the cvp server cares not the firewall. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich Sent: Fri 27/05/2005 09:55 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] Digitaly sign

Re: [FW-1] Enabling an interface On existing R55 Firewall

1. Install NIC 2. Configure TCP/IP 3. Reflect in SMARTCenter, including anti-spoofing Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of john maverick Sent: Fri 27/05/2005 11:56 To: FW-1-MAILINGLIST@AMADEUS.US

Re: [FW-1] CP NG R55 HFA13 on SecurePlatform..User Authentication

Best is to integrate LDAP (AD), local accounts become unmanageable. www.freeradius.org/ or try TACACS+ Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Eren Sonmez Sent: Fri 27/0

Re: [FW-1] VPN-1 Edge

www.checkpoint.com Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Zubair Jalal Sent: Fri 27/05/2005 04:46 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: [FW-1] VPN-1 Edge Hi. What is VPN-1 Edge device

Re: [FW-1] Smart Defense Update Error

There is a maintenance notice on usercenter at present. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Previtera, Sal Sent: Wed 25/05/2005 16:19 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1]

Re: [FW-1] NG AI + IPSO 3.8x

This does not reflect what if on the check point site, HFA-14 is an R55 update. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Quick, Richard A. Sent: Wed 25/05/2005 15:01 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOI

Re: [FW-1] NG AI + IPSO 3.8x

In the HFA-14 release notes, it says "SmartUpdate of version HFA_R55_14 can install packages from version R55 plus, for NOKIA IPSO 3.80." Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Timothy Arnold Sent: W

[FW-1] H.323 VoIP Integration

Hi, I am sound on the setup of H.323 VoIP support and integration in Firewall-1. However, one aspect that I have found little information on is Chaining when the Firewall is multi-homed, would it be only necessary when different call routing protocols are in use? This e-mail and any attachmen

[FW-1] User-Defined Tracking/Alerts

Hi, I using HP OpenView NNM 7.5 as a Network Management Systems, I want to extend the alert-handling capabilities of Check Point VPN-1/Firewall-1, using the internal_snmp_trap command and alertd process, how would I go about ensuring once a rule has the custom track associated with it it makes

Re: [FW-1] High Availability

ts-HA are two Managementserver and a crosscable? > > -- > Christian Franke <[EMAIL PROTECTED]> > > powered by Sun Java Linux Desktop > > > > 2005/5/24,

Re: [FW-1] High Availability

esktop 2005/5/24, Chris McGill <[EMAIL PROTECTED]>: > The Management HA scheme requires one primary Management Server, and at least > one secondary Management Server. There is no limit to the number of secondary > Management Servers. The first installed

Re: [FW-1] How to Backup all configuration from my Nokia IP350

"only problem i have seen is that you need anonymous write on the ftp server - unless someone else knows different?" set backup remote ftp-site ip_address ftp-dir path_name ftp-user name manual filename [ftp-passwd password] scheduled filename [ftp-passwd passwo

Re: [FW-1] High Availability

The Management HA scheme requires one primary Management Server, and at least one secondary Management Server. There is no limit to the number of secondary Management Servers. The first installed Management Server is automatically designated as primary, while every other Management Server added

Re: [FW-1] Dial Backup on SPLAT

Check Point ISP Redundancy allows a dial-up link to be configured as a backup to the primary link. If one of the ISP links is a dialup network, edit the ISP Redundancy Script located in $FWDIR/bin/cpisp_update. In the script, use the Linux or SecurePlatform operating system command to bring u

Re: [FW-1] Dual Network Cards and Redundancy

From: Mailing list for discussion of Firewall-1 on behalf of Jameel Akari Sent: Mon 23/05/2005 19:42 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] Dual Network Cards and Redundancy On Mon, 23 May 2005, Chris McGill wrote: > Two Network cards on the same segment can't s

Re: [FW-1] FW loads Initial Policy after Reboot.

VPN-1/FireWall-1 will use the initial policy instead of the last installed policy after reboot if the Management station is not reachable during the start process. This is a limitation in the license sanity check. Contact Check Point support for a Hotfix ([EMAIL PROTECTED]). This applies to R

Re: [FW-1] Dual Network Cards and Redundancy

ehalf of Christian Franke Sent: Mon 23/05/2005 20:57 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] Dual Network Cards and Redundancy Thanks, any hope in r55 with splat?? 2005/5/23, Chris McGill <[EMAIL PROTECTED]>: > Solution ID: sk22345 > Creation Date: 09/08/20

Re: [FW-1] Dual Network Cards and Redundancy

Sent: Mon 23/05/2005 19:42 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] Dual Network Cards and Redundancy On Mon, 23 May 2005, Chris McGill wrote: > Two Network cards on the same segment can't share the same IP address as > this causes problems with the switc

Re: [FW-1] Dual Network Cards and Redundancy

Two Network cards on the same segment can't share the same IP address as this causes problems with the switching tables. Can you provide more information, what you are talking about is high availability and perhaps laod balancing. Look at ClusterXL, StoneBeat, RainWall, etc. Where a cluster I

Re: [FW-1] Smart Center

1. Run Upgrade-Export on your SMARTCenter, to make a backup copy of your current configuration. 2. Install Check Point SMARTCenter on your new platform (additional steps maybe required depending on platform). 3. Run Upgrade-Import, to import your existing settings. 4. Re-Validate y

[FW-1] Check Point Books - New FTP Server

Hi, I have been getting hundreds of connections, and bandwidth has been low. The solution I have is that each person want the material can e-mail directly with an e-mail account they wish me to send the login information to. I will setup a user account for each person and allow only one perso

[FW-1] NAT/Routing Question

Hi, My understanding is that an ISP provides you with a primary IP and an additional block if requested subnetted differently to the primary block, but makes the necessary adjusts on their equipement to forward all traffic for the block to your primary IP. This also you to NAT at the edge rout

Re: [FW-1] CCSA/CCSE study material

ards, >__ > >Markella Kountourouda, CISSP >Information Security Engineer >ENCODE S.A. >__ > > > >-Original Message- >From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Ch

[FW-1] IPSEC & NAT

To the best of my current understanding NAT-T is enabled by default, and through IKE Phase 1, determines if both endpoints support NAT-T, and which device are NAT'ed in the path. Do you need to do anything else to configure NAT-T? How about ports? Thanks Christopher McGill CC

Re: [FW-1] CCSA/CCSE study material

: (212) 609-5561 Email: [EMAIL PROTECTED] "In cases of defense 'tis best to weigh the enemy more mighty than he seems." William Shakespeare (1564-1616) -Original Message- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Chris McGill S

Re: [FW-1] CCSA/CCSE study material

email? > Thanks again > > Ana > ___ > > Cybertech Projects > > Ana Asuaje > Network Security Engineer > email: [EMAIL PROTECTED] > www.cybertech.com.ve > > -Mensaje original- > De: Mailing list for discussion of Firewal

Re: [FW-1] CCSA/CCSE study material

FTP Server: 86.131.151.139 Username: CP Password: PASSWORD Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of sin Sent: Fri 08/04/2005 22:13 To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-

Re: [FW-1] CCSA/CCSE study material

email? > Thanks again > > Ana > ___ > > Cybertech Projects > > Ana Asuaje > Network Security Engineer > email: [EMAIL PROTECTED] > www.cybertech.com.ve > > -Mensaje original- > De: Mailing list for discussion of Firewall-1 > [mailto

Re: [FW-1] Procedure for Upgrade / Rebuild for NG R55 - Doc available? layman's terms

Hi, FTP Server: 86.131.151.139 Username: CP Password: PASSWORD There is a R55 Upgrade guide there called Upgrade. 1. Run Upgrade-Export 2. Run Pre-Upgrade Verifier on the new server 3. Install SMARTCenter 4. Run Upgrade-Import You should have no problems. Christopher McGill CCSA,

Re: [FW-1] CCSA/CCSE study material

st for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED] En nombre de Chris > McGill > Enviado el: Miércoles, 06 de Abril de 2005 08:56 p.m. > Para: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM > Asunto: Re: [FW-1] CCSA/CCSE study material > > Hi, > > I can help you out w

Re: [FW-1] AW: [FW-1] CCSA/CCSE study material

Subject: [FW-1] AW: [FW-1] CCSA/CCSE study material hi chris, can you send me the link too please. thanks in advance regards wolfgang > -Ursprüngliche Nachricht- > Von: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED] Im > Auftrag von Chris McGil

Re: [FW-1] CCSA/CCSE study material

Security Engineer email: [EMAIL PROTECTED] www.cybertech.com.ve -Mensaje original- De: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] En nombre de Chris McGill Enviado el: Miércoles, 06 de Abril de 2005 08:56 p.m. Para: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Asunto

Re: [FW-1] CCSA/CCSE study material

Hi, I can help you out with electronic material, I have the official Check Point course material for CCSA, CCSE, CCSE+ in NG AI, and Managing SecurePlatform. Drop me an e-mail. [EMAIL PROTECTED] +++Remove the +s as I don't want a bot spamming me.

Re: [FW-1] spoofing question

list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Chris McGill Sent: Tuesday, April 05, 2005 9:09 PM To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] spoofing question I know you have not defined eth2 as external, you have it defined as internal as that i

Re: [FW-1] spoofing question

t for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Chris McGill Sent: Tuesday, April 05, 2005 3:31 PM To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: Re: [FW-1] spoofing question Do you need to make an spoofing allowance on eth2 for 172.24.200.0, as I assume you have no

Re: [FW-1] spoofing question

Do you need to make an spoofing allowance on eth2 for 172.24.200.0, as I assume you have not got it defined as an external interface, and therefore, the filtering applies to anything that passes through the interface? I could be wrong. Christopher McGill CCSA, CCNA, MCP

Re: [FW-1] SMTP Security server

Message Labs provides an in the cloud e-mail filtering solution, yes you have to pay for the service but it may reduce TCO of your current solution. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf

Re: [FW-1] spoofing question

I just tested it, create a simple group Private_Networks, including all the address ranges you to use and apply this as the spoofing enforcement parameters. Christopher McGill CCSA, CCNA, MCP From: Mailing list for discussion of Firewall-1 on behal

[FW-1] Log Servers

Also, forgot to ask, when using SMARTView Tracker it asks for the IP of the SMARTCenter, if I install a Check Point log server from R55 cd, can I connect directly to it? As opposed to a SMARTCenter to view the logs. This e-mail and any attachment is for authorised use by the intended recipient(

Re: [FW-1] Log Servers

discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Chris McGill Sent: Thursday, March 10, 2005 8:47 PM To: FW-1-MAILINGLIST@AMADEUS.US.CHECKPOINT.COM Subject: [FW-1] Log Servers Hi, I have a few questions in regarding to log management. Any information or experience would be

Re: [FW-1] Question about R55 and R55W

R55W should only be used by customers who need Web Intelligence, or who need specific defenses delivered in R55W such as new DNS security or Peer-to-Peer security features. You may feel that IDS/IPS solutions already in place rule out the justification for R55W, but this solutions are generalis

[FW-1] Log Servers

Hi, I have a few questions in regarding to log management. Any information or experience would be appreciated. I am aware of how to setup a Check Point log server, and forward the log information from the enforcement module to it. However, I would like to understand: 1. Is the security ser

Re: [FW-1] OT: Security Audit Software

FoundStone are a leading security comapny, they offer foundscan, which is used by CESG CHECK security members for government security audits. Christopher McGill CCNA, MCP From: Mailing list for discussion of Firewall-1 on behalf of Mark Senior Se

Re: [FW-1] merging NG AI objects

Use Export/Import Tools included with CP Christopher McGill CCNA, MCP -BEGIN PGP PUBLIC KEY BLOCK- Version: GPG (GNU Privacy Guard) mQGiBEG/A1ERBACPI8UxY9FqCI7Vg84of2VJ+EL26YKss1fWhKh7jdz7FvD34Ruw vuXMSFuoW0W8ppmKK/I2VusCDocKHjN7AcRvUzsvryVOmkOKC/T2oyYyxpWKa

Re: [FW-1] CCSA Exam test

Hi, Know the course objectives, they are all pretty straight forward day-to-day CP administration tasks. Christopher McGill CCNA, MCP -BEGIN PGP PUBLIC KEY BLOCK- Version: GPG (GNU Privacy Guard) mQGiBEG/A1ERBACPI8UxY9FqCI7Vg84of2VJ+EL26YKss1fWhKh7jdz7FvD34Ru

Re: [FW-1] DMZ

Hi David, Further after doing so research. I feel I now have a better conceptual understanding on one design method. I assume your gateway router has one public IP, then the additional block of public IPs from your ISP (which is a separate range from routers?) makes up the segment between the

[FW-1] DMZ

Hi, Help! I have spent several hours of researching. I am new to DMZ and Check Point implementation. I am looking for the best design of an enterprise using a gateway router connected to a firewall-1. 1. Do you give the firewall a public address 2. Can you do something on the router forward

[FW-1] Check Point & Cisco Integration

Hi, With the design below, is there a means by which I can use Dynamic (Hide/PAT) NAT on the checkpoint enforcement module, and disable NAT on the cisco router and how it forward the packets or something? Unless I am totally missing something here?

[FW-1] SPLAT IP Forwarding

Does SPLAT have IP Forwarding (Routing Capability) enabled by default or is a configuration required? Thanks This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privile

[FW-1] Nokia IPSO & Cisco Router

Hi, In the experience of the mailing list member, what are the differences/benefits, of using the IPSO with a Cisco gateway router, or using the IPSO to replacement the requirement of a Cisco router. Apart from a default secured platform. Is there any existing benefits of still using a Cisco

Re: [FW-1] about the ping death

http://www.insecure.org/sploits/ping-o-death.html This is no longer a viable attack method, unless you have a spoon changing the configs. Christopher McGill CCNA, MCP -BEGIN PGP PUBLIC KEY BLOCK- Version: GPG (GNU Privacy Guard) mQGiBEG/A1ERBACPI8UxY9FqCI7Vg84of2VJ+E

Re: [FW-1] Secure Platform HCL

SecurePlatform NG with Application Intelligence (R55) Hardware Compatibility Testing Tool http://www.checkpoint.com/techsupport/downloadsng/utilities.html#r55_hw_comp_test_tool Christopher McGill CCNA, MCP -BEGIN PGP PUBLIC KEY BLOCK- Version: GPG (G

Re: [FW-1] secureplatform on HP DL380 G4

I believe that Check Point is currently in the process of purchasing SPLAT hardware certification for HP DL-380 G4 and HP ML-360 G4. http://www.checkpoint.com/products/supported_platforms/compatible.html According to this there are no drivers included for the DL350/380 G4's as of yet.