Re: [FW1] Strange message after installing FW-1 SP3

It's a problem with NT installs as well. What I was told from checkpoint is that you cannot apply SP1 or SP2 or SP3 on top of SP0. You have to uninstall the FW and reinstall from a CP2000 CD (which is SP1) or a later CP2000 CD which has SP2 integrated into it (this is what I did). Then you can a

RE: [FW1] Changing IPSO telnet banner

I think that this is the default behaviour and if you add an entry like the ones described earlier, the original banner should not appear. In any case maybe you should contact Nokia's support. -Original Message- From: Scott Murray [mailto:[EMAIL PROTECTED]] Sent: Friday, May 04, 2001 2:5

RE: [FW1] Dual-homing an interface on a DMZ

dual-home means binding two addresses to a single interface. Multiple interfaces has no bearing here. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Chris Arnold Sent: Thursday, May 03, 2001 4:19 PM To: 'Stafford, Todd'; 'FW-1 Mail List' Subject: RE: [

Re: [FW1] Multicast on Firewall-1

Hello Jenny, I'm not sure about Firewall-1 4.0 on Solaris - I have configured multicast IP traffic through a Firewall-1 4.1 SP3 on Windows 2000. 1. Configure the server to route multicast IP traffic - before loading a security policy on it 2. Create a network object (of type network) whose I

[FW1] Ha Problems

Hi there. I have a problem with a CheckPoint Ha solution. Managment server is of course on a different server. All installation according to Checkpoint whitepaper Firewall A is main firewall and return to higher number is checked. My problem is that the system status and CPHAPROB state shows Fire

RE: [FW1] Faq?

sorry, I responded to the wrong list, please ignore. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of bfuller Sent: Thursday, May 03, 2001 9:19 AM To: titanyen; [EMAIL PROTECTED] Subject: RE: [FW1] Faq? www.software.ibm.com/ts/mqseries -Original M

[FW1] 2 FW interfaces on same network for redundancy?

Hi, We've got a checkpoint FW-1 v3.0 firewall on Solaris 2.6 with a Sun Quad Fast Ethernet installed. We're looking to set up a redundant connection to a network using 2 ports of the Sun QFE card connected to separate Cisco Catalyst switches, with the clients on the network also having connecti

RE: [FW1] Changing IPSO telnet banner

I saw this resolution at Nokia's site, but the problem I have is that the gettytab file is empty, the file size is zero bytes but it is still putting up a telnet banner. Can I simply edit this empty file and add the : >default:\ >:cb:ce:ck:lc:fd#1000:im=\r\n IPSO (%h) (%t)\r\n\r\n:sp#1200: l

Re: [FW1] FW-1 and AOL

It's not HTTPS. I have the same problems. Something screwed up in the security server. I'm on 4.1 SP3 by the way. I kludged a workaround by allowing http only to aol server IP addresses without using any URI filters nor websense. I know it will break if AOL changes their IP addresses but hey, I

[FW1] Duplicate pings

Hi, I experince the follwoing strange behaviour on hosts that are located behind an interface on a firewall which is a subinterface of another.. It concerns interface qe0:1 behind which a /27 network is located.. When I ping from a host I receive the following.. ping x.x.x.x PING x.x.x.x

RE: [FW1] Changing IPSO telnet banner

Scott, I received this fix from Verisign support. They got it from CheckPoint. This fix is for client authentication when using telnet, ftp, rlogin. I'm not sure if it's exactly what your looking for, but here goes... I'm using an IP440 3.3 and, fw1 4.1 sp2. Hope it helps... ###

RE: [FW1] Changing IPSO telnet banner

As you can see at Nokia's resolution case no.1669: The telnet banner is set in /etc/gettytab by using the "im" (initial message) capability. All IPSO terminals use the default entry, which looks like this: default:\ :cb:ce:ck:lc:fd#1000:im=\r\n IPSO (%h) (%t)\r\n\r\n:sp#1200: This produces th

RE: [FW1] [FW1 VPN] - one way only? - I need help

you will need the same rule in the other direction. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Patrick Lotti Sent: Friday, May 04, 2001 5:13 AM To: [EMAIL PROTECTED] Subject: [FW1] [FW1 VPN] - one way only? - I need help Hi, I tried to set up a

[FW1] SecuRemote

Hi, I have a Firewall Module installed separately from the Management console. From a SecuRemote Client. In creating New Site in the SecuRemote client, which IP address do I need, the IP address of the management console or the firewall module? Thanks, Maureen ===

RE: [FW1] beginner's question on DNS

Ask your ISP what they think is the best solution for you since you dont host your own domains. Either put up a cache-only DNS server or maybe use their. /Jonas -Original Message- From: John Tanouye [mailto:[EMAIL PROTECTED]] Sent: den 2 maj 2001 00:23 To: '[EMAIL PROTECTED]' Subj

[FW1] HA problems

Hi there. I have a problem with a CheckPoint Ha solution. Managment server is of course on a different server. All installation according to Checkpoint whitepaper Firewall A is main firewall and return to higher number is checked. My problem is that the system status and CPHAPROB state shows Fire

[FW1] StoneBeat and 3Com Problem

I am having a problem with the StoneBeat Load Balancing software. I have the following setup.   2xFirewalls 1xManagment Server   Running SunOS 5.7 and FW1 4.1 SP2 StoneBeat 4.2.1   they are connected to 3com 3300 switches running software version 2.64.   The problem is when both firewalls

[FW1] SecuRemote, DHCP and IP POOL

Hi all ! Hi have Vpn-1 (CP2K SP3) with SecuRemote and I have a DHCP server on the internal network I want to have acces to with SecuRemote. SecuRemote uses IP Pool to have a temporay assigned internal IP but I cannot set it to give a DNS server or WINS server to the SecuRemote client. How can I h

Fwd: [FW1] Ports.conf (administration ports)

- Message restransmis par Joe Dalton <[EMAIL PROTECTED]> - Date: Fri, 27 Apr 2001 17:52:10 +0200 From: Joe Dalton <[EMAIL PROTECTED]> Reply-To: Joe Dalton <[EMAIL PROTECTED]> Subject: [FW1] Ports.conf (administration ports) To: [EMAIL PROTECTED] Hi guys, Has anyone tried to change t

[FW1] Why should the firewall be the NAT boundery?

I would agree with this, but it needs more explanation. I'm not sure I could offer a complete explanation, so... Why should FW-1 be the NAT boundery? >>> "Juppunov, George" <[EMAIL PROTECTED]> 5/2/2001 10:27:18 pm >>> No. Don't do it. Make the firewall your NAT boundary. George > -O

[FW1] [FW1 VPN] - one way only? - I need help

Hi, I tried to set up an IPSec VPN with pre-shared keys, using SSH Sentinel. The basic key exchange works, and I can send packets from my client through the fw into my intranet. But the replies out of the intranet aren't protected. Packet exchange is like this: SSH Sentinel -> FW1:Send pack

RE: [FW1] Multi-tier Firewall topology

Sure, I oversimplified the diagram to the point that the point was lost Here is a clearer picture: InternetFW1CiscoPIX-DMZ-FW1---CiscoPIX---InternalLan Clearly, the DMZ and Internal LAN could hang off two interfaces of the first CiscoPIX, and we would have the same topo

Re: [FW1] http tunneling

Hi Juan Thanks for your help, but the problem is that http tunnel software links directly to the proxy server, which is BEFORE the firewall, so this rule never would be applied, as it is the proxy making legitimate http requests to the internet who hides internally on http packets other non-legi

RE: [FW1] Strange message after installing FW-1 SP3

Ah well, I'm glad I'm not the only one.. What are the symptoms on your side?? I experienced hanging sessions through the firewall, which forced me to get back to an old FW 4.1 SP2 config.. Nils > -Original Message- > From: Chris F [mailto:[EMAIL PROTECTED]] > Sent: Thursday, May 03, 200

RE: [FW1] 4.1 SP1 version of the GUI client

If you have the CP2000 CD, that's equal to 4.1-SP1, installing the GUI client from there will do the job Met vriendelijke groeten - Bien à vous - Kind regards Guy ROELANDTS EMEA CS Internet Expertise Centre Compaq Software Engineer - Belgium E-mail : [EMAIL PROTECTED] Tel: +32(02)729.77.44 (opt

Re: [FW1] CVP and relaying

Hi John, To stop mail relay, you can specify in the SMTP resource object that you will receive mail only for *@*.yourdomain.com and that should do it. True Received from info could be very useful to stop spam but most spam will not have a successful reverse DNS lookup. I think SMTP securit

[FW1] how to know we are at unlimited user license?

how to know we are at unlimited user license for check point? FYI we are at installing check point in solaris _ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. ===

Re: [FW1] whether there is a VPN module is include in our checkpoint?

Hi, it means that you have VPN-1 installed - building VPN's is possible. VPN+DES+STRONG means the encryption level. Your VPN-1 can also encrypt with 3DES The levels are VPN: exportable, DES/FWZ-1 with 40 Bit DES: VPN and DES with 56 Bit keys STRONG: VPN plus DES and 3DES Hope it helps, best rega

RE: [FW1] OT-Host access

Ihsan--   1.  There is a Unix-based secure telnet project.  Personally, I use ssh as well as most of the rest of the world which is not to say stelnet (??) is bad.  If you can build ssh2 for your environment, I would recommend it on a dedicated DMZ host with plug-gw running.   2.  If you deci

RE: [FW1] fw_xlate_forw Error on FW-1

I think www.phoneboy.com stated that might be due to a general NAT rule that is trying to NAT out certain type of traffic (i.e. UDP) that cannot be NAT'ed. J --- [EMAIL PROTECTED] wrote: > > Technically we have 2 class B networks behind the > NAT, but in practice, we > only have 2k-3k connect

[FW1] any coursebook for CCSA Checkpoint 2000??

what is the recommended coursebook for CCSA Checkpoint 2000?? _ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

[FW1] whether there is a VPN module is include in our checkpoint?

Hi.. May I ask you whether there is a VPN module is included in our checkpoint. Or we have to buy seperately. We use the checkpoint as a firewall purpose only. What is mean by DES and strong??? bash-2.00# fw ver This is Check Point VPN-1(TM) & FireWall-1(R) Version 4.1 Build 41716 [VPN + DE

[FW1] Test

Ignore. To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html

Re: [FW1] Problems with ssh and fw-1

Is it possible that you are not root on the system and don't have permission to write to certain directories? Or prehaps /tmp is not truly world writable? Just a guess Hal Huntley > Hi all > > i am having some problems installing ssh > on solaris 2.7 core install=20 > > i am trying to se

[FW1] SMTP Security servers

Hi   I have gone through various docs at check point site and thru mailing list advices including one below. I am trying to start SMTP security server on PDS2100 box but no luck so far. I understand that fw daemon has to start it after I upload the policy and restart fw. It doesn't wo

RE: [FW1] Faq?

Start at www.phoneboy.com . Apart from that excellent source, it's link page points you to other excellent resources. Mail archives at www.securepoint.com -Original Message- From: titanyen [mailto:[EMAIL PROTECTED]] Sent: Thursday, 3 May 2001 4:42 AM To: [EMAIL PROTECTED] Subject: [FW1]

Re: [FW1] CVP and relaying

Hi Naresh, The problem is that the "Received From" information in the mail header changes from the "true" sender's information to the IP address of the interface on the firewall on which the SMTP server resides. I am interested in keeping the original mail header information in tact to avoid mai

[FW1] Log viewer and user databases questions

Hi everybody, I have a couple of questions for you: 1.- Is there any way to manage in an automated way the log files from Firewall-1? What I mean with manage is for example, to create new log files everyday and store the previous one. 2.- I know it's possible to export the user database from on

RE: [FW1] SIMPLE QUESTION

Don't forget that in addition to creating your NAT rules, you also have to create your rule-set describing what you do and do not allow to pass through your firewall. You also have to add routing statements from the command line on the firewall machine itself to route your internal nets through

RE: [FW1] SSH on port 22

SSH2 with SecureID (or at least S/KEY) support tunneled via plug-gw from a DMZ ssh host to your inbound hosts. Chris -Original Message- From: Scott Kellerman [mailto:[EMAIL PROTECTED]] Sent: Wednesday, May 02, 2001 10:35 AM To: [EMAIL PROTECTED] Subject: [FW1] SSH on port 22 When we

RE: [FW1] gfb: fw1 management station not logging

Double check that the new management center IP address is in $FWDIR/conf/[masters,loggers] on the FW enforcement points. Chris -Original Message- From: gf b [mailto:[EMAIL PROTECTED]] Sent: Wednesday, May 02, 2001 10:55 AM To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: [FW1] gfb:

[FW1] Content Security?

Hmmm...here's a message I've never seen before in the info field of the log: "reason: Content Security - access denied. resource http://ip.address.of.server:80"; I don't have and CVP servers. Thoughts? Chris

RE: [FW1] Disk full on IPSO 440

Title: RE: [FW1] Disk full on IPSO 440 Yes, du works find.  Go to / and enter du -k.  From there, you can drill down into the larger directories and find the offenders. HTH Dan Hitchcock CCNA, CCSE, MCSE Security Analyst Breakwater Security Associates 206.770.0700 x147 dhitchcock (at) break

Re: [FW1] CVP and relaying

Put a rule to not NAT before your NAT rules. --- John Hardly <[EMAIL PROTECTED]> wrote: > > Hi everybody, > I discovered that my mail server (212.x.x.18 on my > DMZ) became an Open Mail Relay > when I installed a CVP with FW-1 4.1. > Every smtp connection from the FW-1 to the mail > server appe

[FW1] Changing Firewall-1 ip address

hi all   i shall be moving our firewalls over to a differnet network , and i have had the licenses re-generated for the external ip address , now i would like to know what i have to change in firewall-1 ver 4.1 to get it to accept the changes of differnet ip addresses

Re: [FW1] Strange message after installing FW-1 SP3

It is a mystery... I have the same error :) I'm fairly certain we (Solaris installs) all do. --- Nils Kolstein <[EMAIL PROTECTED]> wrote: > > Hi, > > I hope someone knows what's going on here.. Ater I > installed FW-1 SP 3 on my > Solaris 7 box I read the following error-message in > the fwd.

[FW1] CVP instructions ?

Does anybody have any documentation or directions on installing a Virus Server in the DMZ so that all traffic is inspected prior entry into the LAN ?    Regards,   Frank ___ Frank M. Olmstead Information Technology Manager Coreco iMAGING, Inc. 55 Middlesex Tur

RE: [FW1] VPN Standards (GRE??)

As in PPTP? You can config FW-1 to pass GRE but it doesn't act as a PPTP server itself. At the risk of offense, why on earth would you want to use PPTP? Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, May 01, 2001 1:47 PM To: [EMAIL PROTECTED

[FW1] 4.1 SP1 version of the GUI client

How can I get the 4.1 SP1 version of the GUI client ? Is build 41437 is SP1 of the GUI client ? I need this because I want to setup IKE and I must enable the Hybrid Mode ! I have Check Point 2000 v.4.1 SP2 (3DES) Edition. Thank's

Re: [FW1] RE: PPTP thru FW1

okay, I will explain this again. I know what your problem is. In the "Security Policy Tab", you should have two rules like this: (src,dest,svc,action,log) net-pptp-allowed, pptp-server, gre/pptp-tcp, accept, long pptp-server, net-pptp-allowed, gre/pptp-tcp, accept, long net-pptp-allowed should

Re: [FW1] RE:

My point is you can't use hide for the "server", but that is rather obvious... - Original Message - From: "Michel Toussaint" <[EMAIL PROTECTED]> To: "'Carl E. Mankinen'" <[EMAIL PROTECTED]>; "Naresh Narang" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Monday, April 30, 2001 1:49 PM Su

RE: [FW1] Dual-homing an interface on a DMZ

Uh...usually you dual-home a host with multiple interfaces. Is this what you mean or do you want to bind multiple addresses to a single interface? Chris -Original Message- From: Stafford, Todd [mailto:[EMAIL PROTECTED]] Sent: Tuesday, May 01, 2001 12:44 PM To: 'FW-1 Mail List' Subject:

Re: [FW1] software of intrusion detection

Before anyone finds out the hard way, this is not entirely true. 1) Checkpoint does not update the RealSecure product they sell as often as ISS does. If you want the LATEST up to date NIDS, you should purchase the ISS product directly. 2) You cannot use a RealSecure Workgroup Management Console

Re: [FW1] Problems with ssh and fw-1

With solaris 2.7 core installation you have no c or gcc compiler available. You should use Developer System support like this !  [ ]  Entire Distribution plus OEM support ... 1114.00 MB (F4 to Customize)  [ ]  Entire Distribution 1087.00 MB  [x]  Developer System Sup

AW: [FW1] unknown established tcp packet

In Version4.1 it is mainly after installing a new Rulebase, because the state tables are cleared on the "established" tcp connections are not recognized any more. Maybe you have installed the rulebase and some stupid application has not recognized yet that the connection has been droped. --Joer

Re: [FW1] Upgrade from CheckPoint 4.0 SP1 to 4.1 SP3

Upgrading to a Current FireWall-1 Release Q: What's the proper procedure for upgrading? A: Before upgrading: Make a backup of your $FWDIR, whatever that may be. Usually, nothing bad happens, but just in case it does, you have something to fall back on. Before beginning, make sure you have the ap

Re: [FW1] Passed CCSA.

You get the answers verbatim in the class for CCSE??? NOT in the classes that I took. Only a couple times do I remember thinking, "I heard that question in class". But those were for questions like "What ports does Firewall-1 use?" "What does the kernel daemon do?" Those are pretty generic que

RE: [FW1] Single management console , VPN between two firewall modules

Hi, U r better off and more secure if u give the actual IP address and not the natted one. Even if u give the natted IP address the same should work provided the proper rules are there in both the rule bases i.e. firewall A and firewall B. Hope it helps. Regards, Narendra -Original Me

[FW1] Solaris 2.7 FW 4.1 install problems

HI all   i am getting some strange errors when i run the InstallU on solaris 2.7   when i run it and do a cluster install   i get this error message   /cdrom/cp2000_des/wrappers/unix/Install.Solaris[1264]: /opt/CPfw1-41/bin/cpconfig: not found

AW: [FW1] Good question about Secure Remote and topology download

Hi back, I do not know if this explains your problem, but CheckpointFirewall-1 works its way through the rules sequential and the 1st / 1st rules that fits the circumstances is used. To me it looks as if the rule for client authentication is placed before the rules which request client encryptio

RE: [FW1] Installation Problems

Title: Installation Problems Hi,   Sorry but I do not understand what problem r u facing….. are u having no communication thru the firewall or what… could be that u ve not turned the logs on for the rules….would be nice if u could provide some more details of ur setup… can u ping both si

RE: [FW1] VPN Standards (GRE??)

Thanks Does anyone know any sites that talks about GRE. I need to do a comparision of VPN technologies (GRE, IPsec, L2TP). Whart are the Pro and Con's. Thanks AC To unsubscribe from this mailing list,

RE: [FW1] Multi-tier Firewall topology

Actually, everything behind FW and in front of the PIX is a traditional DMZ. I personally don't use different vendor FWs but if you're fearful of exploits or problems with a particular box, this is fine. Be aware of your network segments and address space though. I'm not sure how you're plannin

RE: [FW1] Source + Destination NAT

Hi Rani, Your NAT should include two rules for it. Original packet Translated Packet Source Destination Service Source Destination Service SERVERAny Any External_IP_of_SERVER Original Origina

RE: [FW1] RE: PPTP thru FW1

Hi, I have got the same working and my setup details are as follows : Services: Pptp-data : ip_p=47,[22:2,b]=0x880B (type of service is User defined service) PPTP-Highport : 34827 (type of service is TCP) PPTP-TCP : 1723 (type of service is tcp) Create a group called PPTP comprising of the abov

Re[2]: AW: [FW1] Secure Remote for Linux/Solaris, Macintosh ????

Bravo !! Friday, April 27, 2001, 1:17:41 AM, you wrote: CLP> Keep in mind FreeSWAN is not really a client. It is a really good CLP> gateway and requires a lot of setup to make it work. Checkpoint needs CLP> to build non-Windows clients. Linux and Mac OSX clients. CLP> cameron. CLP> [EMAIL

RE: [FW1] Source + Destination NAT

That worked ! Thanks to all who replied ! Still don't know why Firewall-1 did not like "ANY" Rani > -Original Message- > From: Paiement, Marc [SMTP:[EMAIL PROTECTED]] > Sent: Thursday, May 03, 2001 1:17 PM > To: 'Chouha, Rani'; '[EMAIL PROTECTED]' > Subject: RE: [FW1] Source + De

RE: [FW1] Upgrade from CheckPoint 4.0 SP1 to 4.1 SP3

Title: RE: [FW1] Upgrade from CheckPoint 4.0 SP1 to 4.1 SP3 I've heard bad things about FW-1 SP3; we upgraded 1 firewall (on NT), worked fine; upgraded another firewall, it BSOD'd beyond recovery.  The Checkpoint engineers we have "support" with said there are issues with SP3. -Original M

Re: [FW1] FW-1 and AOL

I think once you login AOL -- it uses HTTPS. I don't use AOL, so I could be mistaken. Do you allow HTTPS? Put a rule to allow access to AOL site(s) before your Websense rule for AOL as destination and HTTPS as service. My guess is it will work :) HTH -- Chris --- Greg Gonzalez <[EMAIL PROTEC

Re: [FW1] Should the use of 'any' be avoided where possible?

NEVER use "any" in a rule, unless you are forced toand the same should be said for service types. You should always start from a DENY ALL standpoint, then define only what is necessary, and nothing more. In some cases you would have to use "any", such as a rule to allow internet users to

RE: [FW1] Source + Destination NAT

You just need to create a Network Object that represent 0.0.0.0 with a subnet mask 0.0.0.0 and replace ANY by this object. -Original Message- From: Chouha, Rani [mailto:[EMAIL PROTECTED]] Sent: Tuesday, May 01, 2001 11:26 AM To: '[EMAIL PROTECTED]' Subject: [FW1] Source + Destination NAT

Re: [FW1] outlook slow or timesout through SecuRemote

DId you compare the performance with and without Securemote? - Original Message - From: "Jeff Lawn" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, May 02, 2001 8:36 PM Subject: [FW1] outlook slow or timesout through SecuRemote > > Any suggestions? > > [EMAIL PROTECTED] > >

RE: [FW1] beginner's question on DNS

Hi John, I believe you are asking how to get your FW-1 to resolve hostnames. I agree with Matthias and would absolutely not run a DNS server on the FW itself. If you need instruction on just getting the FW to resolve hostnames then shoot me an Email and I'll explain how. Are you running Solari

[FW1] problem with filtering http

Could anybody help me please? I used resources for filtering http request for normal users. Everything goes OK. Now I decide to add http proxy in my DMZ. And I want to use my rule with resource for filtering as I did before. My proxy is running on Win2k with 2 virtual IP. I add resource for my

[FW1] FWstatic and dynamic nat

We have a firewall that I need to do static and dynamic NAT on. I think I know what to do, but thought I'd run it by y'all first. We have internal servers, with private addresses, that will need to get to the internet, and will have access from the internet also. We have some workstations that

[FW1] FW-1 Intrusion Detection.

Title: RE: [FW1] NT Domain Regsitration through FIrewall-1 Does anyone know of any resources where I can find a comparision or various IDS packages that work in conjuction with FW-1?  I'm not asking which is better (that will vary by environment, of course), but I need to find out what the c

RE: [FW1] beginner's question on DNS

Title: RE: [FW1] beginner's question on DNS     John:     Here are some suggestions to check before proceeding further:     1. Your DNS server is sitting on the DMZ zone.     2. There is a static route that points to the DNS server on the router that the CheckPoint Firewall