Re: [FW-1] /$FWDIR/spool

Hi,   Each mail is a seperate file in the $FWDIR/spool directory.  On a sun machine it is anyway.   Regards,   Werner -Original Message-From: Holland, Stephen [mailto:[EMAIL PROTECTED]]Sent: Thursday, October 18, 2001 8:08 PMTo: [EMAIL PROTECTED]Subject: [FW-1] /$FWDIR/s

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

John Mitchell wrote: > > I run NAV with FW1 v4.1. How is it not compatible? > The point is that NAV is no longer OPSEC certified... -- Martin H. Hoz-Salvador EX-A-IEC, EX-A-FIME http://gama.fime.uanl.mx/~mhoz "Gimme a firewall sandwich with packet filter bread and fast ethernet mustard. No p

Re: [FW-1] fwtable.pl

I did notice all that, but I was still having the problem. But it turns out it was not the script so my apologies to Lance. fwtable.pl is doing exactly what it is supposed to do the problem is that when I do a fw tab -t connections target_ip_of_firewall_module from the Management station the tim

Re: [FW-1] fwtable.pl

Looking at the script, he is not modifying that Timeout field other than to take off the trailing ">" from the end of line output of the `$FWDIR/bin/fw tab -t connections -max $max $target` command. The script then prints the timeout field to a length of 9 chars, starting at character 81 of the l

Re: [FW-1] Windows XP Pro

Title: Message Actually I had a working install on Win2k unexpectedly early.. XP seems to work fine as well, as long as you use sp5 or ng   Frank   -Original Message- From: Firewall-1 (Joe Voisin) [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 3:27 PM To: [EMAIL P

Re: [FW-1] FreeS/WAN as a Linux "SecureClient"

I have done this multiple times and haven't had any issues... I use it at home! the doc is helpful if you are a Linux newbie.. -Original Message- From: John Castillo [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 7:29 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] FreeS/WAN a

Re: [FW-1] Windows XP Pro

According to reliable sources, XP pro works with SecuRemote/SC 4.1 SP5, as well as SecuRemote NG ymmv Frank -Original Message- From: Alexey Vitashkevich [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 3:58 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Windows XP Pro I've

[FW-1] Checkpoint 4.1 on NT

I have just joined the discussion list, so have mercy if someone has already asked this question. I have a site that we need to FTP files from, I have been fighting with this for over 1 month now and we have just realized that the reason we cannot get into this persons ftp server is because his

Re: [FW-1] FreeS/WAN as a Linux "SecureClient"

i was able to pull this off with a remote linux user. not sure what hoops he went through so i dare not attempt the linux-side explanation. took some doing but the doc helped a little bit. as it stands now, it works. the tunnel breaks if you push a policy but aside from that it works fine... O

[FW-1] FreeS/WAN as a Linux "SecureClient"

For those of you who have setup FreeS/WAN and Checkpoint VPN-1, did the document "Linux as a VPN Client to FireWall-1" help in setting this up? Its seems to be the right document for the task, except that it asks you to setup the linux vpn box as a workstation object, then select the IKE / Shared

[FW-1] TCP session timeout and long FTP transfers

Hello, I'm seeing the following behavior on my firewall: when during FTP session the file transfer takes longer than TCP session timeout, the FTP control connection gets removed from the state table, even though there's activity on the ftp-data channel. Is this supposed to be like that ? I'd assu

Re: [FW-1] Problem blocking CodeRed with http resource

To prevent this create a new URI resource (called for example: NIMDA_URI), type "wildcard" match, and in the match properties select: Scheme: HTTP Method: GET Host: * Path: {*cmd.exe,*root.exe,*admin.dll,*readme.exe,*readme.eml,default.ida} Use this resource in a rule at the top of the rulebase:

Re: [FW-1] Problem blocking CodeRed with http resource

This is regarding what i have configured. Name: Block-Http-Exploits Comment : Nimda-Sand-CodeRed Color : Dark Red Connection Methods : Transparent, Proxy Exception Tr

[FW-1] Anti-spoofing

Hi all, Does anybody know what direction anti-spoofing is apllied (Inbound, Outbound or both of them) ? Thanks in advance. "Esta mensagem tem conteúdo informativo e não constitui obrigação ou responsabilidade das empresas integrantes do Grupo Safra. O sigilo desta mensagem é protegido p

Re: [FW-1] Windows XP Pro

I've tried two things ..one is clean install of XP and SR - doesn't work ...then I tried to upgrade 2000 to XP See no problems so far -Original Message- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED]] On Behalf Of David Phillips CISSP Sent: Thursday, O

[FW-1] User Center

Trying to move a metaip license... So user center is down. I cannot get support. I e-mailed them 3 times last week - no response. I Called in, and they say to use the website user center then hang up on me (voice mail system). I spend 45 minutes getting a user center account. Then I try an

Re: [FW-1] Windows XP Pro

Title: Message Interesting,   I have it working fully on my Windows XP Pro Machine.  It's a Thinkpad T-21 with 192Mb RAM and a 3COM integrated NIC.   I have got SSO and SDL both working fine.  I did install the NG version of the Securemote client.   Should be interesting to see how l

Re: [FW-1] Windows XP Pro

I have had some success installing SR/SecureClient on XP, some meaning that depending on what type of adapter I am using. One I know for sure has worked perfectly was Xircom. I was told that Checkpoint is trying to come up with something noteworthy for installations on XP...not that I understa

Re: [FW-1] Problem blocking CodeRed with http resource

Yes, the original working rule is still in there. (Not localnet -> ActiveWebServers http accept) The blockage only occurs on http public net -> DMZ net It still works fine from private new -> DMZ net There is NAT running, but I dont see how it would hurt (of course I have been surprised before)

Re: [FW-1] Windows XP Pro

Title: Message Ah!  Finally a question I can answer!!   Whether SR works on XP or not seems to be dependent on the configuration you're using it in.   I have attempted to install SR/SecureClient on Build 2600 of XP on 5 different machines.  ANYplace I've tried to install iton the LAN adapters, i

[FW-1] /$FWDIR/spool

How do you see what mail is in the spool?  Also does the spool change when new mail comes in my file has a last written to date of June?    

Re: [FW-1] Accessing Servers via Public IPs from Private Network

> -Original Message- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > Sent: Wednesday, October 17, 2001 11:30 AM > To: [EMAIL PROTECTED] > Subject: [FW-1] Accessing Servers via Public IPs from Private Network > > > My question is, can the workstations within the > private network als

[FW-1] Checkpoint and CacheFlow

    I am in the process of configuring a CacheFlow to compliment my Checkpoint/Nokia. Has anyone had any success configuring the CacheFlow for Transparent configuration? I do not own a layer 4 switch, and I have to use Cisco’s WCCP protocol to accomplish the transparent caching. Is

Re: [FW-1] help on port

MSN Messenger should reside on tcp port 1863 MSN Messenger Service establishes an outgoing TCP connection from port 6901 for all voice communications. In the case of computer-to-computer communications, the call recipient also uses TCP port 6901. In the case of computer-to-phone communications,

[FW-1] FW doing a NBNAME port scan

What would cause NT 4.0, FW1 4.1 SP4 to do a port NBNAME port scan? My logs show about 3 times a minute, the source is the firewall - the destination is a private network that doesn't exist - and it's blocked by rule 0. It started with 172.21.x.x and is up to 172.23.x.x. This started happening

Re: [FW-1] Anti-Spoofing

Anders 's response should have clarify most if not all of your question. Just to add that, while you don't need add hide NAT address on the Others+ 's group, you do need that for static NAT. Just a reminder. At 10:52 AM 10/17/01 +0200, you wrote: >> -Original Message- >> From: Bourque Da

Re: [FW-1] Windows XP Pro

Title: Message yes ...it is working good ... -Original Message-From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED]] On Behalf Of Tony SodaroSent: Thursday, October 18, 2001 12:17 PMTo: [EMAIL PROTECTED]Subject: [FW-1] Windows XP Pro Has

Re: [FW-1] Logging to mysql

You can find some example scripts at Lance Spitzner's site (http://www.enteract.com/~spitzner) which has some good info on doing this. Basically, as I understand it, you just create a user defined script which parses the log alert and add's it to the table. If anyone knows how to do both, log

Re: [FW-1] Problem blocking CodeRed with http resource

Have you added a rule under the BlockNimda rule to allow the rest of the http traffic??? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 5:11 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Problem blocking CodeRed with http resource A

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

Have you considered Sophos? -Original Message- From: Sancho Lerena [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 11:27 AM To: [EMAIL PROTECTED] Subject: Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls At 00:00 18/10/2001 -0700, Erin Young wrote: >I am looking for

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

I run NAV with FW1 v4.1. How is it not compatible? John Erin Young wrote: > I am looking for a replacement to NAV for firewalls since it is not > compatible with fw1 v4.1. Might I ask this list for some of thier opinions > on the anti-virus solutions availble for gateways. Currently I am looki

[FW-1] Windows XP Pro

Has any one tried to use Secure remote with the new release build 2600 of Windows XP.   Thanks Tony Sodaro   Tony Sodaro Houston, Texas, USA 281-228-7231 (O) 281-844-4330 (C) 281-853-2531 (Fax)

[FW-1] help on port

All, I have blocked tcp port 1214 to get rid of Kazaa, Napster, etc. I have since found out that MSN Messenger has also been blocked. Anyone have any ideas as to how to let MSN through but still block the peer2peer stuff? Jeff -- "Computers are useless. They

[FW-1] SecuRemote and IKE

Hey Guys, I got a question for you. I have securemote pushed out to few users here and everything seemed to be well. In fact, I even got securemote to resolve to my internal DNS server to domain names could be used. Today, none of my users are able to connect. I keep getting payload malformed

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

At 00:00 18/10/2001 -0700, Erin Young wrote: >I am looking for a replacement to NAV for firewalls since it is not >compatible with fw1 v4.1. Might I ask this list for some of thier opinions >on the anti-virus solutions availble for gateways. Currently I am looking at >Trend Micro's Interscan and M

Re: [FW-1] SecuRemote vpn-1 sp4

Problem also lies in that it would seem that they've forced ike by default which breaks any fwz securemote users. On 2001.10.18 09:08 Steven Thomason wrote: > Also, I have had the same problem. You use to be able to have multiple > options selected such as FWZ and IKE. Now with the latest service

Re: [FW-1] Any truly global managed security companies out there?

You may contact NextGen Internet. www.nextgeninter.net Luis Cuenca Gerente de Desarrollo Tecnologico e-Security, m-Business COSAPI SOFT S.A. Telef. +51-1-3133202, Fax: +51-1-4371606 Celular: +51-1-9701662, Nextel: +51-1-8122607 Av. Javier Prado Este 4491, Surco, Lima 33, Peru http://www.cosapiso

Re: [FW-1] Any truly global managed security companies out there?

Check out www.counterpane.com. -Original Message- From: Greg Winkler [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 8:16 AM To: [EMAIL PROTECTED] Subject: [FW-1] Any truly global managed security companies out there? My company is considering outsourcing management of our

Re: [FW-1] 1 management station for 2 different firewalls

> 1 - Use the same policy for every firewalls using common rules and other > rules for specific gateways. > You'll have to comment very well every rule and use a good color scheme > to avoid confusion. > This can be a very confused option if you have many rules and few of > them common to

Re: [FW-1] External and internal interfaces identification

Unless you have an unlimited license, i suppose than like me you have a Gateway/n license, you can't. In fact you can have only ONE external interface, FW-1 Gateways will count all other interface hosts as internal hosts and count them in the licence used count. In the case of an unlimited licen

Re: [FW-1] Problem blocking CodeRed with http resource

Ah thank you. Any idea why it is not working though? -Original Message- From: Werner.Brockhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 5:14 AM To: FW-1-MAILINGLIST Subject: Re: [FW-1] Problem blocking CodeRed with http resource Hi, You'll also want to add readme.e

[FW-1] fwtable.pl

Hello, I'm trying to use the fwtable.pl script written by Lance Spitzner and everything seems ok except for the reporting of time out. For the udp connections I see negative numbers, -14390/40 and for some tcp connections I'm seeing the time used higher than the time out, 6200/2086 Has anyone e

Re: [FW-1] Any truly global managed security companies out there?

We are ..check our web site. www.nextgeninter.net Alexey Vitashkevich Security Consultant. MSCE, CNE, CCSE Nextgen Internet tel : (609) 419-0531 ext. 107 cell : (609) 548-1252 www.nextgeninter.net -Original Message- From: Mailing list for discussion o

Re: [FW-1] External and internal interfaces identification

To have it not count hosts on multiple interfaces you either need an unlimited license, or Checpoint NG where you can specify multiple interfaces as external. -Original Message- From: Francois Dessart [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 4:19 AM To: [EMAIL PROTECTED

[FW-1] Boyd D Chamberlain/Minerals_Tech is out of the office.

I will be out of the office starting 10/18/2001 and will not return until 10/19/2001. I will respond to your message when I return. ** This email and any files transmitted with it are confidential and intended solely for the

Re: [FW-1] SecuRemote vpn-1 sp4

Also, I have had the same problem. You use to be able to have multiple options selected such as FWZ and IKE. Now with the latest service pack you must have only ONE option set for it to work correctly. For me to get secure clients to work correctly, I only choose IKE, 3DES, and whatever other opti

Re: [FW-1] Any truly global managed security companies out there?

Use IBM. They are pretty good. ** Roman Zeltser, @National Computer Center, RSIS & DNE -Original Message- From: Greg Winkler [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 18, 2001 8:16 AM To: [EMAIL PROTECTED] Subject: [FW-1] Any truly global manage

[FW-1] Any truly global managed security companies out there?

My company is considering outsourcing management of our firewalls. Is there a managed firewall/security company that has a global capability. We are not a large company but we have operations globaly (USA, U.K., Western Europe, Australia, Africa, Pacific Rim). They will need to specialize in firew

Re: [FW-1] VERY Off Topic - Sorry

This is a multipart message in MIME format. --=_alternative 004955F200256AE9_= Content-Type: text/plain; charset="us-ascii" I have received several replies on this - thanks to all - at least I've tried pretty much everything now. For the record I have surrendered on this one - nothing seems to w

[FW-1] STP = Land Attack?

Has anyone had any incidences where spanning tree causes false positives for a MAD land_attack? I have a series of firewalls seperated by Nortel switches running spanning tree, and I am getting loads of land_attacks. This network isn't connected to the internet, and isn't in use; the applicat

Re: [FW-1] External and internal interfaces identification

Title: RE: [FW-1] External and internal interfaces identification If you buy a limited IP license, you only get to nominate one interface as 'external'. All others are considered to be 'protected interfaces'. So even if you set up a DMZ or EDMZ (Extranet De-Militarised Zone), those hosts are

[FW-1] securemote behind ADSL and wingate ?

hi, I have a Wingate machine connected to my ADSL modem and behind it I have a client. Can this client work with SR ? behind ASDL and Wingate ? Best regards, Idan Dolev, === To unsubscribe from this mailing list, please see the instructions at http

Re: [FW-1] External and internal interfaces identification

Hi, I've experienced that and you can only configure one external interface. This external interface will have to be one of yours external interfaces, no matter wich one of them. In this situation you will have to buy/upgrade your license to unlimited hosts. Rodrigo

Re: [FW-1] External and internal interfaces identification

Francois, This is only important if you have a limited license, an unlimited license does not count this. With 4.1, you could have only one External Interface, all others were seen as Internal and were counting in the license. What is more important is the anti-spoofing settings of the Inte

Re: [FW-1] 1 management station for 2 different firewalls

Francois, To me your only option is to define all your objects, they are thus common to both Firewalls as you can have only one objects.C file, then either create two separate policies and install them separately on the two Firewalls, or create one policy and in the install on select on wh

Re: [FW-1] External and internal interfaces identification

You tell it during installation / configuration. Cheers, Anders :) > -Original Message- > From: Francois Dessart [mailto:[EMAIL PROTECTED]] > Sent: 18. oktober 2001 10:19 > To: [EMAIL PROTECTED] > Subject: [FW-1] External and internal interfaces identification > > > Hello, > > I (will)

Re: [FW-1] Problems with domain-tcp

- Check the logs for the reason its being dropped. - Try with different rules, like: Source:Destination:Service: Action: Anyour-dns-server-on-dmz

Re: [FW-1] External and internal interfaces identification

Hi, If you have an unlimited license don't think about it. Otherwise take the name of the interface to the internet and put it into the file $FWDIR/conf/external.if (e.g. eth0). You can only set ONE external interface. If you will have two or more interfaces to the internet (two or more provider

Re: [FW-1] External and internal interfaces identification

Title: RE: [FW-1] External and internal interfaces identification If you buy a limited IP license, you only get to nominate one interface as 'external'. All others are considered to be 'protected interfaces'. So even if you set up a DMZ or EDMZ (Extranet De-Militarised Zone), those hosts are

Re: [FW-1] AOL and Windows 2000 + securemote = pain

This is a multipart message in MIME format. --=_alternative 003A822C00256AE9_= Content-Type: text/plain; charset="us-ascii" AOL is one the few ISPs we specifically ban because of their proprietary approach, using strange protocols etc. Tim Patrick Lotti <[EMAIL PROTECTED]> Sent by: Mailing l

Re: [FW-1] 1 management station for 2 different firewalls

Hi, You have two options: 1 - Use the same policy for every firewalls using common rules and other rules for specific gateways. You'll have to comment very well every rule and use a good color scheme to avoid confusion. This can be a very confused option if you have many rules and few of

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

Hi for updating trend micro (all its antivirus products) you only copy manually the lpt* file to the folder where the software is installed and reboot the machine; for the engine the same In fact the virus signature file is the same for all the antivirus products (pc cillin, officescan, viruswal

[FW-1]

Title: Hi, One of my firewalls has been showing some unusual activity on the external interface today. The logs in question show: IF  eth0 (internal) Action  drop Service (blank) Source  internal broadcast address Dest    various internal PC's Proto   icmp Rule    (blank) Info

[FW-1] 1 management station for 2 different firewalls

Hello, I would like to use one management station for 2 different firewalls modules (they must have different policies). How can I use my central Policy Editor to manage both firewalls, with different policies? Thanks for your help. Francois

Re: [FW-1] Problem blocking CodeRed with http resource

Hi, You'll also want to add readme.eml Regards, Werner -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 17, 2001 9:47 PM To: [EMAIL PROTECTED] Subject: [FW-1] Problem blocking CodeRed with http resource Hey all I picked up the way to do

Re: [FW-1] Problems with domain-tcp

> If I change the checkbox that I mentioned above to "true" all > domain-tcp packets from everywhere go trough the FW1-box. This doesn't sound right.. you have a choice of enabling this "First", "Last", or "Before Last", don't you? If you enable it "First", the rule that allows domain-tcp will b

[FW-1] External and internal interfaces identification

Hello, I (will) have a firewall with multiple internal and external interfaces. How does FW-1 know which ones are internals and other externals? I think it's important for it not to count hosts on external interfaces. Thanks for your help. Francois -

Re: [FW-1] Anti-Virus - Replacement for NAV for Firewalls

On Thu, Oct 18, 2001 at 12:00:48AM -0700, Erin Young wrote: > I am looking for a replacement to NAV for firewalls since it is not > compatible with fw1 v4.1. Might I ask this list for some of thier opinions > on the anti-virus solutions availble for gateways. Currently I am looking at > Trend Micr

Re: [FW-1] AOL and Windows 2000 + securemote = pain

> I have a user that insists that he MUST have AOL as his internet provider as they >have the best > coverage for dialup numbers. Take a 0800- provider. They have full coverage, almost all around the world. Idea is similar to mobile phone roaming :) ==

[FW-1] Anti-Virus - Replacement for NAV for Firewalls

I am looking for a replacement to NAV for firewalls since it is not compatible with fw1 v4.1. Might I ask this list for some of thier opinions on the anti-virus solutions availble for gateways. Currently I am looking at Trend Micro's Interscan and Mcafee's e500 appliance. Also, I am trying to set

Re: [FW-1] Getting New Nokias

Jason, In my opinion the knowledge base of Nokia is also very usefull and contains a lot of good articles (called resolutions in their language). I used some of them to configure from scratch my first Nokias. Met vriendelijke groeten - Bien à vous - Kind regards Guy ROELANDTS EMEA GS Inter

[FW-1] Problems with domain-tcp

Hi, I`m using FW1 4.1 SP4 on NT 4.0 and have the following problem with domain-tcp. Setup from Properties on the Properties Setup on FW1 * Accept Domain Name Over TCP (Zone Tranfer) = not enabled (off) A rule before the cleanup rule is as follow: Soruce:Destination: