Enterprise Firewalls

Quote:

---

Originally posted by mrwall
Thanks,

Hey, wich name do u go by on the List? and when did I help? :)

I rule, don't I? :)

BTW, I answered your Q, check it out,

Hope I helped,
etsh911

---

I went by the same name for the most part but have had many other names that I used to use way back (c4rp3dm, VOeyeP, and more....lol) It has been a while since I have posted there, so I don't remember specifically what problems you have helped me with.

I use the wizards more as a reference in case I forget something...I am good enough with Checkpoint now to work through many of the problems I come across. But don't worrk...I am still keeping an eye out ;)

and yes you do rule :o

lol,

NP guys, so, time to put this thread to an end :)

Start a new one :0

Yours,
etsh911

Quote:

---

Originally posted by mrwall
those are NOT attacks that I get afraid of.

---

But they are vulnerabilities none the less.

Quote:

---

Originally posted by mrwall
and BTW, yea, I am an engineer for CP <an OPSEC partner actually, not CP itself> and when you talked about un-disclosed vuln.s I thought of BS.

---

I did not mean to insult your life's work. Really.

Quote:

---

Originally posted by mrwall
Yet, we do have reported issues :\, but look at the bright side, they aren't serious :)

Ciaz,
etsh911

---

What would you consider "not serious"? just curious.....

Quote:

---

Originally posted by KorpDeath
I'm glad you cleared it all up for me. My mistake, Checkpoint FW-1 is god, your right.

I'm still using Sunscreen though, although you almost converted me.............

---

It's really too bad that Sunscreen is going away soon though. I think it is gonna be EOL'd in a couple of weeks. I've got some inside information....and it is from a pretty reliable source.

Quote:

---

Originally posted by iNViCTuS


It's really too bad that Sunscreen is going away soon though. I think it is gonna be EOL'd in a couple of weeks. I've got some inside information....and it is from a pretty reliable source.

---

That really does suck because the product is as solid as products get. I've been hoping someone will by the rights and do more with it cause it's certainly deserves more than the shelf. Know what I mean?

One hint for those using Checkpoint installed on Nokia devices...Keep away from automatic translation rules or keep them to a max of 30. Anymore than that will put a great strain on the system.
Plan your DMZ routes and use multihomed web servers within the DMZ with two physical networks.
Inbound and secure lan traffic.
Use a distributed environment only.
Do not install VPN policy server object on the management station. Use the Nokia for that.

Keep up with patches for IPSO and FW1.

wilber is right...you do not want to use automatic NAT rules if you can avoid it. Just do them manually...it is much easier anyway. As far as the dual-homed idea for the web servers though...I don't know about that. Why would you want to connect your web servers directly to the private LAN. IMHO, not a good idea. If you need a database connection from the web servers to the LAN or something like that...consider adding another firewall to create a multilayered environment. The reason I would not add the second NIC connected to my LAN is because if that host is compromised, the attacker now also has a direct connection to the LAN. This completely negates the purpose of having a DMZ.

Too true. Multi-homed DMZ boxes is NOT a good idea.

KorpDeath you seem to have knowldege on this area but one problem you seem to be stuck on vunrabilites everything has vunrabilites so just cause it has a vunrability is no reason to stop using it that would be like not eating some canned food cause the tine was dentead now thats just silly ins it so well thats my 2 cencts

the only reason I would see for a multi homed dmz box is for a control channel NOT leading the inside lan. ;) That's why I do it anyway.

About the auto trans rules - totally agree. They have always given me problems so I do all manually. What's most amusing is when I''ve got a ckp eng over for some work and I have to explain them all. :D