- VPN-1 Express Gateway
- VPN-1 SecuRemote
- Firewall-1
- SmartDefense
- SmartCenter
Friday, January 7, 2011
What is included in the Express license
Thursday, January 6, 2011
How to reconstruct Rulebases
The Motif/Windows GUI uses the rulebases.fws file. to recreate this file for whatever reason. If you have rulebase.W files in your conf directory, quit any open GUIs and recreate this file as follows:
Note: These commands will not work on NG FP2 and above. In fact, in NG FP2, they can cause further corruption of your rulebase file. On Unix:
# cd $FWDIR/conf
# fwm -g *.W
On NT:
c:\> cd %FWDIR%\conf
c:\WINNT\FW\conf> for %i in (*.W) do fw fwm -g %i
The differences are:
Other notes:
- On Unix, the * is interpreted as a wildcard, including all .W files
- On NT, the * is not interpreted as a wildcard, so you must list the .W files individually.
- On NT, there is no 'fwm' binary, but it is included as part of fw.exe
- When importing rulebase files, if objects referenced in a specific rulebase no longer exist, then the rulebase in question will not be successfully imported. You will see "Not in Scope" messages when you run this command. This is normal.
- These steps will cause CORRUPTION of your rulebase file in NG FP2 as this command is no longer supported. NG FP3 and later do not allow the commands (e.g. executing fwm -g *.W nets a 'this command is no longer supported' message
Wednesday, January 5, 2011
How to block Kazaa and other network sharing programs
Blocking of Kazaa under NG AI is as follows
Open SmartDefence window
Application Intelligence / Web / HTTP Protocol Inspection / Peer to Peer
You will see the application, chech which you want to blok and check Peer to Peer.
Select the configuration apply to all connection in HTTP Protocol Inspection.
If you want to know more about Kazaa or you run a version previous to NG AI
Initial configuration of Kazaa version 1
Kazaa is only one of a whole culture of peer-to-peer file-sharing networks/programs: Gnutella, eDonkey, BearShare, etc ad infinitum
Kazaa version 2 uses dynamic ports
How to block it on a firewall
Block them by port number. This doesn't scale well, and fails completely with the ones that search for unblocked port numbers to
use. (While to you, a firewall should be a "policy enforcement device", to your users and the authors of these applications, it's just an obstacle to be surmounted.)
If a client uses a HTTP port program like KazaaHTTP, there are very few options that you have as it will tunnel the kazaa traffic over HTTP from the client’s desktop. If you have a novice userbase, simply blocking the port of 1214 should suffice.
If you are using Checkpoint NG, FP3 is supposed to include the additional content filtering needed to block applications like Kazaa.
If you are blocking port 1214, you also have to block all outgoing socks-traffic, because kazaa-client supports Socks-Proxy and
there exists enough free socks-proxy. The second thing, if you are blocking socks then you also have to block all outgoing http/https-traffic, because you can tunnel socks-traffic over http/https with tools like httport.
How to block it on a Cisco router
access-list 101 deny tcp any any eq 1214
What measure you should take
Add a content-filtering solution to your border security. This is about the only way you're going to block stuff that piggy-backs on
well-known service ports (80, 25, etc) in order to circumvent firewalls.
What you should also know about Kazaa
Unfortunately when you install KaZaa you also get at least one virus installed on your computer. I call it a virus because by most descriptions I've seen of the term, TopText qualifies as a virus. You don't ask for it. It takes control of your browser and makes changes to everything you read on the Internet.
TopText operates with a browser to highlight words on every web page, inserting a yellow background behind keywords that have been purchased through their media sales company eZula, Inc. If a web user clicks on one of those yellow highlighted words on a web page, the user is whisked away to the site of the company paying the most that day for each click-through. If a user whose browser is infected with TopText visits your web site, they will be offered links to competitor's web sites for every keyword they find on your site for which they have a buyer.
This is not much, if any, different from the Smart Tags system that Microsoft announced for their Windows XP browser. Media and webmaster pressure and outrage caused Microsoft to cancel, for now, their release of that feature.
Open SmartDefence window
Application Intelligence / Web / HTTP Protocol Inspection / Peer to Peer
You will see the application, chech which you want to blok and check Peer to Peer.
Select the configuration apply to all connection in HTTP Protocol Inspection.
If you want to know more about Kazaa or you run a version previous to NG AI
Initial configuration of Kazaa version 1
Kazaa is only one of a whole culture of peer-to-peer file-sharing networks/programs: Gnutella, eDonkey, BearShare, etc ad infinitum
Kazaa version 2 uses dynamic ports
How to block it on a firewall
Block them by port number. This doesn't scale well, and fails completely with the ones that search for unblocked port numbers to
use. (While to you, a firewall should be a "policy enforcement device", to your users and the authors of these applications, it's just an obstacle to be surmounted.)
If a client uses a HTTP port program like KazaaHTTP, there are very few options that you have as it will tunnel the kazaa traffic over HTTP from the client’s desktop. If you have a novice userbase, simply blocking the port of 1214 should suffice.
If you are using Checkpoint NG, FP3 is supposed to include the additional content filtering needed to block applications like Kazaa.
If you are blocking port 1214, you also have to block all outgoing socks-traffic, because kazaa-client supports Socks-Proxy and
there exists enough free socks-proxy. The second thing, if you are blocking socks then you also have to block all outgoing http/https-traffic, because you can tunnel socks-traffic over http/https with tools like httport.
How to block it on a Cisco router
access-list 101 deny tcp any any eq 1214
What measure you should take
Add a content-filtering solution to your border security. This is about the only way you're going to block stuff that piggy-backs on
well-known service ports (80, 25, etc) in order to circumvent firewalls.
What you should also know about Kazaa
Unfortunately when you install KaZaa you also get at least one virus installed on your computer. I call it a virus because by most descriptions I've seen of the term, TopText qualifies as a virus. You don't ask for it. It takes control of your browser and makes changes to everything you read on the Internet.
TopText operates with a browser to highlight words on every web page, inserting a yellow background behind keywords that have been purchased through their media sales company eZula, Inc. If a web user clicks on one of those yellow highlighted words on a web page, the user is whisked away to the site of the company paying the most that day for each click-through. If a user whose browser is infected with TopText visits your web site, they will be offered links to competitor's web sites for every keyword they find on your site for which they have a buyer.
This is not much, if any, different from the Smart Tags system that Microsoft announced for their Windows XP browser. Media and webmaster pressure and outrage caused Microsoft to cancel, for now, their release of that feature.
Tuesday, January 4, 2011
How to understand and configure MAD
MAD is Malicious Activity Detection, a process that runs on the Management server and will periodically review the logs to find suspicious behaviour. (Multiple auth failures, port scan, syn and land attacks.)
MAD detects/defends:
- Syn-Attacks
- Spoofing attempts (for local interfaces, too)
- portscan detection
- blocked ports scan detection
- login failures
- fast repeated connects
- land attacks
MAD land attack
It is CPMAD that tell you it sees a land attack. Check the cpmad_config.conf file (in $FWDIR/conf) and you should find line containing _land_attck_ in it. A land attack sends out just one SYN packet in which the sending device IP address has been replaced with the address of the destination, meaning that it tries to answer to it's own, resulting in loop backed packets ... slowing down the server.
MAD configuration
The configuration of Checkpoint's Malicious Activity Detection System is done through the file $FWDIR/conf/cpmad_config.conf. For Information on how use the variables in the file, take a look in the EntGS.pdf file located on the installation CD-rom (v4.1).
MAD detects/defends:
- Syn-Attacks
- Spoofing attempts (for local interfaces, too)
- portscan detection
- blocked ports scan detection
- login failures
- fast repeated connects
- land attacks
MAD land attack
It is CPMAD that tell you it sees a land attack. Check the cpmad_config.conf file (in $FWDIR/conf) and you should find line containing _land_attck_ in it. A land attack sends out just one SYN packet in which the sending device IP address has been replaced with the address of the destination, meaning that it tries to answer to it's own, resulting in loop backed packets ... slowing down the server.
MAD configuration
The configuration of Checkpoint's Malicious Activity Detection System is done through the file $FWDIR/conf/cpmad_config.conf. For Information on how use the variables in the file, take a look in the EntGS.pdf file located on the installation CD-rom (v4.1).
Monday, January 3, 2011
How to allow DHCP on the firewall or through the firewall
In some situations it is necessary to run a DHCP server on the firewall, but it should be avoided when ever possible. As has been mentioned, you probably shouldn't be running a DHCP server on
your firewall. Your firewall should be your firewall, and little or nothing else.
That said, the only reason FW-1 should interfere with DHCP is if you have rules preventing the traffic. You'll need to allow UDP/67 *to* the FW, and UDP/68 *from* the FW, both on the
interfaces that you wish to provide BOOTP/DHCP services to. Note that your normal stealth rule will prevent any such traffic, and the rules to allow the DHCP traffic will need to be in front of the stealth rule.
On Nokia firewalls you have a DHCP relay capacity that allows you to have access to a DHCP server and that you have to pass through the firewall. Off the main config menu, BOOTP Relay, is what you want.
You will also need to add to your rulebase something to the effect of:
DHCP_Servers Firewalls BOOTP ACCEPT
your firewall. Your firewall should be your firewall, and little or nothing else.
That said, the only reason FW-1 should interfere with DHCP is if you have rules preventing the traffic. You'll need to allow UDP/67 *to* the FW, and UDP/68 *from* the FW, both on the
interfaces that you wish to provide BOOTP/DHCP services to. Note that your normal stealth rule will prevent any such traffic, and the rules to allow the DHCP traffic will need to be in front of the stealth rule.
On Nokia firewalls you have a DHCP relay capacity that allows you to have access to a DHCP server and that you have to pass through the firewall. Off the main config menu, BOOTP Relay, is what you want.
You will also need to add to your rulebase something to the effect of:
DHCP_Servers Firewalls BOOTP ACCEPT
Sunday, January 2, 2011
can I use a published IP address to "hide" multiple DMZ servers, and direct traffic to the correct server based on the service involved
"All you do is create a STATIC NAT rule with the proper settings. (actually two rules in NAT tab, and two in the rulebase)
lets say your outside IP is 1.1.1.1 and you have two servers inside at 192.168.1.1 (ftp) and 192.168.1.2 (http)
On the NAT tab,
orig src = any
orig dest = 1.1.1.1
orig svc = ftp
xlat src = any
xlat dest = 192.168.1.1
xlat svc = original
orig src = any
orig dest = 1.1.1.1
orig svc = http
xlat src = any
xlat dest = 192.168.1.2
xlat svc = original
and then the obvious rulebase entries to allow packets to enter/leave various interfaces."
lets say your outside IP is 1.1.1.1 and you have two servers inside at 192.168.1.1 (ftp) and 192.168.1.2 (http)
On the NAT tab,
orig src = any
orig dest = 1.1.1.1
orig svc = ftp
xlat src = any
xlat dest = 192.168.1.1
xlat svc = original
orig src = any
orig dest = 1.1.1.1
orig svc = http
xlat src = any
xlat dest = 192.168.1.2
xlat svc = original
and then the obvious rulebase entries to allow packets to enter/leave various interfaces."
Saturday, January 1, 2011
Secure DNS accesses
You will need to restrict services as defined below. But pay a special attention to Dynamic updates if you are using or planning to use them.
allow udp 53 in from outside to dns server [queries to your server]
allow udp 53 in from dns server to outside [queries from your server]
allow tcp 53 in from secondaries or ISP server to dns server [zone transfers from your server]
allow tcp 53 out from dns server to outside [zone transfers from primaries, for which you are a secondary]
allow udp 53 in from outside to dns server [queries to your server]
allow udp 53 in from dns server to outside [queries from your server]
allow tcp 53 in from secondaries or ISP server to dns server [zone transfers from your server]
allow tcp 53 out from dns server to outside [zone transfers from primaries, for which you are a secondary]
Note: queries normally use udp, but apparently also use tcp under load, so restrict queries to udp may cause headaches in some situations.
If you want to enable dynamic updates, despite the additional risk, use TSIG for better authentication of hosts allowed to make updates. Always restrict updates via an ACL.
If you want to enable dynamic updates, despite the additional risk, use TSIG for better authentication of hosts allowed to make updates. Always restrict updates via an ACL.
Subscribe to:
Posts (Atom)