Security

Ask something
Discussion Locked

Check Point Firewall routing

0 helpful
3 replies

by paynen

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have Checkpoint running on NT and my external interface make connections to web servers on the internet all the time and when I do an netstat -a, I can see many ports open to other destination servers on port 80. Is this normal?

3 replies

by dpimlott

Are you using the http security server? if you are using CVP servers (like eSafe or WEBSense) then you probably are.
Are you using http resource rules? If you are, then you are using the http security server and the connections from the firewall toremote web servers is fine.

If you are not using resource rules and want to disable the http security server, have a look at fwauthd.conf in either $FWDIR/conf (unix) or %FWDIR%\conf (NT) and look for the line that says:
80 in.ahttpd
to disable the security server change the line to read:
0 in.ahttpd

Hope this helps

by paynen

I found out the issue - all the traffic coming in from the internet is sent to a virus wall to check for viruses and then the virus wall sends that traffic back to Checkpoint to be routed to the internal network. Would this explain the port 80 connections?

by mshavrov

Is it inbound or outbound connections? If it are outbound connections and your users DO NOT go to this sites, first I can suspect - isn't your NT infected with any kind of Worms? Last Worm/Viruses try to distribute itself through holes in IIS service. In this case check your machine with latest antiviruse program. Also you can check inbound trafic with antivirus software (you can read about this feature in Checkpoint Manuals). If it's inbound connections - you is under attack of mentioned worms. What I did on my firewall - go to "Active Connections" and if I see that any site establishes many connections to my site - I "block" this address.

Good luck,

Michael Shavrov
MCSE W2K, CCNA, CCSA

This discussion is closed to new replies.