topic Re: Ports 18265, 18190, 19009 are exposed via Internet in Firewall and Security Management

Ports 18265, 18190, 19009 are exposed via Internet

Almal_Luna — Wed, 10 Mar 2021 00:10:32 GMT

Hello team,

After a deploy with a new device, we see our WAN interfaz is reachable through these ports: 18265, 18190, 19009

Our device is SG 6200 Gaia R80.30.

In other devices as SG 2200 R77.30 and SG 5100 R80.10 their IP's are not reachable through those ports.

I understand this is normal but only internal communication, not exposed to internet due ICA services, but I'm affiard it could be a vulnerability.

Re: Ports 18265, 18190, 19009 are exposed via Internet

PhoneBoy — Wed, 10 Mar 2021 02:41:08 GMT

18190 and 19009 are for SmartConsole, and 18265 is the ICA Tool.
Which suggests this gateway is also a management station (i.e. you've installed it standalone).
That might be...expected behavior.

You can disable ICA tool via: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39915
Access to the other two ports should be controlled by GUI clients setting in cpconfig.