topic Re: Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets? in Firewall and Security Management

Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets?

userLearnCP — Wed, 16 Nov 2022 19:27:14 GMT

Can Checkpoint 5200 PB-20 IPS assess the content from incoming packets for Mysql database server (port 3306)? If the packet is according to a real Mysql packet then this can be forwarded to the database server, otherwise it will be dropped. The idea is to avoid DDOS attacks by sending massive TCP connections to Mysql server by Telnet or another application.

Re: Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets?

PhoneBoy — Wed, 16 Nov 2022 21:24:52 GMT

Yes, it can.
However, I’m curious why the concern about DDoS since a MySQL server should only be accessed from specific hosts, not generally accessible from the Internet.
While we can do some rate limiting and such if required, if you’re really concerned about DDoS, Check Point sells specific solutions for this.

Re: Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets?

userLearnCP — Wed, 16 Nov 2022 22:31:37 GMT

My suspect it's not about someone from outside but It's someone from inside who can execute it from these specific hosts even.

I have the following questions:

1) By customizing Threat Prevention with IPS would help in case of malformed mysql packets?

2) There is an option of 'IPS Protections' from SmartConsole. Can one of these protections match about the case I explained?

Re: Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets?

PhoneBoy — Thu, 17 Nov 2022 23:28:10 GMT

Review the IPS Protections for yourself to see what will be blocked.

What is your precise definition of “massive TCP connections”?
If you’re concerned about that happening, you can use the ratelimiting functions.
See: https://community.checkpoint.com/t5/General-Topics/R80-x-Performance-Tuning-Tip-DDoS-fw-sam-vs-fwaccel-dos/td-p/41525

Re: Can Checkpoint 5200 PB-20 IPS can inspect Mysql packets?

userLearnCP — Fri, 18 Nov 2022 19:57:43 GMT

Thanks for the picture and the link.

What is your precise definition of “massive TCP connections”?

- I mean multiple TCP connections. I tried to mention it as a synonym. These connections are associated with packets.