topic Re: port 264 queries whether its need or not in Firewall and Security Management

port 264 queries whether its need or not

umar7 — Wed, 04 Jan 2023 07:53:04 GMT

We have the following questions regarding FW1_topo traffic.

What is FW1_topo traffic for?
What is the impact to our production environment when a known IOC IP address had established connection with our firewall using FW1_topo service?
Is allowing FW1_topo service by default necessary in our environment?
Can we disable this implied rule?
If yes, how can we disable it? And what is the impact of disabling this implied rule?

Re: port 264 queries whether its need or not

Chris_Atkinson — Thu, 05 Jan 2023 04:07:10 GMT

Is your gateway configured for remote access VPN?

Please refer:

sk60773: [RST, ACK] response to TCP/264

sk132712: Vulnerability scan shows ports 18231 and 264 open under LISTEN mode when using TLS1.0 and TLS1.1 - reference CVE-2000-1201

sk69360: Check Point response to SecuRemote Topology Service Hostname Disclosure

sk62692: Ports used on Security Gateway for SecureClient and Endpoint Security VPN

If you have no plans to leverage Check Point remote access disabling this global option may also work for you:

Re: port 264 queries whether its need or not

Blason_R — Thu, 05 Jan 2023 02:43:14 GMT

As suggested by @Chris_Atkinson this is used for fetching the Topology by Remote Access VPN users. if you dont use this feature you can disable it using Implied rules and those are correct sks given by him and if you are following those it should not be a problem.

Re: port 264 queries whether its need or not

the_rock — Thu, 05 Jan 2023 03:51:10 GMT

Chris is spot on with those SKs as @Blason_R said.

Re: port 264 queries whether its need or not

umar7 — Thu, 05 Jan 2023 09:48:19 GMT

hello guys ,

thanks for the information i will update and if i have any queries regarding this issue . i will update the chat tail.