topic Checkpoint Satefull Inspection for reestablished tcp session in Firewall and Security Management

Checkpoint Satefull Inspection for reestablished tcp session

ihenock101 — Mon, 05 Jun 2023 05:46:13 GMT

Hi All,

I have one question regarding checkpoint Satefull inspection feature. I have rule that allows Server A to be accessed from public, and in the firewall as I know there is only one rule needed for such traffic due to checkpoint Satefull inspection. My concern is if the TCP session by any means fails, is adding a rule from server A to any make this TCP session to reestablish by the server ?

Thanks,

Re: Checkpoint Satefull Inspection for reestablished tcp session

G_W_Albrecht — Mon, 05 Jun 2023 08:55:56 GMT

If the TCP session fails, i would assume that the client needs to establish a new connection to the server - it usually does not make sense for a server to reach out for a client to re-establish a connection 😉 Also authentication would be an issue here.

Re: Checkpoint Satefull Inspection for reestablished tcp session

_Val_ — Mon, 05 Jun 2023 10:00:17 GMT

What is the expected behavior, what are you trying to achieve?

Re: Checkpoint Satefull Inspection for reestablished tcp session

ihenock101 — Tue, 06 Jun 2023 05:10:34 GMT

The thing is the server access from public failed in the middle of no where. so, I taught whenever the tcp session failed writing a rule in the reverse direction (i.e from server to any) may allow the server to reestablish the tcp session

Re: Checkpoint Satefull Inspection for reestablished tcp session

PhoneBoy — Tue, 06 Jun 2023 19:44:43 GMT

A reverse rule won't solve this issue as you will get a TCP packet out of state message: https://support.checkpoint.com/results/sk/sk31382
Or something like "First Packet isn't SYN" from: https://support.checkpoint.com/results/sk/sk11088
You can disable these checks for specific flows by using the procedure in sk11088.
This is generally not recommended for security reasons, though.