topic IPS-Blocks between FW Gateways in Firewall & Security Management

IPS-Blocks between FW Gateways

Anna_Habenegg — Tue, 08 May 2018 09:36:49 GMT

Hello Check Mates,

The IPS on the border firewalls at our customers site blocks management traffic (mostly port 18264) from other Check Point Gateways.

The firewalls communicate to the external IP of the border gateway.

See the pictures atteched.

Do you have any idea why this happens?

Best regards Anna

Re: IPS-Blocks between FW Gateways

Mario_Zuker — Wed, 09 May 2018 10:39:59 GMT

Hi Anna,

On a first look the attached logs look suspicious

The client type in the logs hints the source of these connections is not a CP gateway

The fact that target is port 18264 FW1_ica_services may be significant here

TCP port 18264 is the port used for FW1_ica_services

It is possible to use internal CA certificates for client connections as well as for site-to-site connections with other gateways, these VPN peers must be given access to the CRL list through FW1_ica_services

Please send me PM to further discuss this, my email is marioz@checkpoint.com

Best Regards, Mario
marioz@checkpoint.com

Re: IPS-Blocks between FW Gateways

Anna_Habenegg — Fri, 11 May 2018 10:16:18 GMT

HI Mario,

thanks for the reply!

I will check your reccommendation with the custoemr and give you feedback as soon as I've testet it.

BR Anna