topic Multipath TCP Connection (MPTCP) in Firewall and Security Management

Multipath TCP Connection (MPTCP)

Arthur_DENIS1 — Tue, 25 Aug 2020 20:26:15 GMT

Hi,

I try to integrate Mulipath TCP behing CHeckpoint firewall, but seems to be not possible...

I found this SK:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk114666&partition=Basic&product=Security

And indeed, TCP flag is stripped.

Any ways to allow this flag ?

Thanks,
Arthur

Re: Multipath TCP Connection (MPTCP)

PhoneBoy — Wed, 26 Aug 2020 00:37:16 GMT

From a security perspective, MPTCP means the security gateway will not necessarily be able to see the entire packet flow.
As a result, the security gateway could make incomplete/incorrect security decisions, resulting in unpredictable behavior.

Re: Multipath TCP Connection (MPTCP)

Arthur_DENIS1 — Wed, 26 Aug 2020 06:18:15 GMT

Indeed, but the but here is to allow my WAN aggregator to a specific IP (source IP to destination IP only).

And even if is less secure, we should keep the availability to allow this flag, isn't ?