Stealth Rule

Prashan_Attanay — Thu, 23 Nov 2017 06:45:05 GMT

Checkmates,

May be this question is bit stupid, But i want to know if stealth rule implemented like this we don't have access to firewalls (like ssh) right ?

Re: Stealth Rule

Timothy_Hall — Thu, 23 Nov 2017 14:36:08 GMT

Correct, typically prior to the Stealth Rule you'll have rules such as:

1) Admin. Access - SSH/HTTPS/4434 to the firewall from trusted internal hosts/subnets

2) Ping/Traceroute - Can internal hosts ping the firewall itself, and will the firewall hop show up in traceroute path or "star out"

3) SNMP Monitoring traffic from an NMS to the firewall itself

4) dhcp-request/dhcp-reply/DHCP relay services if needed

5) Allow for Dynamic Routing Protocols & VRRP if firewall is configured for those

There are some other corner cases (Legacy Client Auth, old versions of SecuRemote and such), but generally these are the only rules you should have in front of the Stealth rule.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.

topic Re: Stealth Rule in General Topics

Stealth Rule

Re: Stealth Rule