topic Security Gateway starts to listen on port 80, 264 and 443 after upgrade from R81.10 to R81.20 in General Topics

Security Gateway starts to listen on port 80, 264 and 443 after upgrade from R81.10 to R81.20

EricRobert — Thu, 21 Nov 2024 18:54:20 GMT

Hi,

We are monitoring our outside interface to be sure that they are not visible from the Internet, but immediatly after an upgrade from R81.10 to R81.20, a scan revealed that TCP ports 80, 264 and 443 are now listening on outside interface.

How can we disable listening ports on outside interface ?

Thanks

Re: Security Gateway starts to listen on port 80, 264 and 443 after upgrade from R81.10 to R81.20

Lesley — Thu, 21 Nov 2024 19:10:20 GMT

I think some custom changes on previous version have been lost after upgrade. Did you do clean install?

start with

https://support.checkpoint.com/results/sk/sk132712

also check if traffic is allowed by explicit rule or implied rule. In traffic logs if you can see it is hit on rule 0 it is an implied rule.

Re: Security Gateway starts to listen on port 80, 264 and 443 after upgrade from R81.10 to R81.20

PhoneBoy — Thu, 21 Nov 2024 21:56:05 GMT

Those ports are typically allowed through implied rules.
If you've edited .def files to disable certain rules, those changes do not propagate through an upgrade.

The correct way to disable these implied rules for 80/443 is through configuration: https://support.checkpoint.com/results/sk/sk105740
To ensure that TCP port 264 isn't listening, see: https://support.checkpoint.com/results/sk/sk132712
You may need to perform the "regedit" portion of the SK to disable the relevant process that listens on this port.