topic Re: Restricting Gaia in General Topics

Restricting Gaia

jimm — Wed, 11 Jun 2025 07:01:12 GMT

When configuring an R81.20 Quantum gateway, the Gaia web interface is available via port 443 on its management interface. However i was surprised to see its also available on other interfaces. What is the best practice for restricting Gaia to listen only on the management interface?

Re: Restricting Gaia

the_rock — Wed, 11 Jun 2025 07:34:42 GMT

In web ui, go to:
System Management > Access > Administration Access

In clish, set management interface interfacename

Andy

Re: Restricting Gaia

emmap — Wed, 11 Jun 2025 07:37:15 GMT

Once the gateway is SIC'd to management you can control access within the gateway settings.

Re: Restricting Gaia

jimm — Wed, 11 Jun 2025 07:57:00 GMT

setting the management interface didnt help. Other interfaces still responded on 443. ie;

CPFW01> show management interface
eth1

However, the 'platform portal' setting in gateway object is set to 'according to the firewall policy' . So i will verify the rules

Re: Restricting Gaia

D_W — Wed, 11 Jun 2025 08:05:02 GMT

I also struggle with this setup.
On R81.10 I see the Check Points are answering ping to 192.168.1.1 although the (physical) Mgmt Interface is state off and not connected.
When the (physical) Mgmt Interface is state on but cable still not connected then also the Portal shows up with 192.168.1.1 ⁉️

Re: Restricting Gaia

Chris_Atkinson — Wed, 11 Jun 2025 09:08:45 GMT

Some additional considerations:

https://support.checkpoint.com/results/sk/sk105740

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/Host-Access.htm

Re: Restricting Gaia

the_rock — Wed, 11 Jun 2025 11:03:06 GMT

I find that odd as well...let me do some lab tests later.

Andy

Re: Restricting Gaia

the_rock — Wed, 11 Jun 2025 11:43:24 GMT

What is output of below?

Andy

my lab:

R82> show management interface
eth0
R82>