topic Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List in General Topics

Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Mon, 29 Sep 2025 15:40:21 GMT

I have a Check Point Security Management Server that is NATed to a public IP, and I’ve noticed that port 19009 (used by SmartConsole, CPM service) is accessible from the internet due to an implied rule, even though I have configured the GUI Clients list. My setup is running R81.20 take 113.

Questions:

Why is the GUI Clients list not restricting network-level access to port 19009, allowing internet connections via an implied rule?

How can I configure the SMS to block access to port 19009 from the internet, ensuring only IPs in the GUI Clients list can connect?

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Blason_R — Mon, 29 Sep 2025 17:21:14 GMT

Did you configure the Static NAT or Automatic Static Destination NAT? I guess it should not be a issue if Manual NAT rule is configured. Or if not then editing implied_rules.def and commenting out CPMI should resolve it. But ensure to check the file location as per your setup.

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Mon, 29 Sep 2025 18:50:35 GMT

The connection goes through automatic NAT.

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Mon, 29 Sep 2025 19:26:27 GMT

Just to make sure, if you run cpconfig via expert mode and then navigate to gui clients, does the IP in question show there?

Andy

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Mon, 29 Sep 2025 20:05:04 GMT

I can confirm that the IP I'm connecting from is not in the cpconfig list. As a test, I also tried accessing via Proton VPN, and it works

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Bob_Zimmerman — Mon, 29 Sep 2025 21:04:52 GMT

What's your API access set to? You can check with 'api status | grep Accessibility'.

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Mon, 29 Sep 2025 21:05:52 GMT

Not sure if it has to do with what I attached, though thats more for outbound.

Andy

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Mon, 29 Sep 2025 23:00:20 GMT

Now that I think about it, that wont help. Reason is because thats ONLY valid for access to smart console, NOT anything else, so to block access to another port, you need actual explicit rule in smart console.

Andy

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Tue, 30 Sep 2025 11:50:53 GMT

Accessibility: Require local

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Bob_Zimmerman — Tue, 30 Sep 2025 13:49:18 GMT

Okay, so that's not the problem.

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Tue, 30 Sep 2025 16:34:29 GMT

According to instructions from TAC, I disabled the Apply for Security Gateway control connections option. However, I received information that this might cause issues with VPN connections.

After disabling it, the MGMT is no longer reachable from the internet. What I’d like to understand is why the GUI Clients setting is not being applied, even though it is included in the implemented rule.

the image is subjective

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Tue, 30 Sep 2025 16:36:19 GMT

The reason why thats not applied is cause its only for access to smart console.

Andy

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

SubZer0 — Wed, 01 Oct 2025 17:35:30 GMT

I'm still not clear why it's not working through the GUI clients list. Any ideas ?

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Wed, 01 Oct 2025 17:37:44 GMT

Ok...

Maybe someone else can correct me if Im wrong when I say this, but Im fairly sure that gui list is ONLY for access to smart console and web UI, nothing else.

Andy

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Lesley — Wed, 01 Oct 2025 18:04:26 GMT

GUI list is only for Smart Console access and also smart view web.

Not for SSH and https (gaia web portal)

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Wed, 01 Oct 2025 18:15:01 GMT

Thanks Leslie, thats exactly what I thought. I believe it also applies to web UI?

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Bob_Zimmerman — Wed, 01 Oct 2025 18:25:04 GMT

Sure, but what is 19009 used for besides SmartConsole?

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Wed, 01 Oct 2025 19:37:03 GMT

Agree, thats it : - )

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

Henrik_Noerr1 — Wed, 01 Oct 2025 19:54:02 GMT

Welcome to 'implied rules' and 'control connections' from Check Point that noone can explain or understand. 🙂

We have multiple MDS setups with global domain and VSX used in all these - and trying to decipher what is opened automatically and with NAT in mind is impossible. In light of these issues, We have access lists and/or 3rd party vendor firewalls in front of Check Point firewalls to actually know what our exposure is. I also have shodan scans running against out public ip address range to discover these issues.

Regards,

Henrik

Re: Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

the_rock — Wed, 01 Oct 2025 19:56:37 GMT

It certainly does get complicated, totally agree Henrik.

Andy