topic Re: fwaccel off in Spark Firewall (SMB)

fwaccel off

BrunoMarques21 — Wed, 01 Sep 2021 11:22:44 GMT

I have a Quantum Spark 1570 Appliance with firmware R80.20.30 (992002285).
I have the following scenario:

1 web server with Totvs application
totvs application uses port 8051 for communication

I need to access it remotely through a mobile app.

I made the rule to allow UDP/TCP connection to port 8051

I created a NAT rule to be able to translate my external IP address to my internal IP address.

When I'm with fwaccel on, the application doesn't work, when I disable fwaccel off, everything works, what can it be?

To access the application I use the IP address for example 200.200.200.200:8051

Access control rule

NAT rule

Re: fwaccel off

_Val_ — Wed, 01 Sep 2021 11:54:14 GMT

Moved to the appropriate category.

I recommend opening a TAC case for this.

Re: fwaccel off

the_rock — Wed, 01 Sep 2021 12:18:46 GMT

Val suggested the right thing, for sure. In case like that where sxl is the culprit, TAC would definitely give you securexl debugs to run, so they can try figure out the actual reason behind this behavior.

I found below, but you may want to get right procedure from TAC.

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_CLI_ReferenceGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_CLI_ReferenceGuide/208732

Re: fwaccel off

_Val_ — Wed, 01 Sep 2021 12:23:08 GMT

This for regiular Gaia, @the_rock. And the observed issue is related to SMB.

Re: fwaccel off

BrunoMarques21 — Wed, 01 Sep 2021 12:25:26 GMT

All right, I'll open the call and then come back to talk about how it was resolved

Re: fwaccel off

the_rock — Wed, 01 Sep 2021 12:27:57 GMT

Ah, true. Was not sure if debugs for sxl for SMB are different, thank you for pointing that out @_Val_ .

Re: fwaccel off

PhoneBoy — Wed, 01 Sep 2021 13:05:12 GMT

Disabling SecureXL globally is generally not recommended.
You can disable it for a specific service here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164793&partition=Advanced&product=Quantum

That said disabling SecureXL is a workaround and a TAC case will be necessary to fix the underlying issue.