topic Re: Port Scan and SMB in Spark Firewall (SMB) https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18683#M636 <HTML><HEAD></HEAD><BODY><P>Yes, it is just like that - as the fw sam command does not work on SMBs and only SAM Events created by CP SAM GWs will work (no 3rd party events), this is all we have (and we even do know no details)...</P></BODY></HTML> Fri, 07 Sep 2018 12:16:46 GMT G_W_Albrecht 2018-09-07T12:16:46Z Port Scan and SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18681#M634 <HTML><HEAD></HEAD><BODY><P>For the GAiA gateways, <A href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk110873&amp;partition=Advanced&amp;product=Security"><EM>sk110873 How to configure Security Gateway to detect and prevent port scan</EM></A>&nbsp;gives a detailed configuration guide for R7x and R80.x. But for SMB units, in IPS protections we only find the protection <EM>Masscan Port Scanner</EM> - but no description how it works. I would assume that the IPS is able to collect statistics, but is that done with locally managed SMB devices ? And what about SMBs managed by R7x / R80.x, can you configure an automatic SAM rule to close the port scanning connections also on SMB gateways ?</P></BODY></HTML> Tue, 14 Aug 2018 12:18:18 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18681#M634 G_W_Albrecht 2018-08-14T12:18:18Z Re: Port Scan and SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18682#M635 <HTML><HEAD></HEAD><BODY><P>Günther, on locally managed SMB appliances, I believe that is all you have.</P><P></P><P>For centrally managed, they have the same protections, such as Host Port Scan, Zmap, Masscan, etc.</P><P></P><P>They do&nbsp;not support SAM rules, and using "Block source" automatic reactions in SmartEvent will have no effect.</P></BODY></HTML> Tue, 14 Aug 2018 13:29:18 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18682#M635 Pedro_Espindola 2018-08-14T13:29:18Z Re: Port Scan and SMB https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18683#M636 <HTML><HEAD></HEAD><BODY><P>Yes, it is just like that - as the fw sam command does not work on SMBs and only SAM Events created by CP SAM GWs will work (no 3rd party events), this is all we have (and we even do know no details)...</P></BODY></HTML> Fri, 07 Sep 2018 12:16:46 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Port-Scan-and-SMB/m-p/18683#M636 G_W_Albrecht 2018-09-07T12:16:46Z