Restrict external access to the Management Server

[Exonix]

Hello,

We have a Management Server in an internal network, but we also have two managed gateways with public IPs that are managed over the Internet. That’s why we enabled NAT on the Management Server:

It turned out that this exposed the Management Server, and we observed login attempts in the audit logs:
How can we protect our Management Server? It must be accessible from some internal networks and external gateways.

PS C:\> tnc public_IP -port 19009


ComputerName     : public_IP
RemoteAddress    : public_IP
RemotePort       : 19009
InterfaceAlias   : Ethernet 3
SourceAddress    : 192.168.178.48
TcpTestSucceeded : True

[simonemantovani]

If the management is behind a firewall, you could filter access only for the remote gateways, right?

[Exonix]

Yes, I could. Now I need to figure out whether the Management Server is really behind the firewall. I can see traffic from my side to the public IP, but only on ports 80/443 — I don’t see any traffic on port 19009 I've shonw above

[Martijn]

Hi.

Port 19009 is used by the SmartCenter for the CPM service.

sk52421 - Ports used by Check Point software

It is handeled by the Implied Rules if enabled which is the default.
If you do not log Implied Rules (which is off by default) you do not see this traffic in the logs.

Martijn

[Martijn]

Hi,

Do you have implied rules enabled? If so, they come before any other rule in the rule base.
So Control Connections (Check Point's services) are allowed regardless of the rules you create to block them.

Disable Implied Rules and create custom rules for your SmartCenter traffic. But be aware, you need to create specific rules in your rule base for policy installs, log's from gateway to management. So make sure those are in place.

Martijn

[Lesley]

would also recommend to configure gui access list in the GAIA portal and SSH access. Add there only IP ranges that are allowed to connect with SmartConsole and SSH,HTTPS

[the_rock]

I agree with what the guys said, makes total sense.