Port 19009 on MGMT Server Accessible from Internet via Implied Rule Despite GUI Clients List

[SubZer0]

I have a Check Point Security Management Server that is NATed to a public IP, and I’ve noticed that port 19009 (used by SmartConsole, CPM service) is accessible from the internet due to an implied rule, even though I have configured the GUI Clients list. My setup is running R81.20 take 113.

Questions:

Why is the GUI Clients list not restricting network-level access to port 19009, allowing internet connections via an implied rule?

How can I configure the SMS to block access to port 19009 from the internet, ensuring only IPs in the GUI Clients list can connect?

[Blason_R]

Did you configure the Static NAT or Automatic Static Destination NAT? I guess it should not be a issue if Manual NAT rule is configured. Or if not then editing implied_rules.def and commenting out CPMI should resolve it. But ensure to check the file location as per your setup.

[SubZer0]

The connection goes through automatic NAT.

[the_rock]

Just to make sure, if you run cpconfig via expert mode and then navigate to gui clients, does the IP in question show there?

Andy

[SubZer0]

I can confirm that the IP I'm connecting from is not in the cpconfig list. As a test, I also tried accessing via Proton VPN, and it works

[the_rock]

Not sure if it has to do with what I attached, though thats more for outbound.

Andy

[the_rock]

Now that I think about it, that wont help. Reason is because thats ONLY valid for access to smart console, NOT anything else, so to block access to another port, you need actual explicit rule in smart console.

Andy

[Bob_Zimmerman]

What's your API access set to? You can check with 'api status | grep Accessibility'.

[SubZer0]

Accessibility: Require local

[Bob_Zimmerman]

Okay, so that's not the problem.

[SubZer0]

According to instructions from TAC, I disabled the Apply for Security Gateway control connections option. However, I received information that this might cause issues with VPN connections.

After disabling it, the MGMT is no longer reachable from the internet. What I’d like to understand is why the GUI Clients setting is not being applied, even though it is included in the implemented rule.

the image is subjective

[the_rock]

The reason why thats not applied is cause its only for access to smart console.

Andy

[SubZer0]

I'm still not clear why it's not working through the GUI clients list. Any ideas ?

[the_rock]

Ok...

Maybe someone else can correct me if Im wrong when I say this, but Im fairly sure that gui list is ONLY for access to smart console and web UI, nothing else.

Andy

[Lesley]

GUI list is only for Smart Console access and also smart view web.

Not for SSH and https (gaia web portal) 

[the_rock]

Thanks Leslie, thats exactly what I thought. I believe it also applies to web UI?

[Bob_Zimmerman]

Sure, but what is 19009 used for besides SmartConsole?

[the_rock]

Agree, thats it : - )

[Henrik_Noerr1]

Welcome to 'implied rules' and 'control connections' from Check Point that noone can explain or understand. 🙂

We have multiple MDS setups with global domain and VSX used in all these - and trying to decipher what is opened automatically and with NAT in mind is impossible. In light of these issues, We have access lists and/or 3rd party vendor firewalls in front of Check Point firewalls to actually know what our exposure is. I also have shodan scans running against out public ip address range to discover these issues.

Regards,

Henrik

[the_rock]

It certainly does get complicated, totally agree Henrik.

Andy