Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Christian_Wagen
Contributor
Jump to solution

Protocol Signatures

What are the Protocol Signatures doing?

C_pro_sig_1.JPG

1 Solution

Accepted Solutions
HeikoAnkenbrand
Champion Champion
Champion

Hi @Christian_Wagen,

In R80.xx and R81, the identification of most common protocols are done using Firewall services with protocol signature. 
Signatures are pieces of information taken from both "Client to Server" and "Server to Client" packets that eventually identify the protocol. During the Service matching process, signatures validate that the content of the connection is truly the configured protocol. Protocol Signatures are part of the matching process.

SecureXL packet flow:
After policy installation, all traffic matching the Service with Protocol Signature enabled, will use the Medium Patch of traffic flow (PXL, new name PSLXL).

To use matching by protocol signature and services:

- Add the matching service to the appropriate rule.
- Activate the Protocol Signature option.
- Enable Application Control and/or  URL Filtering Blades

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

4 Replies
HeikoAnkenbrand
Champion Champion
Champion

Hi @Christian_Wagen,

In R80.xx and R81, the identification of most common protocols are done using Firewall services with protocol signature. 
Signatures are pieces of information taken from both "Client to Server" and "Server to Client" packets that eventually identify the protocol. During the Service matching process, signatures validate that the content of the connection is truly the configured protocol. Protocol Signatures are part of the matching process.

SecureXL packet flow:
After policy installation, all traffic matching the Service with Protocol Signature enabled, will use the Medium Patch of traffic flow (PXL, new name PSLXL).

To use matching by protocol signature and services:

- Add the matching service to the appropriate rule.
- Activate the Protocol Signature option.
- Enable Application Control and/or  URL Filtering Blades

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
_Val_
Admin
Admin

Please look here: https://community.checkpoint.com/t5/Security-Management/White-Paper-Protecting-IoT-Internet-of-Thing..., in the paper itself.

Protocol signature ensures the protocol is used according to RFC.

0 Kudos
valterj
Contributor

Hi All. 

Considering that Protocol Signature is a feature to provide more security and reliability to traffic inspection process, why is not enabled by default? Shouldn't this be the opposite, enabled by default and I disable if I need?

Regards. 

Valter Junior

Timothy_Hall
Legend Legend
Legend

The Protocol Signature checkbox is not enabled on any TCP or UDP services by default.  It is probably not enabled by default due to the performance hit, as it silently kills the SecureXL Accept templating rate to zero, and requires Medium Path streaming of the first few packets of the connection to determine a final match.  This is going to cause far more rulebase lookup overhead than a regular Column-based matching Firewall/Network policy rulebase lookup. With a high new connection rate the performance impact of the "Protocol Signature" feature can become quite pronounced.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events