Restricting Gaia

[jimm]

When configuring an R81.20 Quantum gateway, the Gaia web interface is available via port 443 on its management interface.  However i was surprised to see its also available on other interfaces.  What is the best practice for restricting Gaia to listen only on the management interface?

[the_rock]

In web ui, go to:
System Management > Access > Administration Access

In clish, set management interface interfacename

Andy

[emmap]

Once the gateway is SIC'd to management you can control access within the gateway settings.

[jimm]

setting the management interface didnt help. Other interfaces still responded on 443. ie;

CPFW01> show management interface
eth1

However, the 'platform portal' setting in gateway object is set to 'according to the firewall policy' . So i will verify the rules

[Chris_Atkinson]

Some additional considerations:

https://support.checkpoint.com/results/sk/sk105740

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/Host-Ac...

[D_W]

I also struggle with this setup.
On R81.10 I see the Check Points are answering ping to 192.168.1.1 although the (physical) Mgmt Interface is state off and not connected.
When the (physical) Mgmt Interface is state on but cable still not connected then also the Portal shows up with 192.168.1.1 ⁉️

[the_rock]

I find that odd as well...let me do some lab tests later.

Andy

[the_rock]

What is output of below?

Andy

my lab:

R82> show management interface
eth0
R82>