Hello. I have some gateways that accept traffic to the gateway itself on TCP/443, despite our stealth rule that should be preventing this. My apologies, as I see this is a frequent topic that is discussed on these forums.
We are looking at sk180808 which was presented to us as a possible solution. I am wanting to make sure I fully understand the sk article before attempting to implement it.
- The CLI change is done on the management server, and not the gateway.. is that correct?
- The change then takes affect on a gateway after you install policy on that gateway.
-In this sense, we can look at this as a "global" change that affects all of the gateway clusters under this management server. We may be able to install policy on only one cluster and test things out first.. but one way or another all the other clusters eventually will have to get policy install.
- reverting back, in case the results are not desirable.. would just be setting the value back to "0", cpstop;cpstart, then install policy again? Or would "revert to previous revision and then install policy" work?
My last question: I'm wondering if there is any recommended reading on more fully understanding the "Multiportal Policy" in general.. I have a rudimentary understanding that if you activate certain different blades and features on Check Point, one or more of those features provision a "portal" interface, that may share the same IP/Port as the portals for other blades/features.. and that is why Implied Rules are used with Multiportal policy.
What I would like a better understanding about is which features I have enabled that has put us into "multiportal mode?" Is there a way to see which "portals" are turned on with a gateway?
Thanks for any information!
