Not quite, with X11. I had a long, drawn-out discussion about this new "feature" with Checkpoint support, even got bumped back to Israel for in-depth explanation. Checking the "Match for Any" box is the default for X11, iirc, and it won't help in NG FP3 and later.
Basically, new with NG FP3, X11 protocol is *blocked* when you have a rule for allowing "Any" service. Yes, this is totally different from anything else that FW-1 does. This is documented in the release notes for NG FP3. If you want to allow services in the 6000 range of ports (overlapping the X11 range), you must add a rule *above* the "allow any" services rule. Note that there is a pretty good description in the Tracker (Log Viewer) when packets are blocked, but no reference to the rule number associated with this block (the allow any rule). One argument I had with Checkpoint was that the Log should show the rule number which caused the X11 block, even though unintended by the FW administrator, so that if the FW admin WANTS X11 ports to be allowed, he/she would see what rule number to put the allow X11 (or other 6000-range ports) *above*. Lost the argument, but they may have added it to the RFE list.
This new X11 "feature" is actually not sane behavior, IMO, but I suspect there aren't too many FW-1 customers who really want to allow X11 traffic.
This is different from the "Any" doesn't mean *ANY* explanation that I've gotten from Checkpoint before. ;-)
HTH. -- David Strom
David Gillett wrote:
Simply put, "Any" is not a magic designation that works for all services -- it's just a group of services that includes all services marked "included in 'Any'". For whatever reason, X11 is not so marked by default. If all you need is for "Any" to include X11, there's a checkbox on the X11 service properties to include it in "Any".
Dave Gillett
-----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] Behalf Of Perruccio, Vincenza
I'd like to have more information about X11 protocol that don't pass into "Any " Rule, but we have to get an apposite rule. My platform is Nokia with CP NG FP3 HF2 Do you have any document about this?
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
