Hello, In a recent security audit, I was advised to disable external access to TCP port 264 (FW1_topo) because it could be used to extract detailed network topology information from my firewall.
So far the only way I found to do this was to disable "Accept VPN-1 & Firewall-1 control connections" in the Global Properties pane. But if I do this, then all my IPSEC VPNs also stop working. I tried adding a rule to allow specific IKE and IPSEC packets through, but this didn't appear to work. In the log it says "encryption failure: received a cleartext packet within an encrypted connection" at the start of any IKE negotiation. Ths is logged against the rule I created specifically to allow IKE. Can anyone suggest a way to make this work? Thanks in advance for any help. Simon Ashford. -- Simon J. Ashford, Email: [EMAIL PROTECTED] IT Support Unit Tel: +44 (0)20 8943 7032 National Physical Laboratory, Fax: +44 (0)20 8943 7093 Teddington, Middlesex, UK. WWW: http://www.npl.co.uk/ ------------------------------------------------------------------- This e-mail and any attachments may contain confidential and/or privileged material; it is for the intended addressee(s) only. If you are not a named addressee, you must not use, retain or disclose such information. NPL Management Ltd cannot guarantee that the e-mail or any attachments are free from viruses. NPL Management Ltd. Registered in England and Wales. No: 2937881 Registered Office: Teddington, Middlesex, United Kingdom TW11 0LW. ------------------------------------------------------------------- ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
