On 5/17/06, Erick Mechler <emechler@xxxxxxxxxxxxxx> wrote:
:: SYNdefender is disabled on the Nokia/Checkpoint firewall. Nokia's response :: after seeing the results of the scan has been that SYNdefender is still :: functional even if we disable it and valid authorized scans won't be :: allowed from the firewall as that is a product limitation! The most vocal piece of feedback I gave to CheckPoint back when I used their FW-1 products was to provide a Big Red Button(tm) to disable all of the SmartDefense functionality. It was never made very clear to me, as the admin, when those things kicked-in, and how they would effect my traffic flow. I haven't used FW-1 in the last 12 months, so this might have been addressed, but I can't say for sure.
It wasn't - that's the problem. As I said in my first post, I've experienced numerous problems with the Smart Defense module, which doesn't care what your rules are setup like. You just can't allow *ALL* traffic to go to the destination. Smart Defense seems to be working on a lower level than the rules (or has higher priority, the end result is the same) so if the SD module finds your traffic inappropriate, it will drop it no matter what's in the rules. That's why I suspected that the SYN Defense module gets activated no matter what's in the rules. So, a question for Sanjay: can you setup a tcpdump sniffer in front and behind, just to log all packets. Then run your scans and see what happens at the both ends. You can post pcap files somewhere so people can look at them as well (just sanitize the IP addresses, if you need to). Cheers, Bojan
