RE: port 256/257 and firewall-1

["Weiss, Errol S." <errol () cip saic com>]

My take on this, from Checkpoint, is that the ports are "proprietary"
Checkpoint ports and provide:
1) Firewall module and management station services
2) Download of the rule base
3) Systems status

The services can be disabled under the Firewall Policy/ Properties and
uncheck the "Accept Firewall-1 Control Connection" box.  I certainly
wouldn't have the ports accessible on an untrusted interface.

Errol

Errol S. Weiss       errol () cip saic com
SAIC Center for Information Protection
(703) 556-7366  Office
(800) CIP-1214  CIP-Central
(888) 602-4537  Pager
http://www.saic.com/internet/cyber_security.html



> -----Original Message-----
> From: George Wang [SMTP:wangw () SINGNET COM SG]
> Sent: Thursday, October 16, 1997 8:46 AM
> To:   firewall-wizards () nfr net
> Subject:      port 256/257 and firewall-1
>
> Hi,
>
> I have configured the firewall-1's policy to only pass DNS and WWW,
> however when I do a port scan from external side, it reveals that
> ports
> 256/257 TCP also open. I think it's for firewall-1's control module. 
>
> Could anyone tell me whether there is any risk for this and is it
> necessary to explicitly add a filtering rule to reject pkts destined
> for
> these ports from external side?
>
> thanks for any advice.