Re: [FW1] ISAKMP IP Protocol

[Scott Schindler <scott@FW1-NOSPAMenstar.com>]

Actually the default 3 packet aggresive key exchange is logged in the
firewall by default and you can find the information in the log you will be
sniffing for.  Also the Isakmp service is defined in manage> services which
allows you to find port info.  Lastly there are many books, including most
written by William Stallings that will give you the exact packet sequence
for Isakmp and what the 3 packet exchange does not do that the 6 packet
exchange does, in particular system authentication.

Good Luck.

----- Original Message -----
From: "Murphy, Paul" <Paul.Murphy@lloydstsb.co.uk>
To: "fw-1-mailinglist" <fw-1-mailinglist@lists.us.checkpoint.com>
Sent: Wednesday, November 08, 2000 9:26 AM
Subject: [FW1] ISAKMP IP Protocol


>
>
> Hi group,
>
> Can anyone tell me the IP protocol/TCP port that the ISAKMP tunnel uses?
>
> Also, does anyone know the sequence of events that take place between
> the
> firewalls when a connection is being established?  I am presuming that
> some
> sort of negotation takes place between the firewalls before any
> encrypted
> data is sent through (or this might be part of the stream I guess).
>
> I am trying to find a way that I can identify a new encrypted connection
> session being established between the firewalls when I put a sniffer on
> the
> external interface on the firewall instigating the connection.  Is there
> a
> signature?
>
> Many thanks,
>
> Paul.
>
>
> ------------------------------------------------------------------------
> -----------------------------------------------
> This e-mail is intended only for the above addressee.  It may contain
> privileged information. If you are not the addressee you must not copy,
> distribute, disclose or use any of the information in it.  If you have
> received it in error please delete it and immediately notify the sender.
>
> evolvebank.com is a division of Lloyds TSB Bank plc.
> Lloyds TSB Bank plc, 71 Lombard Street, London EC3P 3BS.  Registered in
> England, number 2065.  Telephone No: 020 7626 1500
> Lloyds TSB Scotland plc, Henry Duncan House, 120 George Street,
> Edinburgh EH2 4LH.  Registered in Scotland, number 95237.  Telephone
> No:>
> Lloyds TSB Bank plc and Lloyds TSB Scotland plc are regulated by the
> Personal Investment Authority and represent only the Scottish Widows
> and Lloyds TSB Marketing Group for life assurance, pensions and
> investment business.
>
> Members of the UK Banking Ombudsman Scheme and signatories to the UK
> Banking Code.
> ------------------------------------------------------------------------
> -----------------------------------------------
>
>
> ========================================================================
> ========
>      To unsubscribe from this mailing list, please see the instructions
> at
>                http://www.checkpoint.com/services/mailing.html
> ========================================================================
> ========


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================