[FW1] DCE-RPC (MS-RPC) and FW-1

["Hartmann, Josef" <hartmann@FW1-NOSPAMsecunet.de>]

Hi,

is there anybody who's successfully setup MS-RPC (port 135 ...)????


My setup (according to FW-14.0SP3 release notes) does not work.
The first rule accets the DCE-RPC service supplied by FW-1. However this is
not used if there's a request using port 135 (shouldn't that be that?).
After that rule there's a rule with the DCE-other service which includes the
uuid and one with the class-factory ID of the application. However this not
used as well.

Moreover when I use a sniffer to review the packtes, DCE-RPC packets are
decoded an there are OID, IID, AID which are different to the
uuid/class-factory ID supplied by the application vendor. Shouldn't these be
the same. Is the OID/IID/AID the CLSID required by FW-1?

Please help on this topic.

Will there be any improvement in Checkpoint NG?



Thanks


Josef

PS: Why is the list server moving all the time?


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================