[FW1] Port 1176 to the Firewall???

["Mills, Paul" <Paul.Mills@FW1-NOSPAMamericredit.com>]

Title: Port 1176 to the Firewall???

Since the implementation of a Nokia IP650 Firewall on the 14th, I have been seeing workstations from inside our company trying to communicate directly with the firewall on port 1176.  I am using Client Authentication (with Steel-Belted Radius) to authenticate web surfing to an NT Domain Group.  On the previous RS/6000 (AIX) firewall which was CheckPoint 4.1 SP1 this wasn't an issue, but now that we are on a Nokia IP650 running CheckPoint 4.1 SP3 there is quite a bit of traffic being sent directly to the firewall itself.  I realize that with a Standard sign-on and Partially automatic client authentication (timeout is 24hrs) that there should be a single http interaction when a customer initially surfs the web and gets hit with an authentication pop-up.  Then they authenticate and the information is supposed to be cached on the firewall itself for 24hrs.  I can't yet explain why the increased traffic is there.

Can anyone help?  Has anyone seen this before?

Thanks,

Paul Mills
CCSA, CCSE
Data Security Analyst-Firewalls