[FW-1] Topology issue

["FireWall-1 (Layer-0)" <checkpoint@FW1-NOSPAMLAYER-0.COM>]

Title: Topology issue

One of my customers has a strange problem with topology requests. I didn't set up their firewall, they did it themselves, and I have been involved in post set-up audit. Leave it to say that they have a few interesting rules, and the config of the box isn't how *I* would have done it...

They are running NT SP6a, with FW-1 4.1 SP1 (build 41490 from fw ver), and they didn't buy Software Support.

When someone tries to do a topology request from inside the protected network, everything is OK, but if you try to do one from outside the firewall, you get the error message 'Communication with site X.X.X.X has failed'. I have checked the logs, and the firewall accepts the FW_topo request, but the topology doesn't download. The 'Respond to Unauthenticated Topology Requests (IKE and FWZ)' property is set.

There are too many rules (and too complex) to list in full, but the main ones are:

Securemote encryption rule
Firewall stealth rule
Default drop rule

After trying several options, I tried the following rule at the top of the rulebase:
Any->Firewall->(Port 256)->Accept
and viola! it works.

My question is:
a) should this rule be necessary?
b) is this a known issue with SP1, or is it unique to this site?
c) not being able to see any reason for this, why is it necessary?

I have set up dozens of Firewalls with similar (but less convoluted) rulebases, and I always follow the procedure of placing encryption rules at the top, followed by anti-intrusion rules, a stealth rule, site specific rules, and default drop rule. I have never had to do this in the past to get topology downloads working. Any ideas?

Craig Little B.Sc, CPD, CPI, SCJD, CCSA, CCSE
Senior Consultant
Layer-0 Internet Security

www.layer-0.com
mailto:craig@layer-0.com

Ph:     02 4648 2855
Fax:    02 4647 8899
Mob:    0416 112 138