|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] Reject on rule 997 ???
Hi, sorry can't help, but some information - same problem. The 997 is found in <Checkpoint>/lib/dcerpc.def (included in base.def) #define dcerpc_reject_alterc ... or /* ALTER CONTEXT to unknown interface! Reject. */ (delete <conn> from connections, set sr1 997, log long, reject) ###> this is the rejected rule number dcerpc uses port 135, also Microsoft DCE locator service loc-srv/epmap - dcom I didn't really know what was happening. Are there any differences between checkpoints dcerpc and microsofts implementation of dcerpc ? Bernd "Kinsey, Brian A." schrieb: > > I have some rejects showing up in my log viewer on rule 997. This is quite > interesting to me as we don't have nearly that many rules in our rulebase. > > I found some info on phoneboy and Checkpoint's KB on rule 998 rejects, but > nothing on 997. The 998 rejects there all had something to do with Exchange, > but the machines that are showing up in my log are not any kind of mail > servers. > > I have noticed this from a web server in one DMZ to a database server in > another DMZ as well as from External DNS servers in a DMZ and Internet IP > addresses. > > Has anyone seen this before or know what may cause this behavior? > > ================================================= > To set vacation, Out Of Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
