Re: [FW-1] questions about log

["Reed Mohn, Anders" <Anders.Reed.Mohn@FW1-NOSPAMITCOMPAGNIET.NO>]

> first
> I have set no reject actions in the rulebase.(The default
> rule's action
> is drop) but in the log,I found rejected action recorded.Why?

What rule is rejecting? (Rule number is listed in a separate column)

Also, in the policy editor, try the "view implicit rules".
FW-1 makes rules based on the policy properties you
specify, in addition to the rules you specify.
Maybe you'll see a rule there that matches.

> Second
> I let a network to access my web server.But in the log,I found all the
> access from the hosts in that network have been droped (the
> service type
> is http).Why?

Could have been stopped by rule 0  (that's those implicit rules),
by anti-spoofing, or by an error in your explicit rule.
We need more details.

> Third
> Can someone tell me how to control the size of log file?(For example,I
> can set the max size.)I heard that if the file is larger than
> the space
> of the disk,firewall will crush.


Look into using  "fw logswitch", preferably every day at the same time,
or on another regular interval.

Cheers,
Anders :)

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================