[FW-1] Policy Editor Qeury problem ?

[Gordon Webber <Gordon.Webber@FW1-NOSPAMSITA.INT>]

Hi All,

I have a rather over-complex rulebase as a many rules were created "off the
back" of PIX access lists from the box that the Nokia FW-1 replaced.
Because the PIX was interface oriented, I have ended up with a few rule
that use "negation". This is to (or at least was intended to) restrict the
rule to a source addrss of "outside" (i.e. not a known address from any of
our own interfaces).
Because I cannot predict the incoming source address, I coded something
along the lines of "negate (inside-network + corporate vpns)".
The result should therefore test as "if not an address from my 'inside'
network, nor an address from my vpns", then allow access..........

In reality this seems to work as external port 80 access is controlled from
this rule and external users can get in !

NOW, if I go into the Policy Editor gui and apply a "Query" with an
"outside" source address, a DMZ destination & service of port 80, the query
fails to find to match the rule !!!????????

It seems as though the query does not use the boolean operator as expected
?

Has anyone else come across this ??..... any comments ??

Cheers, Gordon

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================