| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW-1] Non-SYN problems with NG FP2 / Will CP support for Non-SYN in the future?
- To: [email protected]
- Subject: Re: [FW-1] Non-SYN problems with NG FP2 / Will CP support for Non-SYN in the future?
- From: "Palmer, Kevin" <[email protected]>
- Date: Mon, 29 Apr 2002 15:21:15 -0400
- Reply-to: Mailing list for discussion of Firewall-1 <[email protected]>
- Sender: Mailing list for discussion of Firewall-1 <[email protected]>
- Thread-index: AcHvmwEfxa/rVx/uT+KCN++r7ywrwwAF/BQQ
- Thread-topic: Re: [FW-1] Non-SYN problems with NG FP2 / Will CP support for Non-SYN in the future?
I'm going to modify my position on the issue slightly and say that I am strongly in favor of Check Point giving everyone a check box to disable the non-SYN feature and any other feature that prevents TCP resume and asymmetric routing from working.
Kevin Palmer
-----Original Message-----
From: Don [mailto:[email protected]]
Sent: Monday, April 29, 2002 12:33 PM
To: [email protected]
Subject: Re: [FW-1] Non-SYN problems with NG FP2 / Will CP support for
Non-SYN in the future?
> Does anyone else agree that Check Point should allow non-SYN packets by
> default? What about including a simple check box in global properties
> instead of objects_5_0.c? This is a big deal for a number of potential
> customers deciding between Check Point and PIX. Since Cisco PIX is not
> affected by this issue, PIX has the advantage.
No we do not agree. You can enable CP to pass non-SYN packets so there is
no loss of functionality here.
This use to be the default behavior for CheckPoint but it lead to serious
DoS problems. A firewall should not pass traffic that has not been
explicitly allowed.
> Please advise.
Perhaps you should clean up your routing so that it isn't asymetric?
-Don
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
|
|
