[FW-1] fw sam error

[Mick Toothaker <mtoothaker@FW1-NOSPAMFIDELITYBANK.COM>]

I am working with OPSEC suspicious activity messages (SAM), trying to get
our RealSecure IDS to originate SAM and CheckPoint NG to respond to SAM. The
next step I need to take is making sure that "fw sam -v -t 60 -i src <IP
address>" manual methods work. Well, they are not. When I enter the above
command at the management console, I get the following error:

sam: Unexpected end of session. It is possible that the SAM request for
'Inhibit
 Drop Close src ip <IP address> on All' was not enforced.

where <IP address> is a dotted decimal IP address.

I found the article on the SecureKnowledge database "sk8382", but that did
not make any difference, and I am not sure that article applies to my
environment.

VPN-1 NG FP3 (non-HF1), single enforcement point, single management console.
Enforcement point: SecurePlatform, NG FP3, Second Edition (non-HF1)
Management console: Windows 2000 Server, NG FP3 (non-HF1)

Mick Toothaker
Manager of Technology Services
Fidelity Bank, Wichita, KS

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================