My company recently upgraded our firewall UTM from R71 to R75. It was neat and no worries upgrade until today our External Security company sent us a report our public Internet ip scanning report failed on PCI compliance. Report shows there is self-sign checkpoint certification on our Internet facing firewall. Yes, it is right. All checkpoint firewall has a Certification on it which default is self signed. Our policy doesn’t allow any http/https access to our firewalls. There is a stealthy rule in place to deny all access.
Also this command works for R75.20 , but not for R75
Setting kernel global parameters permanently is unique for some OS’s.
Warning: Edit the Security Gateways ONLY.
Note: Verify the parameter first using command
fw ctl get int
fw ctl get int fwseqvalid_exact_syn_on_rst
fw ctl get int multi_portal_allow_redirect
$FWDIR/boot/modules/fwkern.conf file using vi editor or text editor to add line syntax:
“Value” in syntax must be a valid number Decimal or Hexadecimal, as used in C programming language.
Decimal = a number, such as 10 or 1024.
Hexadecimal = prefixed by 0x, such as 0x10 (which is 16), 0xffff
Note: Create the
fwkern.conf file if not found in the
Important Note: The Security Gateway must be rebooted after any change in the fwkern.conf file.
Another solution from CPUG Phoneboy
Edit $FWDIR/lib/implied_rules.def on the Security Management Server. Find this line: #define ENABLE_PORTAL_HTTP_REDIRECT and comment it out. After the change should look like:
Reinstall the Security Policy.
As I said (and can confirm now) this should be addressed in a future release.
# mpclient list
that will show a list of “processes clients’ assotsiiorovannyh with multiportalom. For example, sslvpn.
Another KB sk58362 for this feature in Other Improvement Section
“You can now use multiple portals over port 443 and port 80. For example, the SecurePlatform Web User interface and the Mobile Access portal can both be on port 443. In the SmartDashboard Gateway properties window, set the Portal URL for the different portals on the portal configuration pages.“