1) Checkpoint uses CPMI for the GUI client to connect to the Management server. Traffic is encrypted but the protocol is checkpoint proprietary.
2) There is no easy to setup anti-spoofing rules. Make sure all the networks behind the firewall are properly defined. Otherwise, you will run into problems with anti-spoofing.
3) Use 'stealth' and "clean-up" rule to drop these traffics
Thanks for your help. Much appreciated. I wasn't sure that CPMI was encrypted so thanks.
Having the networks defined is fine but is there an implicit rule saying 'nobody from this network' can connect to the external port & no 'external network users' can connect to the internal port? Or should I add this rule myself?
The third one if fine. I have the cleanup and stealth rules in the rulebase, I just wondered whether there was a rule I could enter which would catch all broadcast and multicast and log them separately (or not log them at all)
