Checkpoint problem

I run ISA behind Check Point. It's best to let a firewall be a firewall and the security servers can be real resource hogs. We use NTLM for authenticated access to the Internet via ISA and the caching function dropped our bandwidth usage by a solid 30+%.

You get the best of both worlds. In fact, if you go over to

you'll see this is one of their recommended configurations for large companies.

HTH,

Ray

Configuring Client Authentication ports in Manual or Partially Automatic mode to work with SSL

Solution ID: sk12421 Creation Date: 06/18/2002 Revised Date: 01/09/2004 Preferred Product: FireWall-1 Latest Version: NG Category: Authentication

The information in this article applies to: FireWall-1 VPN-1 Client Authentication Partially Automatic Fully Automatic SSL fwauthd.conf

950 HTTPS

Solution

For example in order to use port 950 do as follow:

1. Run cpstop on the FireWall-1 module machine
2. Edit the fwauthd.conf file under $FWDIR/conf/ on the module and add the following line

950 fwssd in.ahclientd wait 950 ssl:polo (where 'polo' is the Nickname of the Certificate on FireWall-1 module)

1. Run cpstart
2. Open the GUI and create a new TCP Service for port 950 (for example tcp_950)
3. Add the new defined service to the FW1_clntauth group under the Services tab
4. Install the policy

In order to successfully initiating connection and authentication use the following URL path example:

https://:950

Note: Any port can be used but make sure to create the correct TCP Service fulfill/reflecting your needs.

NOTE: Any desired number can be defined and then added into the 'FW1_clntauth' Services group

Wayne McGlinn Brisbane, Oz

Thank you