RE: [FW1] Filtering HTTP

["Juppunov, George" <gjuppunov@FW1-NOSPAMbofasecurities.com>]

You can apply such filters in any direction that CheckPoint can inspect.
I don't think you have increased your DoS exposure. One thing you might want
to
do is disable the banner of the http security server, in order to make the
recon
more difficult. 

George


 -----Original Message-----
From: 	Joe Keegan [mailto:jkeegan@hotmail.com] 
Sent:	Wednesday, August 08, 2001 1:25 PM
To:	gjuppunov@bofasecurities.com; Joe_Trivisonno@progressive.com;
fw-1-mailinglist@beethoven.us.checkpoint.com
Subject:	RE: [FW1] Filtering HTTP

I have done this and it seems to work great. We have only a few IIS servers 
which are all patched, but one runs citrix and the codered seems to screw it

all the time.

One question I have is on how secure these URI resources are. From my 
understand (which is not too comprehensive) the URI filter is designed to be

used from the internal network to the internet (keep the users from looking 
at , etc). Now that I have the checkpoints looking at all the Incoming 
HTTP requests to my IIS servers, have I increased my risk to DoS's or other 
compromises?

thanks

Joe



>You can create a URI resource and match the string.
>
>George
>
>  -----Original Message-----
>From: 	Joe_Trivisonno@progressive.com
>[mailto:Joe_Trivisonno@progressive.com]
>Sent:	Monday, August 06, 2001 9:36 AM
>To:	fw-1-mailinglist@beethoven.us.checkpoint.com
>Subject:	[FW1] Filtering HTTP
>
>
>We would like to block HTTP traffic using FW-1 destined for pages called
>"default.ida" on our web servers. Is there a way to do this using FW-1?
>
>
>
>
>===========================================================================
=
>====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
>===========================================================================
=
>====
>
>
>_____________________________________________________________________
>IMPORTANT NOTICES:
>           This message is intended only for the addressee. Please notify 
>the
>sender by e-mail if you are not the intended recipient. If you are not the
>intended recipient, you may not copy, disclose, or distribute this message
>or its contents to any other person and any such actions may be unlawful.
>
>          Banc of America Securities LLC("BAS") does not accept time
>sensitive, action-oriented messages or transaction orders, including orders
>to purchase or sell securities, via e-mail.
>
>          BAS reserves the right to monitor and review the content of all
>messages sent to or from this e-mail address. Messages sent to or from this
>e-mail address may be stored on the BAS e-mail system.
>
>
>
>
>===========================================================================
=====
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
>===========================================================================
=====
>


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


_____________________________________________________________________ 
IMPORTANT NOTICES: 
          This message is intended only for the addressee. Please notify the
sender by e-mail if you are not the intended recipient. If you are not the
intended recipient, you may not copy, disclose, or distribute this message
or its contents to any other person and any such actions may be unlawful.

         Banc of America Securities LLC("BAS") does not accept time
sensitive, action-oriented messages or transaction orders, including orders
to purchase or sell securities, via e-mail.

         BAS reserves the right to monitor and review the content of all
messages sent to or from this e-mail address. Messages sent to or from this
e-mail address may be stored on the BAS e-mail system.




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================