[FW1] strange behaviour with http scanning and CVP (esafe)

["André Münch" <ajmuench@hotmail.com>]

Hello all,

i´m using fw1 4.1 OS Solaris 7 with esafe protect gateway as CVP Server
and internal MS proxy 2.0 server.

This is a part of my rule base:

A:    Proxy    ANY    HTTP-->HTTP_Scan    accept   (scanned by esafe)
B:    Proxy    ANY    all_allowed_services     accept

the group "all_allowed_services" contains protocols in use which can´t be
scanned by the CVP Server. Of course it doesn´t
contain the scannable protocols (http, smtp, ftp)

I noticed drops of http traffic in the log by the clean up rule. I wondered
why and added a rule C behind rule B:

C:    Proxy    ANY    HTTP                            drop

Now the log contains a amount of http drops in rule C.

Obviously the users aren´t affected by this drops. (nobody complained )

Any ideas why not all http traffic will match rule A.

André














================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================