RE: [FW1] Accept ICMP vs. Accept "Last"

[Lance Spitzner <lance@spitzner.net>]

On Tue, 21 Mar 2000 Thomas.Poole@gecits.ge.com wrote:

> either way you do it, acceptICMP means it will be handled at the policy
> property level
> 
> 1) First means icmp will be passed before it hits ANY rules.
> 2) Before last is before your cleanup rule (so it won;t be logged)
> 3) Last is after all your defined rules. 
> 
> I wouldn't suggest setting it to first. Tailor for what you need. 
> 
> You can also uncheck the implied policy and make sure own rule.

Any way you look at it, by default CheckPoint FW-1 does not
statefully inspect ICMP (at least that I know of).  For an
such an expenisve product, I find this fact disappointing.

-Lance



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================