[FW1] How much is FW-1 sensitve to clock skew between modules?

[Jochen Fritzenkoetter <jf@netuse.de>]

Hallo!

Sometimes I run across FW-1 systems, where firewall and management modules
reside on different hosts with a clock skew between these hosts of more
than several seconds. One customer has a difference of approximately 5 minutes
between manager and gateway:

manager: date
Thu Nov 11 10:26:18 MET 1999

gateway: date
Thu Nov 11 10:21:01 MET 1999

Ie: manager is ahead in time. The obvious solution is of course to use some
kind of time server.

My question: Should'nt this have an effect on the authentication protocol
between the two modules, e.g. regarding possible replay attacks, or 
are there other implications of clock skews, such as the gateway not being
able to log to the manager (as it is a problem with this customer)? 

Ciao,
Jochen

-- 
Jochen Fritzenkoetter
NetUSE Kommunikationstechnologie GmbH
Siemenswall, D-24107 Kiel, Germany
Fon: +49 431 386435 00   --   Fax: +49 431 386435 99




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================