Re: Ports 256,257,258 open on FW-1

["Peter J. Cherny" <peterc () arquebus com au>]

I quote from the FWWL Archive (from myself inter alia) :-

A quick peek in the dot pf file (or a view rules) will tell you a lot.
(not to mention the architecture manual.)
SRV_tcp(fw1,      256)
SRV_tcp(fw1_log,  257)
SRV_tcp(fw1_mgmt, 258)
SRV_tcp(fw1_clntauth, 259)
SRV_udp(fw1_snmp, 260)

*> From: Weiss, Errol S. [SMTP:errol () cip saic com]
*> Sent: Sunday, October 19, 1997 2:09 AM
*> To:   George Wang; firewall-wizards () nfr net
*> Subject:      RE: port 256/257 and firewall-1
*>
*> My take on this, from Checkpoint, is that the ports are "proprietary"
*> Checkpoint ports and provide:
*> 1) Firewall module and management station services
*> 2) Download of the rule base
*> 3) Systems status
*>
*> The services can be disabled under the Firewall Policy/ Properties and
*> uncheck the "Accept Firewall-1 Control Connection" box.  I certainly
*> wouldn't have the ports accessible on an untrusted interface.


> At 11:59 11/12/98 +0800, you wrote:
> I notice that ports 256,257,and 258 are open when our Firewall-1 is
> portscanned. 
>
> Does anyone know what FW-1 uses these ports for?