Re: Support for IP redirection by CheckPoint Firewall-1 NG

I see where my Secureplatform firewalls attempt to
send
icmp redirects, because the
/proc/sys/net/ipv4/conf/eth0/send_redirects has a
value 
of 1 by default.  
Hopefully by setting this to 0 in the /etc/rc.local
file will prevent this behavior and clear up the
firewall logs with constant rule 0 drops of the icmp
redirect attemtps by the OS.


--- Markus Wernig <listener@wernig.net> wrote:
> Jarek Sluzewski wrote:
>
> >     In other words, if the firewall receives a
> packet, and based on its
> >     routing table determines that this packet
> should be sent via same
> >     interface that received it, will the NG
> forward the packet or just
> >     drop it (as PIX would).
> >      
> In our tests on Nokia Ipso3.8, the packet was sent
> back out without any 
> problems on the same interface if there was a rule
> to allow it. We 
> dind't see any icmp redirects. This kind of makes
> sense because the 
> firewall engine will see the packet before the
> routing engine does.
> (And, yes, they would have been dropped anyway.)
>
> krgds /markus

Randall Paige
Cell # 404 218-0241


                
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Find what you need with new enhanced search. 
http://info.mail.yahoo.com/mail_250