Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

snmp monitoring of Checkpoint firewall

Posted on 2014-10-28
10
Medium Priority
?
438 Views
Last Modified: 2014-10-30
I have enabled SNMP on my checkpoint 4400 firewall running R77.10.  

However, I am not sure how to create a rule on the firewall to allow SNMP traffic to flow between my monitoring server (10.1.1.20) and the internal interface of the firewall (10.1.1.16).  I am new to Checkpoints so am a little lost.

SNMP-Rule.PNG
All of the documentation I have found online states that this needs to be done, but provides no instruction on how to do it.

Please help.
0
Comment
Question by:mtkaiser
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 62

Expert Comment

by:gheist
ID: 40410092
You need to allow from IP to IP and only SNMP
0
 
LVL 12

Accepted Solution

by:
Fidelius earned 1000 total points
ID: 40410257
Your rule is OK. If you set up SNMP correctly, it should work.
You can clean up rule a little bit and leave only snmp and snmp-trap.

If you want more strict rule make it like this:
CP monitoring rule
And put the rule as high as possible, as it will be hit pretty often.
0
 
LVL 62

Assisted Solution

by:gheist
gheist earned 1000 total points
ID: 40410370
No - snmp requests come from SNMP server and checkpoint keeps state to get responses back to SNMP server.
Then check logs (from one host to other host, looking for smart blocking errors, if yes, change rule to IP:any->CP:161 all UDP))

SNMP traps can notify monitoring system (if it includes SNMP trap handling), thats out of scope for first attempt. It will need a new rule in other direction 162/UDP, with same hand-patting to make it work.
0
Will your db performance match your db growth?

In Percona’s white paper “Performance at Scale: Keeping Your Database on Its Toes,” we take a high-level approach to what you need to think about when planning for database scalability.

 
LVL 12

Expert Comment

by:Fidelius
ID: 40410441
Yes, I agree.
But if you put rule the way I wrote it, you will at the same time allow snmp queries from server to CheckPoint, and CheckPoint sending traps to server.
This rule can be separated in two rules, but if you put it like this, it is more clearer and easier to manage.
0
 
LVL 62

Expert Comment

by:gheist
ID: 40410447
But why to let unused protocols through?
0
 
LVL 12

Expert Comment

by:Fidelius
ID: 40410469
As I said, it is more clearer and easier to manage. Also it takes less resources on firewall upon compiling rules
If you want strict and very high level of security you can write two separate rules
- one allowing server to CP only at udp/161
- other allowing CP to server only for udp/162

At the end it is balance between security and manageability.
0
 
LVL 62

Expert Comment

by:gheist
ID: 40410477
In other words sacrificing of security on altar of laziness ;)
0
 
LVL 12

Expert Comment

by:Fidelius
ID: 40410492
It depends :)
Sometimes going to more restricted policies on inside network leads to more problems, especially if you have lots of rules, and lots of systems to manage. But this is totally different subject from one in question ;)
0
 
LVL 62

Expert Comment

by:gheist
ID: 40410509
My point is to check for conflicts with inspection engine at the very beginning to keep it running problem-free after.
0
 

Author Closing Comment

by:mtkaiser
ID: 40413709
Thanks guys!!
0

Featured Post

Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question