[Snort-users] Compiling snort for CheckPoint Firewall-1 support

Paul Melson pmelson at ...11827...
Thu May 11 11:31:01 EDT 2006


-----Original Message-----
Subject: [Snort-users] Compiling snort for CheckPoint Firewall-1 support

>   i would like to test snort 2.4.4 release with CheckPoint fw-1 (NGR55 and
NGX) and in-line > (snort-inline.sf.net) support. I have used snortsam last
months, but I need a real IPS now 
> thath sends commands to my firewalls and blocks traffic. How can I compile
snort for fw1 ? 
> support???

You can't build Snort with FW-1 specific support like you can with
RealSecure or other commercial products that have OPSEC(tm) support.
However, you can build Snort with flexible response (configure
--enable-flexresp && make) and then Snort can send TCP RST or ICMP
unreachable packets to both attacker and target which will shut down the
connection.  

One tip with using TCP RST and FW-1: you will probably want to place the
Snort sensor on the VLAN immediately inside the firewall and disable
spoofing protection on the inside interface.  Otherwise FW-1 is prone to
dropping the TCP RST packets and leaving connections in the state table that
you want killed.

PaulM





More information about the Snort-users mailing list