[Snort-users] Compiling snort for CheckPoint Firewall-1 support
pmelson at ...11827...
Thu May 11 11:31:01 EDT 2006
Subject: [Snort-users] Compiling snort for CheckPoint Firewall-1 support
> i would like to test snort 2.4.4 release with CheckPoint fw-1 (NGR55 and
NGX) and in-line > (snort-inline.sf.net) support. I have used snortsam last
months, but I need a real IPS now
> thath sends commands to my firewalls and blocks traffic. How can I compile
snort for fw1 ?
You can't build Snort with FW-1 specific support like you can with
RealSecure or other commercial products that have OPSEC(tm) support.
However, you can build Snort with flexible response (configure
--enable-flexresp && make) and then Snort can send TCP RST or ICMP
unreachable packets to both attacker and target which will shut down the
One tip with using TCP RST and FW-1: you will probably want to place the
Snort sensor on the VLAN immediately inside the firewall and disable
spoofing protection on the inside interface. Otherwise FW-1 is prone to
dropping the TCP RST packets and leaving connections in the state table that
you want killed.
More information about the Snort-users