Nokia DOH (adding rules)

[Piloria]

ok this is the first time i have configured a nokia box i have always used NT. so a gui console on the machine makes it easy.

1. activated CP FW-1
2. ran cpconfig on box (only works under admin user at this point)
3. entered required data and set up gui client ip addresses
4. rebooted
5. firewall has no rule to allow gui client management access.
6. need to add a rule (i presume via command line on console)

how do i enter the management rule (never added a rule via command line before)

is there another way of setting up where this isnt required?

 

[ChrisAC]

You don't need to add a rule to allow the GUI access. Just run cpconfig, create the administrator account(s), GUI client addresses, reboot it and then point your policy editor / SMARTDashboard at the box and then accept the fingerprint and bingo .... you're in!!

I'm in the middle of building a new fw on a Nokia IP330 at the moment. Cool platform!

Chris. **********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[Piloria]

ok i need to unload the policy

fw unload localhost

 

[Piloria]

inothe firewall wont accept an incomming connection if there isnt a management rule (not in defauly rulebase)

so you need to unload the policy (it adds it automaticly) so get the gui client working then add the management rule and it all works again

 

[ChrisAC]

You shouldn't need to unload the policy. When it starts up it loads the default filter which allows management connections. Are you using NG? I built mine last week using NG FP3 but I've also done it on 4.1 on a Nokia IP440 and I didn't need to unload the policy to get connected via the GUI. However, if you can't get in then unloading the policy from the command line will do it.

This is from Nokia Network Security - Syngress (Good book) ..

" After you have the CheckPoint packages installed, enabled, and configured, you can begin configuring a security policy for your Nokia firewall. Even if the InitialPolicy is loaded, you should be able to connect with a GUI client and push a policy. If you have any trouble with this process, unload the default filter with fw unloadlocal (prior to NG FP2 the command was fw unload localhost)."

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[brianpaterson]

You only need a rule if you have a distributed implementation and your management traffic has to go over the firewall to get to the management station. Otherwise its just the addition of the GUI through CP Config. B-)
Brian, CCSE
brian@domain-integrity.com