 Re: TCP packet out of state
Oh, and I meant to add, that allowing out of state TCP packets is a massive security risk. If you're going to do that, why bother with using Check Point at all? Just install a Cisco router with basic access lists, and save yourself the license fee.
Think carefully through the implications of allowing out of state traffic - you've now disabled Check Point's vaunted "Stateful Inspection" What would happen if I was to send 25,000 acks through your firewall? It would allow them, and add them to your connection tables, filling it up.
I could also use it for port scanning pretty trivially. |