CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > Content Security/Security Servers/CVP/UFP
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-09-22
Junior Member
 
Join Date: 2008-09-22
Posts: 4
Rep Power: 0
SG-UK has an average reputation (10+)
Default Implicit Rule Denying VB script

Hi guys,

I am having a problem executing a vb script through my CP firewall. It keeps getting dropped on rule 996 obviously there is no rule 996. However I can't see why it is being dropped and log viewer gives no usefull info.

Thanks

Scott
Reply With Quote
  #2 (permalink)  
Old 2008-09-22
Senior Member
 
Join Date: 2006-03-19
Location: Northern Ohio
Posts: 913
Rep Power: 3
RayPesek has an average reputation (10+)
Default Re: Implicit Rule Denying VB script

Those really high numbers are SmartDefense numbers. 996 is for RPC. Here's an example: Check Point Software: SmartDefense Advisory - Microsoft DCE-RPC denial of service

What's the script trying to do?

Ray
Reply With Quote
  #3 (permalink)  
Old 2008-10-02
Junior Member
 
Join Date: 2008-09-22
Posts: 4
Rep Power: 0
SG-UK has an average reputation (10+)
Default Re: Implicit Rule Denying VB script

HI,

It is microsoft WMI is used for a lot of operations. It is being used to poll server configuration data, manage servers via scripts, managing logon scripts etc...

How can I stop smartdefense from dropping it??

Thanks

Scott
Reply With Quote
  #4 (permalink)  
Old 2008-11-20
Junior Member
 
Join Date: 2008-09-22
Posts: 4
Rep Power: 0
SG-UK has an average reputation (10+)
Default Re: Implicit Rule Denying VB script

Hi guys,

How can i disable this in smartdefense, i am running FP3 and can't seem to find anywhere to disable a particular alert?

Thanks

Scott
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 02:22.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0