X-windows Session.

[humayun]

I have some users who would like to use X-windows session between a unix/linux machine and their windows XP machine. What are the ports I would need to open up in order for this to work?

Thanks in advance.

[kva.kva]

Do you try to add rule with allowing tcp service X11 (X Window System - 6000-6063)?

[humayun]

Actually i did try to add that using ports 6000-6063 and I also added these ports for Xsession 6000-6250

Its no longer getting dropped in my logs but its still but authenticating the session.

- Humayun

[Sergej]

X11 is not included to the ANY port definition. You can change this behavior by going to "Advanced Configuration" (last button in last menu under Global Properties) and removing check-mark on the Firewall-1>StateFullImspection for the 'reject_x11_in_any'

P.S. You can also use dbedit if you cool enough :)

[kva.kva]

Sergej
X11 is not included to the ANY port definition. You can change this behavior by going to "Advanced Configuration" (last button in last menu under Global Properties) and removing check-mark on the Firewall-1>StateFullImspection for the 'reject_x11_in_any'

P.S. You can also use dbedit if you cool enough :)

You right, but if in rule it uses definite service, i think, this configuration isn't importance.

[kva.kva]

Originally Posted by humayun

Actually i did try to add that using ports 6000-6063 and I also added these ports for Xsession 6000-6250

Its no longer getting dropped in my logs but its still but authenticating the session.

- Humayun

Do you see anything in log on linux server?

[humayun]

I cant find the Option you mentioned in my NGX (R60) SmartDashboard.

Do you know where precisely its at?

[kva.kva]

Use GuiDBEdit for editing.
But it isn't necessarily. You need to edit "reject_x11_in_any" only if you want to allow X11 through Any services. If you explicitly add rule for service X11, it should work.

"X11

X11 connections are not allowed through service 'Any'. All services of type 'Other' and X11 (which is a very special case) require a specific rule, since these services run specific INSPECT code, and are not just 'Accepted'. In order to allow X11 connections, either add a rule that explicitly allows X11 connections, or use Check Point's Database Tool (GUIDbEdit) to set the value of the attribute reject_x11_in_any to 'false'."

http://secureknowledge.checkpoint.co....do?id=sk27124
http://secureknowledge.checkpoint.co....do?id=sk24600