The UnofficialAxent Raptor Firewall
Frequently Asked Questions (FAQ),

And Some Answers ...



Copyright
This document and its contents are Copyrighted (c) 1999 by Nash E. Foster under the GPL. Any content included herein that is pulled from the Raptor Mailing List remains property of the original poster, except where noted. If you have a problem with being included, quoted, or referenced from within this document, let nash know and he'll fix it.

Q: I've seen references to hotfixes on the list, but all I ever see on the Raptor Support site are the patch kits. Is there another place I should be looking for updates?

A: The patches are available linked from
http://www.raptor.com/cs/patches/patches.html . These links contain various tables which show the patch and hotfixes for a given product and operating system combination. E.g. Raptor UNIX 6.0 which is at: http://www.raptor.com/cs/patches/eunv6patches.html The tables look something like the following:

The links under "Download Patch Kit" will take you to the patch bundle. The link under "Hotfixes" will take you to a hotfix page relevant to the product you are dealing with. E.g.:
http://www.raptor.com/cs/patches/eunv602hotfixes.html


Do note, please, that not all Hotfixes are appropriate for all environments. You should read the documentation carefully to determine whether the hotfix you are about to apply is actually required for your site. Some are, some are not.


Q: Do I have to load the 6.01 patch before installing the 6.02 patch?

A: No, the patch bundles include all previous patches and do not need to be applied in sequence. Neither do the hotfixes, for that matter, since they simply replace a given system binary (e.g. /usr/raptor/bin/httpd) with another system binary that you have downloaded.


Q: I've been looking around for some PC-based or very inexpensive single user firewall solutions? What is available? Do they support VPNs?

A: This isn't really a topic of relevance to the Raptor Mailing List, but we get this all the time. There are basically three products of which I am aware at this time but no one seems to have been able to sufficiently test the VPN interoperability to make me confident that will work at all. You can look around for:

Surely there are more, but I'm not here to provide marketing glitz for these PC firewall companies. If you want something added or removed from the list, mail me why and I'll consider it.


Q: What needs to be opened to permit Outlook 98 to access Exchange? Via OWA?

Answer From: Brett J. Kreykes Brett.Kreykes@ForeignCandy.com

Proto	Src             Dest
TCP     1024-65535      1044
TCP     1024-65535      1055


Q: Does Raptor provide for a way to ftp to a firewall and copy the log files from it? The NT version of ftp allows for you to type "ftp -n -s:script.scr 12.12.54.58" The Raptor version does not seem to allow for the -s option to run a script. Is there a similar option in this version?

A. posted by Edward Davis edavis@openmarket.com you find the 'remotelog' stuff in the raptor directories

stick remotelog on another server the go to raptorfirewall and run rempass to let that other server access logfiles

then run remotelog towards the firewall and it sucks the entire log or yesterdays log over to your box. works great

comes over as ascii text, and left running can stream the log over

as for FTP, you simply set up normal NT scripting on the raptor firewall and allow vulture to allow ftp, and PUMP the log off the firewall. unless you install an ftp server on the firewall itself

A. posted by "Ng, Kenneth (US)" kenng@kpmg.com

On Unix firewalls we have a cron process that runs ssh with RSA authentication to an internal log machine. This is much safer then allowing something to connect to the firewall and getting access. If you must do it this way, connect the process to the internal NIC, so that no one one the outside can reach it. I know that there are cron type programs available for NT, and I presume ftp or something can be scripted.

A. posted by Jason Diesel jdiesel@axent.com

Rather than ftp to the firewall, a connection that you have little control over, why not set the firewall up so that it ftp's the logs to another machine at a pre-set time everyday, say 2am. You will need the ftp.exe client from our ftp site, as ftp'ing from the firwall locks certain ports down and the default NT one does not understand this.

You can then get clever with some scripting, and have that machine process the logs into a report format before you get into the office each day, having everything ready for you.

More detail provided by John DiGiovanni jdigiovanni@christianacare.org

You can download the FTP.EXE program from ftp://ftp.raptor.com/pub/unsupported/ftp.exe. You can read about it at the URL: http://www.raptor.com/cs/FAQ/top10.html#11

This works a little different than the Microsoft client with that client you can use -s:script.ftp. The raptor client does not suppore that command so you have to use a < dos redirection to send the commands to the ftp.exe client.

Use it as follows..

ftp -v -n < script.ftp

The script.ftp contains the commands just as you would type them from the client.

           open
	   xxx.xxx.xxx.xxx (your destination machine)
	   user  
	   put logfile.19990724
	   quit
I ZIP my files bofore I send them the the FTP server. I also has a binary command and some CD commands I use as well. Thanks to Deepak Sakhrani for answering my post.


Q: Is there an HP-UX version of Raptor 6.0 available yet?

A. posted by Ronald C Atkinson atkinsonr@dteenergy.com Well after waiting several years, we finally received Raptor 6.0 (actually called Praesidium) for HP-UX today. For everyone else waiting for it you might want to contact your HP rep, it actually does exist and is available now. I never thought I was going to see it. Ron


Q: What are the System Requirements for Raptor?

A. Raptor publishes its System Requirements for Each Platform and Version at http://www.raptor.com/cs/FAQ/faqs.html


Q: What does the Raptor Installation do to harden the Solaris OS?

A. posted by Bill Royds Bill_Royds@pch.gc.ca Look in /etc/init.d/* for Raptor modifications

This means a firewall machine can't have NFS file shares, can't pick up NIS passwords can act as a BOOTP/DHCP server, can't act as a router, will not automound files and will not do automatic volume management for CD's or floppies.


Q: Some web sites are very fast and I can get to them with no problems. Other web sites seem extremely slow, taking several minutes to download a simple page. What's up with that?

A: Most likely you are experiencing a problem with reverse lookups not being correctly configured for some web sites. Perhaps, the problem is related to your own reverse records. In any case, you can easily fix the web browsing problems by disabling reverse lookups in your config.cf file. Simply find the following:

          # reverse_lookup controls:

	  # reverse_lookup controls whether the connection endpoints are
	  # DNS resolved to get hostnames. If this is disabled, then rules
	  # will only match on IP addresses, and domain rules will not work.
	  # Further, all the logs will be in terms of IP addresses.

	  reverse_lookup=1
And change the last line to:
          reverse_lookup=0
Now you must reconfigure the gateway by either stopping and restarting it or by running the /usr/raptor/bin/display command and entering 'c'.


Q: Log Error: SMTP: Non-transparent call from 10.1.1.1

A: This probably indicates that you do not have server or client transparency configured correctly. You need to remember to publish your servers on the external interface if you wish to have them accessible. [ed note: is this right? I haven't had a problem w/it in so long ... ]


Q: Is it possible to turn off the reverse lookups "feature" for only one interface? E.g. Don't do reverse lookups for traffic received on the inside interface, but still do it for the external interface.

A: No, it is a configuration which applies (primarily) to the logging subsystem which is a single subsystem servicing the entire firewall.


Q: 610 Internal error: can't bind socket to 139.25.250.106 UDP port 53 (Cannot assign requested address.) A. posted by Michael Ristau Michael.Ristau@siWan.de

I guess that you didn't uninstall raptor before installing the new NIC. If you make changes like joining an nt domain, changing an IP address or exchanging a NIC requires that you uninstall raptor before doing this. Then you may perform the changes + after this you may install raptor again. I know that this is cumbersome, but by this you'll avoid error messages like those you get now.


Q: Can I enabled IBM 3270 Access through my Raptor firewall?

A: Yes, the telnetd will properly proxy this application for you.

More detail provided by Chris Leonardos cleonardos@vitts.com

... IBM's Client Access software (which does 3270) as well as allowing direct database access/printing etc., requires you remove the "Eagle Secure Gateway" message from the telnet proxy before it will work.

This message can be removed by editing the gateway_motd file (or ftp_motd for that service) located in the sg directory.


Q: MMC crashes with a Dr. Watson every time you try to launch the Widows Raptor Management Console (RMC). What's wrong?

A: Answer posted by Jeff Paddock jpaddock@axent.com: I have seen this Dr. W when I applied the msjavx86.exe (Java Virtual Machine) patch. If you do not apply this MS patch then the 6.0.2 patch should work with out issues.


Q: I would like to use pcAnywhere on the system with the Raptor console and remote control it from a system on the internal network so I can configure the firewall from my desk. Is this a good idea? If yes, how is it done? If no, why?

A: Generally, you would not be encouraged to run PC Anywhere on your firewall or remote administrator. PC Anywhere is not reviewed in public (neither is Raptor) for security. If you do want to enable PC Anywhere either TO the the firewall you need to add the following lines to you sg/portcontrol.cf file:

enable tcp 5631 enable udp 5632


Q: How do I enable PC Anywhere through my firewall?

A: You need to create two protocol entries, two GSPs, and a rule. One each for the PC Anywhere TCP port and one for the UDP port. Here's a list of those ports by the version of PC Anywhere you are using, this is also available from Symantec's web site (where I downloaded it).

version TCP port UDP port How to Change Port Settings
2.0 65301 22 Download and install the file PORTS_20.EXE
7.0 65301 22 download and install the file PORTS_70.EXE
7.50, 7.51 65301 22 Upgrade to 7.52 by downloading and installing the upgrade file 75UP_C.EXE
CE 65301 22 Ports cannot be changed
7.52 5631 5632 Execute the file TCPPORT2.REG located in the pcANYWHERE folder.
8.x, 9.x 5631 5632 Automatically accounts for connection to or from the other set of ports.