FireWall-1 FAQ: Two CVP Servers for the Same Connection?
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
Q:
I would like to setup FireWall-1 ver. 4.0 SP-3 including the latest hotfix for SP-3 so that data received through a http or ftp connection are first scanned by Norton Antivirus and then by Finjan’s Surfingate. I tried to create a rule like this:
| Source | Destination | Service | Action |
| proxy | any | http->anti-vrius
http->finjan |
accept |
and a similar rule for ftp, but the GUI told me it is not allowed to use two CVP servers for one connection. When I use two separate rules, the connection is caught by the first one and the second check is not carried out.
Anyone here has an idea how to do this correctly?
A:
Check Point allows for this to occur in FireWall-1 4.1 with the help of an application called CVP Manager. This application looks like a single CVP server to a firewall module, but it is basically a front end that calls a number of different CVP servers, either in sequence, or in a load balancing configuration. CVP Manager can be downloaded from Check Point's support site.In the NG release, you can create "CVP Groups" that allow you to chain or load balance multiple CVP servers.
