FireWall-1 FAQ: Services are Slow in Connecting
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
When you try to establish a telnet connection from the internal net to a computer on the external net, it might take around 10sec before you get the login prompt (20sec for ftp). HTTP does not experience this sort of delay.
This is most likely a DNS issue. The system you are trying to telnet to is trying to perform a reverse DNS lookup on the host you are trying to telnet from (i.e. resolve a name to the IP). The “delay” is the amount of time it takes to time out. You can resolve this by simply adding a host entry on the server with the client’s name and IP address or by fixing DNS.
Another possibility is ident. Some servers use ident for reverse lookups. If ident is being dropped at the firewall, this will cause a delay. You can shorten this delay by adding a rule to reject ident (as opposed to drop), which will time ident out much quicker.
