FireWall-1 FAQ: Connections terminate on a policy install
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
You might notice that on a policy installation, your active connections will terminate. As of FireWall-1 4.1 SP2, FireWall-1 will flush the connections table on a policy load. In FireWall-1 NG FP2 and above, this can be resolved by going to the Gateway object in Policy Editor / Smart Dashboard and going to the Advanced Frame, Connection Persistence. There you can define whether connections are saved across policy installs or not.
In FireWall-1 4.1, you can add the ‘keep’ flag to the connection table definition in $FWDIR/lib/table.def on the management console. It should look like the following (this is from FireWall-1 4.1 SP4): connections = dynamic refresh sync expires TCP_START_TIMEOUT expcall KFUNC_CONN_EXPIRE kbuf 1
#ifdef SECUREMOTE
implies userc_verified_connections
#else
implies ftp_restrictions
#endif
hashsize 32768 limit 25000;
One simply adds ‘keep’ after the word ‘sync’ as shown below: connections = dynamic refresh sync keep expires TCP_START_TIMEOUT expcall KFUNC_CONN_EXPIRE kbuf 1
#ifdef SECUREMOTE
implies userc_verified_connections
#else
implies ftp_restrictions
#endif
hashsize 32768 limit 25000;
You will need to reload your security policy for this change to take effect.
If you are using an Oracle SQLNetv2 connection, an alternative approach is to configure Oracle to use one specific port with USE_SHARED_SOCKET = TRUE parameter.
