> Source: [sk110561](https://support.checkpoint.com/results/sk/sk110561)

# sk110561 - How to protect the Security Gateway from Firewalk scans

| Property | Value |
|----------|-------|
| Solution ID | sk110561 |
| Date Created | 2016-04-13 |
| Last Modified | 2020-04-19 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Solution

**Abstract**

When a customer has servers that need to be available to the world in a DMZ - for example web servers, the Firewalk application can do reconnaissance scans to map the network based on the way the gateway handles the ICMP traffic.

Firewalking is an active reconnaissance network security technique, that attempts to determine what layer 4 protocols a firewall or router will forward.

Firewalking works by sending out TCP or UDP packets with a TTL one greater than the targeted gateway. If the gateway allows the traffic, it will forward the packets to the next hop where they will expire and elicit an ICMP_TIME_EXCEEDED message. If the gateway host does not allow the traffic, it will likely drop the packets and there will be no response.

Firewalking activity against the infrastructure allow an external scan to successfully map the hosts from the Internet to the test environment. This allows an attacker to gather information regarding the internal network.

To stop such activity, the firewall may be tuned to drop ICMP Time Exceeded messages.

Stateful ICMP is set to accept replies and error by default.

**Procedure**

Stateful ICMP

1. In SmartDashboard, Select Policy \> Global Properties.
2. In the Global Properties dialog box, select the Stateful Inspection branch from the left pane.
3. In the Stateful Inspection page, uncheck both of the following check boxes in the "Accept Stateful ICMP" section:
   * Replies
   * Errors
4. Click OK in the Global Properties dialog box.
5. Install policy.

The above is a global change that affects the Rule Base and disables the following:

* Replies - Accept ICMP reply packets for ICMP requests that were accepted by the Rule Base.
* Errors - Accept ICMP error packets which refer to another non-ICMP connection (for example, to an ongoing TCP or UDP connection) that was accepted by the Rule Base.

Note: Disabling from Global properties is the only solution by design.   
If it can not be disabled using Global Properties, open RFE.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content