Firewall rules affected by crash or patch?

[Mott Given]

Can firewall rules on HP-UX be accidentally changed by either:
1) a system crash
2) a patch
If so, which cause is more likely?
If I don't have a root account or access to view the firewall rules, what HP-UX files can I still see that might help me figure out if #1 or #2 above affected the firewall rules?

Mott Given

[A. Clay Stephenson]

You are not very clear. Is the Firewall itself running on HP-UX (e.g. Checkpoint) or are you having problems relating to the HP-UX host connected to an external firewall (e.g. Cisco's PIX or another host running CheckPoint)?

[Mott Given]

Its the latter problem. SOme ports which we need on that host appear to have become closed.

[Steven E. Protter]

If the fireall is Symantec or whatnot.

Then the answer is no.

If those servers crash, they generally can be restarted and run the way they were configured before the crash. If they totally crash and don't come up you don't have a firewall or outside access any more.

No matter how many times the HP box crashes or not, it won't affect the firewall.

Conact the administrator of the firewall and ask them if they've made changes. Nine times out of ten when I can't do something, they were fiddling around.

SEP

[A. Clay Stephenson]

A patch might do it if, for example, /etc/inetd.conf were modified so that some services no longer start or if /etc/services (or the services NIS(+) map were modified. Are you still using exactly the same IP address(es)?

The typical way to resolve problems like this is to enable full logging on the firewall and then try some of these missing functions. THe firewall's log should then have "Deny" messages which will lead you to the problem.

----------------------------------------------

A very useful method is to connect another host on the same side of the firewall and see if the services now work. If so then that is definitely a firewall configuration change.