Recently one of our sales offices was not able to download postage using their Pitney Bowes postage machine. I was seeing dropped packets from the machine in our Checkpoint firewall logs. The logs were stating that SmartDefense was blocking the packets due to an illegal header format detected in the http protocol.
After speaking with the Pitney Bowes technician it was discovered that the machine uses chunked encoding to transmit the sensitive account information to their servers.
It turns out the SmartDefense isn’t so smart after all. Setting all the HTTP Protocol Inspection pieces of SmartDefense to Inactive didn’t solve the packets being dropped. In order, to fix this issue I had to set all the HTTP Protocol Inspection pieces of SmartDefense to active and check the monitor only checkbox so as not to actually block the packets. This in theory would have shown me exactly the SmartDefense rule that had been blocking the transmissions….not the case. It did allow the chunked encoded packet transmissions to pass through the firewall but it didn’t show me what SmartDefense rule was triggering the block. On to trial and error…..
Finally, I figured out that in order to fix this issue you must have ASCII Only Response Headers set to active (either active/monitor only or just active). This will allow the chunked encoded packets through the firewall or at least it has worked for my application. You can find this setting by going into SmartCenter, under the SmartDefense tab > expand Web Intelligence > HTTP Protocol Inspection > set ASCII Only Response Headers to active. You must re-install the policy after making these changes.
We are running Checkpoint NGX R65.
I hope this helps.
Will
March 19, 2009 at 8:03 am
We too are running into this issue on a Pitney Bowes DM400C
However, we are using a Fortinet firewall/router and not a Checkpoint product.
Is there a way to turn on “chunked encoding” for the Fortinet product?
Aloha,
Jonathan Spangler
March 19, 2009 at 9:34 pm
I can’t find anything on the fortinet boxes but I am not very familiar with them either. We are actually going to move to them in the near future because they offer a better feature set for less money. I have a great contact for Fortinet in Atlanta if you want to give them a call. Email me if you would like the contact info. wmoore@theadminrules.com
Thanks for reading and please post what you come up with or email it to me so I can post it and give you credit.
Will