Many thanks for the update, I total agree with your recommendations, but from a client firewall perspective (i.e. the integrity client) what ports would i need to allow for peap authentication ... i.e. is it over http (tcp port 80), https (tcp port 443), etc.

Your assistance is appreciated.

Thanks again.

Regards,

Adrian

Many thanks Erik, so hopefully no configuration necessary of the integrity client.

many thanks adrian

That's correct, there should be no client (software) firewall configuration.

Erik

I wish it was as simple as that, unfortunately all laptops (the wireless users) will have the integrity client, so not sure where to go from here, as since checkpoint has purchased integrity the free support has gone!

But as you have pointed out, this happens at layer 2, so not sure if the integrity client gets involved at this point?

thanks again.

regards adrian

Correct me if I'm wrong (I'm not very familier with these client firewall products), but as I understand it they are all layer-3/4 firewalls.

That being the case none of them will effect the 802.1x authentication/authorization process.

I agree, but for some reason the windows team who do the image for the laptop need me to provide them with what is needed on the integrity client. By as it is layer 2 i'm not sure if rules need to be defined. Suspect the only way to be sure would be to put a sniffer on the client.

Thanks again for your assistance.

regards, Adrian.

I know this isnt exactly an all encompasing list but it's about the best thing I could find:

http://www.checkpoint.com/products/enterprise/comparison_chart.html

For what it's worth the Integrity firewall does do some application layer filtering.

I would tell your Windows build team that no settings are needed and just test prior to deployment (you're going to know quickly if it isnt working). I would be very suprised if the client had issues because of this.

Hi Eric,

Thanks again for your assistance, this is a good page to work from.

Thanks again for your efforts it is appreciated.

All the best for the testing!

Thanks and regards,

Adrian.