sk184876 - Internal DDoS port re-enables itself after being disabled in Maestro Security Gateways

Internal DDoS port re-enables itself after being disabled in Maestro Security Gateways

Product

Maestro HyperScale Firewall, Security Gateways

Version

R81.10 (EOS), R81.20

OS

Gaia

Platform

16000

Last Modified

2026-05-18

Symptoms

The internal Distributed Denial of Service (DDoS) port becomes enabled again after an administrator disables it. Administrators disable the internal DDoS port on the Security Gateway by running:

fwaccel dos config set --disable-internal

After some time, the internal DDoS port is enabled again without administrator action.

Cause

In this software version, DDoS acceleration uses Indicators of Compromise (IoC) processing. During IoC handling, multiple internal components manage the DDoS internal port state.

Under specific IoC processing conditions, one of these components resets the internal DDoS port to its default enabled state. This occurs independently of administrator actions and depends on IoC processing events.

Solution

Added an option to disable enforcement on internal interfaces when IOC indicators are loaded. To configure this option, add or modify [IOC] enable_internal_interface=<value> in the file _$FWDIR/conf/malware_config_ (for MDS, additionally in _$MDS_FWDIR/conf/malware_config_).

A private Hotfix is required to fully prevent IoC modules from re-enabling the internal DDoS port after it is disabled.

This problem was fixed. The fix is included in:

Jumbo Hotfix Accumulator for R81.20 starting from Take 120
Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2026-05-13
Last Modified: 2026-05-18