CHECK POINT NG: NEXT GENERATION SECURITY ADMINISTRATION

By A. NOMIY

CONTENTS CHAPTER 1 INTRODUCTION TO CHECK POINT NEXT GENERATION INTRODUCTION INTRODUCING THE CHECK POINT NEXT GENERATION SUITE OF PRODUCTS ACCOUNT MANAGEMENT (LDAP) SECUREMOTE/SECURE CLIENT REPORTING MODULE CHECK POINT HIGH AVAILABILITY (CPHA) USERAUTHORITY META IP SVN COMPONENTS VPN-1/FIREWALL-1 MANAGEMENT MODULE MODULES SECUREUPDATE SECUREXL GRAPHICAL USER INTERFACE SECURITY DASHBOARD POLICY SERVER DESKTOP SECURITY LOOKING AT FIREWALL TECHNOLOGY PROXY SERVER VS PACKET FILTER PERFORMANCE AND SCALABILITY FIREWALL-1’S INSPECTION ENGINE SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 INSTALLING AND CONFIGURING VPN-1/FIREWALL-1 NEXT GENERATION BEFORE YOU BEGIN OBTAINING LICENSES SECURING THE HOST DISABLING SERVICES ROUTING AND NETWORK INTERFACES ENABLING IP FORWARDING CONFIGURING DNS PREPARING FOR VPN-1/FIREWALL-1 NG ADMINISTRATORS GUI CLIENTS UPGRADING FROM A PREVIOUS VERSION INSTALLING CHECK POINT VPN-1/FIREWALL-1 NG ON WINDOWS INSTALLING FROM CD CONFIGURING CHECK POINT VPN-1/FIREWALL-1 NG ON WINDOWS LICENSES CERTIFICATE AUTHORITY INITIALIZATION INSTALLATION COMPLETE GETTING BACK TO CONFIGURATION UNINSTALLING CHECK POINT VPN-1/FIREWALL-1 NG ON WINDOWS UNINSTALLING SVN FOUNDATION UNINSTALLING MANAGEMENT CLIENTS INSTALLING CHECK POINT VPN-1/FIREWALL-1 NG ON SOLARIS CONFIGURING CHECK POINT VPN-1/FIREWALL-1 NG ON SOLARIS SNMP EXTENSION GROUP PERMISSION INSTALLING CHECK POINT VPN-1/FIREWALL-1 NG ON NOKIA NG PACKAGE UPGRADING IPSO IMAGES INSTALLING VPN-1/FIREWALL-1 NG CONFIGURING VPN-1/FIREWALL-1 NG ON NOKIA CHAPTER 3 USING THE GRAPHICAL INTERFACE MANAGING OBJECTS NETWORK OBJECTS WORKSTATION NETWORK DOMAIN OSE DEVICE EMBEDDED DEVICE GROUP LOGICAL SERVER ADDRESS RANGE GATEWAY CLUSTER DYNAMIC OBJECT SERVICES TCP UDP RPC ICMP OTHER DCE-RPC RESOURCES URI URI FOR QOS SMTP FTP OPSEC APPLICATIONS SERVERS RADIUS RADIUS GROUP TACACS DEFENDER LDAP ACCOUNT UNIT CERTIFICATE AUTHORITY SECUREMOTE DNS INTERNAL USERS TIME SCHEDULED EVENT VIRTUAL LINK ADDING RULES RULES SOURCE DESTINATION SERVICE ACTION TRACK INSTALL ON COMMENT GLOBAL PROPERTIES FIREWALL-1 IMPLIED RULES VIEWING IMPLIED RULES SYNDEFENDER SECURITY SERVER AUTHENTICATION VISUAL POLICY EDITOR GATEWAY HIGH AVAILABILITY MANAGEMENT HIGH AVAILABILITY STATEFUL INSPECTION LDAP ACCOUNT MANAGEMENT NETWORK ADDRESS TRANSLATION CONNECTCONTROL OPEN SECURITY EXTENSION LOG AND ALERT LOG VIEWER COLUMN SELECTIONS SYSTEM STATUS CHAPTER 4 CREATING A SECURITY POLICY REASONS FOR A SECURITY POLICY HOW TO WRITE A SECURITY POLICY SECURITY DESIGN FIREWALL ARCHITECTURE WRITING THE POLICY GUIDELINES STANDARDS PROCEDURES DEPLOYMENT ENFORCEMENT MODIFICATIONS OR EXCEPTIONS IMPLEMENTING A SECURITY POLICY DEFAULT AND INITIAL POLICIES TRANSLATING YOUR POLICY INTO RULES DEFINING A FIREWALL OBJECT DEFINE RULE BASE MANIPULATING RULES CUT AND PASTE RULES DISABLE RULES DELETE RULES HIDING RULES DRAG AND DROP QUERYING THE RULE BASE POLICY OPTIONS VERIFY INSTALL UNINSTALL VIEW ACCESS LISTS INSTALL USERS DATABASE INSTALLING A SECURITY POLICY POLICY FILES CHAPTER 5 APPLYING NETWORK ADDRESS TRANSLATION HIDING NETWORK OBJECTS ROUTING AND ARP CONFIGURING STATIC ADDRESS TRANSLATION STATIC SOURCE STATIC DESTINATION AUTOMATIC NAT RULES AUTOMATIC HIDE AUTOMATIC STATIC STATIC NAT IN WIN2K NAT GLOBAL PROPERTIES CHAPTER 6 AUTHENTICATING USERS FIREWALL-1 AUTHENTICATION SCHEMES S/KEY SECURID OS PASSWORD VPN-1 & FIREWALL-1 PASSWORD RADIUS AXENT PATHWAYS DEFENDER DEFINING USERS CREATING A WILDCARD USER CREATING AND USING TEMPLATES CREATING GROUPS OF USERS USER AUTHENTICATION CLIENT AUTHENTICATION CLIENT AUTHENTICATION VERSUS USER AUTHENTICATION SESSION AUTHENTICATION SESSION AUTHENTICATION VERSUS CLIENT AND USER AUTHENTICATION LDAP AUTHENTICATION LDAP ADMINISTRATION SCHEMA CONFIGURATION MANAGING LDAP USERS CHAPTER 7 OPEN SECURITY (OPSEC) AND CONTENT FILTERING CONTENT VECTORING PROTOCOL (CVP) DEFINING OBJECTS CREATING A CVP RESOURCE USING THE RESOURCE IN A RULE CVP GROUP URI FILTERING PROTOCOL (UFP) CREATING A URI RESOURCE TO USE UFP UFP GROUP APPLICATION MONITORING (AMON) CLIENT SIDE OPSEC APPLICATIONS EVENT LOGGING API LOG EXPORT API SUSPICIOUS ACTIVITIES MONITORING OBJECT MANAGEMENT INTERFACE CHECK POINT MANAGEMENT INTERFACE USERAUTHORITY API OTHER RESOURCE OPTIONS URI RESOURCES URI FILE URI WILD CARDS SMTP RESOURCES FTP RESOURCES CHAPTER 8 MANAGING POLICIES AND LOGS ADMINISTERING CHECK POINT VPN-1/ FIREWALL-1 NG FOR PERFORMANCE CONFIGURING NG FOR PERFORMANCE ADMINISTERING NG FOR PERFORMANCE MONITORING NG FOR PERFORMANCE PLATFORM SPECIFIC TOOLS PERFORMANCE CONCLUSION ADMINISTERING CHECK POINT VPN-1/ FIREWALL-1 NG FOR EFFECTIVENESS QUALITY CONTROL PATCHES AND UPDATES POLICY ADMINISTRATION MANAGING MULTIPLE POLICIES EDITING FILES MANAGING FIREWALL LOGS LOG ROTATIONS LOG MAINTENANCE ADMINISTERING CHECK POINT VPN-1/ FIREWALL-1 NG FOR RECOVERABILITY MAKING BACKUPS PERFORMING ADVANCED ADMINISTRATION TASKS FIREWALL CONTROLS FWSTOP FWSTART CPSTOP CPSTART CPCONFIG CPSTAT FIREWALL PROCESSES *NIX NOKIA WINDOWS $FWDIR\TMP FWD FWM IN AHTTPD IN ASMTP D IN ATELNETD IN ARLOGIND IN AFTPD IN ACLIENTD IN AHCLIENTD FW KILL CHAPTER 9 TRACKING AND ALERTS ALERTS COMMANDS USING TRACK OPTIONS LOGGING MODIFIERS TIME SETTINGS USER-DEFINED TRACKING ALERTF ADVANCED USER-DEFINED ALERTS SUSPICIOUS ACTIVITIES MONITORING (SAM) CHECK POINT MALICIOUS ACTIVITY DETECTION (CPMAD) CPMAD CONFIGURATION CPMAD_CONFIG CONF CPMAD PROBLEMS CHAPTER 10 CONFIGURING VIRTUAL PRIVATE NETWORKS ENCRYPTION SCHEMES ENCRYPTION ALGORITHMS; SYMMETRIC VS ASYMMETRIC CRYPTOGRAPHY KEY EXCHANGE METHODS: TUNNELING VS IN-PLACE ENCRYPTION HASH FUNCTIONS AND DIGITAL SIGNATURES CERTIFICATES AND CERTIFICATE AUTHORITIES TYPES OF VPNS VPN DOMAINS CONFIGURING AN FWZ VPN LOCAL GATEWAY REMOTE GATEWAY ADDING VPN RULES FWZ LIMITATIONS CONFIGURING AN IKE VPN TESTING THE VPN DEBUGGING VPNS CONSIDERATIONS FOR EXTERNAL NETWORKS CONFIGURING A SECUREMOTE VPN LOCAL GATEWAY OBJECT USER ENCRYPTION PROPERTIES FWZ IKE CLIENT ENCRYPTION RULES INSTALLING SECUREMOTE CLIENT SOFTWARE USING SECUREMOTE CLIENT SOFTWARE SECURE DOMAIN LOGIN (SDL) CHAPTER 11 SECURING REMOTE CLIENTS INSTALLING AND CONFIGURING A POLICY SERVER INSTALL FROM CD CONFIGURING A POLICY SERVER DESKTOP SECURITY OPTIONS DESKTOP SECURITY POLICY DESKTOP SECURITY GLOBAL PROPERTIES DESKTOP CONFIGURATION VERIFICATION EARLY VERSIONS COMPATIBILITY CLIENT ENCRYPT RULES INSTALLING SECURECLIENT SOFTWARE SECURECLIENT PACKAGING TOOL LOGGING INTO THE POLICY SERVER ENABLING HIGH AVAILABILITY FAILING OVER FIREWALL SYNCHRONIZATION SINGLE ENTRY POINT VPN CONFIGURATIONS (SEP) GATEWAY CONFIGURATION POLICY CONFIGURATION MULTIPLE ENTRY POINT VPN CONFIGURATIONS (MEP) OVERLAPPING VPN DOMAINS OTHER HIGH AVAILABILITY METHODS ROUTING FAILOVER HARDWARE OPTIONS