Check Point Next Generation Security Administration

by Syngress

• ISBN13: 9781928994749
• ISBN10: 1928994741
• Format: Paperback
• Copyright: 2002-05-11
• Publisher: Syngress Media Inc

Summary

Check Point NGX R65 is the next major release of Check Point's flagship firewall software product. Check Point's NGX is the underlying security software platform for all of the company's enterprise firewall, VPN, and management solutions. It enables enterprises of all sizes to reduce the cost and complexity of security management and ensure that their security systems can be easily extended to adapt to new and emerging threats. This title is a continuation of Syngress's best-selling references on Check Point's market leading firewall and VPN products. . Understand NGX R65 Operational Changes: SVN Architecture, New VPN-1 Features, Additional Features, VPN-1 Power VSX . Deploy SmartClients and SmartManagement: SmartDashboard, SmartMap, SmartView Tracker, SmartView Monitor, SmartUpdate, SmartLSM, Secure Client Packaging Tool, Management Plug-Ins, Check Point Configuration/cpconfig . Drive the Management Portal: A Tour of the Dashboard, What's New in SmartDashboard NGX, Your First Security Policy, Other Useful Controls on the Dashboard, Managing Connectra and Interspect Gateways, Smart Portal . Master Advanced Authentication: Authentication Overview, Users and Administrators, SmartDirectory, User Authentication, Session Authentication, Client Authentication . Use Advanced VPN Concepts for Tunnel Monitoring: Encryption Overview, VPN Communities, Policy-Based VPN, Route-Based VPN . Configure Advanced VPN Client Installations: SecuRemote, Secure Client, Office Mode, Visitor Mode, Windows L2TP Integration, SSL Network Extender, Backup Gateways, Multiple Entry Point VPNs . Deploy and Configure SmartDefense: Network Security, Application Intelligence, Web Intelligence . Get Inside Secure Platform: Installation, Configuration, Secure Platform Shell, Secure Shell . Learn Advanced Troubleshooting Techniques: NGX Debugging, Packet Analysis, Log Troubleshooting, VPN Analysis, VPN Client Analysis, ClusterXL Troubleshooting

Table of Contents

Foreword	xxv
Introduction to Check Point Next Generation	1	(40)
Introduction	2	(1)
Introducing the Check Point Next Generation Suite of Products	2	(13)
VPN-1/Fire Wall-1	4	(3)
Account Management (LDAP)	7	(1)
SecuRemote/Secure Client	8	(1)
Reporting Module	9	(2)
Check Point High Availability (CPHA)	11	(1)
UserAuthority	12	(1)
FloodGate-1	12	(2)
Meta IP	14	(1)
Understanding VPN-1/Fire Wall-1 SVN Components	15	(12)
VPN-1/Fire Wall-1 Management Module	16	(1)
Central Management ofVPN-1/Fire Wall-1 Modules	16	(4)
SecureUpdate	20	(1)
SecureXL	21	(1)
Graphical User Interface	22	(1)
Security Dashboard	22	(4)
Policy Server	26	(1)
Desktop Security	27	(1)
Looking at Firewall Technology	27	(7)
Proxy Server vs. Packet Filter	28	(1)
Performance and Scalability	29	(1)
FireWall-1's Inspection Engine	30	(2)
Performance and Scalability	32	(2)
Summary	34	(2)
Solutions Fast Track	36	(3)
Frequently Asked Questions	39	(2)
Installing and Configuring VPN-1/FireWall-1 Next Generation	41	(100)
Introduction	42	(1)
Before You Begin	42	(18)
Obtaining Licenses	44	(1)
Securing the Host	45	(1)
Disabling Services	46	(3)
Routing and Network Interfaces	49	(1)
Enabling IP Forwarding	50	(1)
Configuring DNS	51	(1)
Preparing for VPN-1/FireWall-1 NG	52	(5)
Administrators	57	(1)
GUI Clients	58	(1)
Upgrading from a Previous Version	59	(1)
Installing Check Point VPN-1/FireWall-1 NG on Windows	60	(28)
Installing from CD	60	(12)
Configuring Check Point VPN-1/FireWall-1 NG on Windows	72	(1)
Licenses	73	(3)
Administrators	76	(2)
GUI Clients	78	(3)
Certificate Authority Initialization	81	(2)
Installation Complete	83	(2)
Getting Back to Configuration	85	(3)
Uninstalling Check Point VPN-1/FireWall-1 NG on Windows	88	(6)
Unistalling VPN-1 & FireWall-1	88	(3)
Uninstalling SVN Foundation	91	(2)
Uninstalling Management Clients	93	(1)
Installing Check Point VPN-1/FireWall-1 NG on Solaris	94	(32)
Installing from CD	95	(8)
Configuring Check Point VPN-1/FireWall-1 NG on Solaris	103	(1)
Licenses	103	(2)
Administrators	105	(2)
GUI Clients	107	(2)
SNMP Extension	109	(1)
Group Permission	110	(1)
Certificate Authority Initialization	111	(1)
Installation Complete	112	(4)
Getting Back to Configuration	116	(2)
Uninstalling VPN-1 & Fire Wall-1	118	(4)
Uninstalling SVN Foundation	122	(3)
Uninstalling Management Clients	125	(1)
Installing Check Point VPN-1/FireWall-1 NG on Nokia	126	(9)
Installing the VPN-1/FireWall-1 NG Package	127	(1)
Upgrading IPSO Images	128	(1)
Installing VPN-1/FireWall-1 NG	129	(3)
Configuring VPN-1/FireWall-1 NG on Nokia	132	(3)
Summary	135	(1)
Solutions Fast Track	136	(3)
Frequently Asked Questions	139	(2)
Using the Graphical Interface	141	(50)
Introduction	142	(1)
Managing Objects	142	(29)
Network Objects	144	(1)
Workstation	145	(3)
Network	148	(1)
Domain	149	(1)
OSE Device	150	(2)
Embedded Device	152	(1)
Group	153	(1)
Logical Server	154	(2)
Address Range	156	(1)
Gateway Cluster	156	(1)
Dynamic Object	157	(2)
Services	159	(1)
TCP	159	(1)
UDP	160	(1)
RPC	161	(1)
ICMP	161	(2)
Other	163	(1)
Group	164	(1)
DCE-RPC	164	(1)
Resources	165	(1)
URI	165	(1)
URI for QoS	165	(1)
SMTP	165	(1)
FTP	165	(1)
OPSEC Applications	166	(1)
Servers	166	(1)
Radius	166	(1)
Radius Group	167	(1)
TACACS	167	(1)
DEFENDER	167	(1)
LDAP Account Unit	168	(1)
Certificate Authority	168	(1)
SecuRemote DNS	169	(1)
Internal Users	169	(1)
Time	170	(1)
Group	170	(1)
Scheduled Event	171	(1)
Virtual Link	171	(1)
Adding Rules	171	(4)
Rules	172	(1)
Adding Rules	173	(1)
Source	173	(1)
Destination	173	(1)
Service	173	(1)
Action	174	(1)
Track	174	(1)
Install On	175	(1)
Time	175	(1)
Comment	175	(1)
Global Properties	175	(6)
FireWall-1 Implied Rules	175	(2)
Viewing Implied Rules	177	(1)
SYNDefender	177	(1)
Security Server	178	(1)
Authentication	179	(1)
VPN-1	179	(1)
Desktop Security	179	(1)
Visual Policy Editor	179	(1)
Gateway High Availability	179	(1)
Management High Availability	179	(1)
Stateful Inspection	180	(1)
LDAP Account Management	180	(1)
Network Address Translation	180	(1)
ConnectControl	180	(1)
Open Security Extension	180	(1)
Log and Alert	180	(1)
SecureUpdate	181	(2)
Log Viewer	183	(3)
Column Selections	185	(1)
System Status	186	(1)
Summary	187	(1)
Solutions Fast Track	187	(2)
Frequently Asked Questions	189	(2)
Creating a Security Policy	191	(38)
Introduction	192	(1)
Reasons for a Security Policy	192	(1)
How to Write a Security Policy	193	(9)
Security Design	196	(1)
Firewall Architecture	197	(1)
Writing the policy	197	(2)
Introduction	199	(1)
Guidelines	199	(1)
Standards	200	(1)
Procedures	200	(1)
Deployment	201	(1)
Enforcement	201	(1)
Modifications or Exceptions	202	(1)
Implementing a Security Policy	202	(18)
Default and Initial Policies	202	(1)
Translating Your Policy into Rules	203	(2)
Defining A Firewall Object	205	(6)
Define Rule Base	211	(4)
Manipulating Rules	215	(1)
Cut and Paste Rules	215	(1)
Disable Rules	215	(1)
Delete Rules	216	(1)
Hiding Rules	216	(1)
Drag and Drop	217	(1)
Querying the Rule Base	217	(1)
Policy Options	218	(1)
Verify	218	(1)
Install	218	(1)
Uninstall	219	(1)
View	219	(1)
Access Lists	219	(1)
Install Users Database	219	(1)
Management High Availability	220	(1)
Installing a Security Policy	220	(1)
Policy Files	221	(2)
Summary	223	(1)
Solutions Fast Track	223	(3)
Frequently Asked Questions	226	(3)
Applying Network Address Translation	229	(26)
Introduction	230	(1)
Hiding Network Objects	230	(6)
Routing and ARP	234	(2)
Configuring Static Address Translation	236	(6)
Static Source	236	(3)
Static Destination	239	(2)
Routing and ARP	241	(1)
Automatic NAT Rules	242	(5)
Automatic Hide	243	(1)
Automatic Static	244	(1)
Static NAT in Win2k	245	(1)
Routing and ARP	246	(1)
NAT Global Properties	247	(2)
Summary	249	(1)
Solutions Fast Track	249	(2)
Frequently Asked Questions	251	(4)
Authenticating Users	255	(52)
Introduction	256	(1)
FireWall-1 Authentication Schemes	256	(8)
S/Key	257	(1)
SecurID	258	(1)
OS Password	258	(1)
VPN-1 & FireWall-1 Password	259	(1)
RADIUS	260	(1)
AXENT Pathways Defender	261	(2)
TACACS	263	(1)
Defining Users	264	(5)
Creating a Wildcard User	264	(1)
Creating and Using Templates	265	(3)
Creating Groups of Users	268	(1)
User Authentication	269	(6)
Client Authentication	275	(7)
Client Authentication versus User Authentication	282	(1)
Session Authentication	282	(7)
Session Authentication versus Client and User Authentication	288	(1)
LDAP Authentication	289	(12)
LDAP Account Unit	291	(3)
LDAP Administration	294	(1)
Schema Configuration	294	(1)
Managing LDAP Users	295	(6)
Summary	301	(1)
Solutions Fast Track	302	(2)
Frequently Asked Questions	304	(3)
Open Security (OPSEC) and Content Filtering	307	(46)
Introduction	308	(1)
OPSEC Applications	308	(2)
Content Vectoring Protocol (CVP)	310	(8)
Defining Objects	310	(1)
Creating a CVP Resource	311	(3)
Using the Resource in a Rule	314	(2)
CVP Group	316	(2)
URI Filtering Protocol (UFP)	318	(6)
Defining Objects	318	(2)
Creating a URI Resource to Use UFP	320	(3)
Using the Resource in a Rule	323	(1)
UFP Group	324	(1)
Application Monitoring (AMON)	324	(2)
Client Side OPSEC Applications	326	(2)
Event Logging API	326	(1)
Log Export API	326	(1)
Suspicious Activities Monitoring	327	(1)
Object Management Interface	327	(1)
Check Point Management Interface	328	(1)
UserAuthority API	328	(1)
Other Resource Options	328	(16)
URI Resources	329	(1)
URI file	330	(2)
URI Wild Cards	332	(4)
SMTP Resources	336	(4)
FTP Resources	340	(1)
TCP	341	(3)
Summary	344	(1)
Solutions Fast Track	345	(4)
Frequently Asked Questions	349	(4)
Managing Policies and Logs	353	(40)
Introduction	354	(1)
Administering Check Point VPN-1/FireWall-1 NG for Performance	355	(13)
Configuring NG for Performance	355	(3)
Administering NG for Performance	358	(5)
Monitoring NG for Performance	363	(4)
Platform Specific Tools	367	(1)
Performance Conclusion	368	(1)
Administering Check Point VPN-1/FireWall-1 NG for Effectiveness	368	(12)
Quality Control	368	(2)
Patches and Updates	370	(1)
Policy Administration	371	(1)
Managing Multiple Policies	372	(1)
Editing Files	373	(2)
Managing Firewall Logs	375	(1)
Log Rotations	376	(4)
Log Maintenance	380	(1)
Administering Check Point VPN-1/FireWall-1 NG for Recoverability	380	(2)
Making Backups	380	(2)
Performing Advanced Administration Tasks	382	(6)
Firewall controls	382	(1)
fwstop	382	(1)
fwstart	382	(1)
cpstop	383	(1)
cpstart	383	(1)
cpconfig	383	(1)
cpstat	383	(1)
fw	383	(2)
Firewall Processes	385	(1)
*NIX	385	(1)
Nokia	386	(1)
Windows	386	(1)
$FWDIR \tmp	386	(1)
fwd	386	(1)
fwm	387	(1)
in.ahttpd	387	(1)
in.asmtp.d	387	(1)
in.atelnetd	387	(1)
in.arlogind	387	(1)
in.aftpd	387	(1)
in.acliented	387	(1)
in.ahclientd	387	(1)
fw kill	387	(1)
Summary	388	(1)
Solutions Fast Track	388	(2)
Frequently Asked Questions	390	(3)
Tracking and Alerts	393	(22)
Introduction	394	(1)
Alerts Commands	394	(5)
Using Track Options	395	(1)
Logging Modifiers	396	(1)
Time Settings	396	(1)
Alerts Commands	397	(2)
User-Defined Tracking	399	(4)
alertf	400	(1)
Advanced User-Defined Alerts	400	(3)
Suspicious Activities Monitoring (SAM)	403	(3)
Check Point Malicious Activity Detection (CPMAD)	406	(6)
CPMAD Configuration	408	(1)
cpmad_config.conf	408	(2)
CPMAD Problems	410	(2)
Summary	412	(1)
Solutions Fast Track	412	(2)
Frequently Asked Questions	414	(1)
Configuring Virtual Private Networks	415	(36)
Introduction	416	(1)
Encryption Schemes	416	(6)
Encryption Algorithms; Symmetric vs. Asymmetric Cryptography	417	(2)
Key Exchange Methods: Tunneling vs. In-Place Encryption	419	(1)
Hash Functions and Digital Signatures	420	(1)
Certificates and Certificate Authorities	421	(1)
Types of VPNs	421	(1)
VPN domains	422	(1)
Configuring an FWZ VPN	422	(5)
Defining Objects	423	(1)
Local Gateway	423	(1)
Remote Gateway	423	(2)
Adding VPN Rules	425	(2)
FWZ Limitations	427	(1)
Configuring an IKE VPN	427	(8)
Defining Objects	428	(1)
Local Gateway	428	(1)
Remote Gateway	429	(1)
Adding VPN Rules	430	(2)
Testing the VPN	432	(1)
Debugging VPNs	433	(2)
Considerations for External Networks	435	(1)
Configuring a SecuRemote VPN	435	(5)
Local Gateway Object	436	(1)
User Encryption Properties	436	(1)
FWZ	437	(1)
IKE	437	(2)
Client Encryption Rules	439	(1)
Installing SecuRemote Client Software	440	(2)
Using SecuRemote Client Software	442	(5)
Secure Domain Login (SDL)	445	(2)
Summary	447	(1)
Solutions Fast Track	447	(2)
Frequently Asked Questions	449	(2)
Securing Remote Clients	451	(28)
Introduction	452	(1)
Installing and Configuring a Policy Server	452	(3)
Install from CD	453	(1)
Configuring a Policy Server	454	(1)
Desktop Security Options	455	(8)
Desktop Security Policy	455	(3)
Desktop Security Global Properties	458	(1)
Desktop Configuration Verification	459	(1)
Early Versions Compatibility	460	(1)
Client Encrypt Rules	461	(2)
Installing SecureClient Software	463	(10)
SecureClient Packaging Tool	465	(8)
Logging into the Policy Server	473	(2)
Summary	475	(1)
Solutions Fast Track	475	(2)
Frequently Asked Questions	477	(2)
Advanced Configurations	479	(32)
Introduction	480	(1)
Check Point High Availability (CPHA)	480	(8)
Enabling High Availability	481	(3)
Failing Over	484	(2)
Firewall Synchronization	486	(2)
Single Entry Point VPN Configurations (SEP)	488	(7)
Gateway Configuration	489	(6)
Policy Configuration	495	(1)
Multiple Entry Point VPN Configurations (MEP)	495	(9)
Overlapping VPN Domains	496	(3)
Gateway Configuration	499	(2)
Overlapping VPN Domains	501	(3)
Other High Availability Methods	504	(3)
Routing Failover	505	(1)
Hardware Options	505	(2)
Summary	507	(1)
Solutions Fast Track	507	(1)
Frequently Asked Questions	508	(3)
Appendix A Class C Subnet Mask Cheat Sheet	511	(8)
Appendix B Spoofing: Attacks on Trusted Identity	519	(84)
Introduction	520	(1)
What It Means to Spoof	520	(5)
Spoofing Is Identity Forgery	520	(1)
Spoofing Is an Active Attack against Identity Checking Procedures	521	(1)
Spoofing Is Possible at All Layers of Communication	521	(1)
Spoofing Is Always Intentional	522	(1)
Spoofing May Be Blind or Informed, but Usually Involved Only Partial Credentials	523	(1)
Spoofing Is Not the Same Thing as Betrayal	524	(1)
Spoofing Is Not Necessarily Malicious	524	(1)
Spoofing Is Nothing New	525	(1)
Background Theory	525	(2)
The Importance of Identity	526	(1)
The Evolution of Trust	527	(2)
Asymmetric Signatures between Human Beings	527	(2)
Establishing Identity within Computer Networks	529	(4)
Return to Sender	530	(1)
In the Beginning, There Was...a Transmission	531	(2)
Capability Challenges	533	(14)
Ability to Transmit: ``Can It Talk to Me?''	533	(2)
Ability to Respond: ``Can It Respond to Me?''	535	(4)
Ability to Encode: ``Can It Speak My Language?''	539	(2)
Ability to Prove a Shared Secret: ``Does It Share a Secret with Me?''	541	(2)
Ability to Prove a Private Keypair: ``Can I Recognize Your Voice?''	543	(1)
Ability to Prove an Identity Keypair: ``Is Its Identity Independently Represented in My Keypair?''	544	(2)
Configuration Methodologies: Building a Trusted Capability Index	546	(1)
Local Configuratios vs. Central Configurations	546	(1)
Desktop Spoofs	547	(2)
The Plague of Auto-Updating Applications	547	(2)
Impacts of Spoofs	549	(13)
Subtle Spoofs and Economic Sabotage	550	(1)
Flattery Will Get You Nowhere	550	(2)
Subtlety Will Get You Everywhere	552	(1)
Selective Failure for Selecting Recovery	552	(2)
Bait and Switch: Spoofing the Presence of SSL Itself	554	(8)
Down and Dirty: Engineering Spoofing Systems	562	(32)
Spitting into the Wind: Building a Skeleton Router in Userspace	562	(1)
Designing the Nonexistent: The Network Card That Didn't Exist but Responded Anyway	563	(1)
Implementation: DoxRoute, Section by Section	564	(22)
Bring Out the Halon: Spoofing Connectivity Through Asymmetric Firewalls	586	(1)
Symmetric Outgoing TCP: A Highly Experimental Framework for Handshake-Only TCP Connection Brokering	587	(7)
Summary	594	(1)
Solution Fast Track	595	(4)
Frequently Asked Questions	599	(4)
Index	603