Foreword |
|
xxix | |
|
FW-1 NG Operational Changes |
|
|
1 | (22) |
|
|
2 | (1) |
|
Static NAT Changes from 4.x to NG |
|
|
2 | (9) |
|
|
4 | (2) |
|
Version 4.x Destination Static NAT |
|
|
6 | (2) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (3) |
|
|
13 | (1) |
|
|
13 | (1) |
|
|
14 | (4) |
|
|
16 | (1) |
|
|
16 | (2) |
|
|
18 | (1) |
|
|
19 | (1) |
|
Frequently Asked Questions |
|
|
20 | (3) |
|
|
23 | (38) |
|
|
24 | (1) |
|
|
24 | (15) |
|
What's New in NG SmartDashboard? |
|
|
25 | (1) |
|
|
25 | (3) |
|
|
28 | (1) |
|
New Menu Items and Toolbars |
|
|
29 | (2) |
|
|
31 | (3) |
|
The Extended Object Properties Screen |
|
|
34 | (1) |
|
Extended Administrator Access |
|
|
34 | (1) |
|
A GUI Overview of New FP3 Features |
|
|
35 | (1) |
|
The New Policy Installation Interface |
|
|
36 | (2) |
|
Using Sections in the Security Rule Base |
|
|
38 | (1) |
|
Version Control with Database Revision Control |
|
|
38 | (1) |
|
|
39 | (4) |
|
What's New in SmartView Status? |
|
|
39 | (1) |
|
|
39 | (3) |
|
Changes in the Menu and the Toolbar |
|
|
42 | (1) |
|
Highlights of SmartView Status |
|
|
42 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
43 | (5) |
|
What's New in SmartView Tracker? |
|
|
43 | (1) |
|
|
43 | (2) |
|
|
45 | (1) |
|
Highlights From the SmartView Tracker |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
46 | (1) |
|
|
46 | (2) |
|
|
48 | (5) |
|
|
48 | (1) |
|
|
48 | (1) |
|
|
49 | (1) |
|
Monitor Using Check Point System Counters |
|
|
49 | (1) |
|
|
50 | (1) |
|
Monitor Using Network Objects |
|
|
51 | (1) |
|
|
51 | (1) |
|
Monitor Using Top Firewall Rules |
|
|
51 | (1) |
|
Monitor Using Virtual Links |
|
|
52 | (1) |
|
|
53 | (1) |
|
Check Point Systems Counter Reports |
|
|
53 | (1) |
|
|
53 | (1) |
|
|
53 | (3) |
|
|
54 | (1) |
|
|
55 | (1) |
|
|
56 | (1) |
|
|
57 | (1) |
|
Frequently Asked Questions |
|
|
58 | (3) |
|
|
61 | (64) |
|
|
62 | (1) |
|
|
62 | (34) |
|
Setting Up Active Directory for FireWall-1 Authentication |
|
|
63 | (1) |
|
Active Directory Installation and Basic Configuration |
|
|
64 | (5) |
|
|
69 | (3) |
|
|
72 | (1) |
|
Active Directory Schema Management |
|
|
73 | (3) |
|
|
76 | (3) |
|
Enabling SSL Communication Between VPN-1/FireWall-1 and Active Directory |
|
|
79 | (2) |
|
Setting Up the Firewall for AD Authentication |
|
|
81 | (1) |
|
Configuring Global Properties for Active Directory |
|
|
82 | (1) |
|
Defining the Active Directory Account Unit |
|
|
83 | (6) |
|
Configuring LDAP Administrators |
|
|
89 | (1) |
|
User Management on Active Directory |
|
|
90 | (2) |
|
Configuring the Rule Base |
|
|
92 | (2) |
|
|
94 | (1) |
|
Suggested Uses of MS-AD Authentication |
|
|
95 | (1) |
|
|
96 | (9) |
|
Setting Up the LDAP for FireWall-1 Authentication |
|
|
97 | (2) |
|
Setting Up the Firewall for LDAP Authentication |
|
|
99 | (3) |
|
|
102 | (2) |
|
Suggested Uses of LDAP Authentication |
|
|
104 | (1) |
|
|
105 | (5) |
|
Setting Up the Firewall for RADIUS Authentication |
|
|
106 | (2) |
|
Setting Up RADIUS for FireWall-1 Authentication |
|
|
108 | (1) |
|
Suggested Uses of RADIUS Authentication |
|
|
109 | (1) |
|
|
110 | (4) |
|
Setting Up the Firewall for TACACS+ Authentication |
|
|
111 | (1) |
|
Setting Up TACACS+ for FireWall-1 Authentication |
|
|
112 | (2) |
|
Suggested Uses of TACACS+ Authentication |
|
|
114 | (1) |
|
|
114 | (7) |
|
Self-Service User Management with ADSI |
|
|
117 | (4) |
|
|
121 | (1) |
|
|
122 | (1) |
|
Frequently Asked Questions |
|
|
123 | (2) |
|
|
125 | (32) |
|
|
126 | (1) |
|
|
126 | (5) |
|
|
128 | (1) |
|
|
129 | (2) |
|
|
131 | (1) |
|
SEP Configuration Examples |
|
|
131 | (4) |
|
|
131 | (1) |
|
|
132 | (3) |
|
MEP Configuration Examples |
|
|
135 | (11) |
|
|
135 | (5) |
|
Setup of New York Firewall |
|
|
140 | (2) |
|
Setup of San Diego Firewall |
|
|
142 | (4) |
|
Combinations of MEP and SEP |
|
|
146 | (1) |
|
|
146 | (4) |
|
|
147 | (1) |
|
|
147 | (3) |
|
Routing Between VPN Connections |
|
|
150 | (1) |
|
Dynamic IP Address VPN Connections |
|
|
151 | (2) |
|
|
153 | (1) |
|
|
153 | (2) |
|
Frequently Asked Questions |
|
|
155 | (2) |
|
Advanced VPN Client Installations |
|
|
157 | (34) |
|
|
158 | (1) |
|
The Difference Between SecuRemote and SecureClient |
|
|
158 | (1) |
|
|
159 | (1) |
|
Encrypting Internal Traffic |
|
|
160 | (1) |
|
Using SR/SC from Behind a CP-FW-1 System |
|
|
161 | (2) |
|
|
163 | (2) |
|
Creating Rules for Internal Connections to Remote Clients |
|
|
165 | (1) |
|
Examples of Common Deployments |
|
|
166 | (8) |
|
L2TP Tunnels Terminating on a Check Point FP3 Box |
|
|
174 | (7) |
|
|
181 | (1) |
|
|
182 | (3) |
|
|
185 | (1) |
|
|
185 | (3) |
|
Frequently Asked Questions |
|
|
188 | (3) |
|
High Availability and Clustering |
|
|
191 | (114) |
|
|
192 | (1) |
|
|
192 | (9) |
|
Why Do You Need a Cluster? |
|
|
192 | (1) |
|
|
192 | (1) |
|
|
193 | (1) |
|
High Availability or Load Sharing? |
|
|
193 | (1) |
|
|
193 | (1) |
|
|
193 | (1) |
|
Clustering and Check Point |
|
|
193 | (1) |
|
Operating System Platform |
|
|
193 | (1) |
|
Clustering and Stateful Inspection |
|
|
194 | (1) |
|
|
194 | (1) |
|
Location of Management Station |
|
|
194 | (1) |
|
A Management Station on a Cluster-Secured Network |
|
|
195 | (1) |
|
Management Station on Internal Network |
|
|
196 | (2) |
|
Connecting the Cluster to Your Network: Hubs or Switches? |
|
|
198 | (1) |
|
FireWall-1 Features, Single Gateways vs. Clusters: The Same, But Different |
|
|
198 | (1) |
|
Network Address Translation |
|
|
199 | (1) |
|
|
199 | (1) |
|
Remote Authentication Servers |
|
|
200 | (1) |
|
External VPN Partner Configuration |
|
|
200 | (1) |
|
Installing FireWall-1 NG FP3 |
|
|
201 | (6) |
|
Checking the Installation Prerequisites |
|
|
201 | (1) |
|
|
202 | (1) |
|
|
202 | (5) |
|
|
207 | (44) |
|
Configuring ClusterXL in HA New Mode |
|
|
208 | (1) |
|
Prerequisites for Installing ClusterXL in HA New Mode |
|
|
208 | (1) |
|
Configuration of ClusterXL HA New Mode |
|
|
209 | (15) |
|
Testing ClusterXL in HA New Mode |
|
|
224 | (1) |
|
Test 1: Pinging the Virtual IP Address of Each Interface |
|
|
224 | (1) |
|
Test 2: Using SmartView Status to Examine the Status of the Cluster Members |
|
|
224 | (1) |
|
Test 3: FTP Session Through the Cluster When an Interface Fails |
|
|
225 | (1) |
|
Command-Line Diagnostics on ClusterXL |
|
|
226 | (3) |
|
How Does ClusterXL HA New Mode Work? |
|
|
229 | (2) |
|
ClusterXL HA New Mode Failover |
|
|
231 | (3) |
|
ClusterXL Failover Conditions |
|
|
234 | (3) |
|
Special Considerations for ClusterXL in HA New Mode |
|
|
237 | (1) |
|
Network Address Translation |
|
|
237 | (2) |
|
Configuring ClusterXL in HA Legacy Mode |
|
|
239 | (2) |
|
Configuring ClusterXL in Load-Sharing Mode |
|
|
241 | (1) |
|
Prerequisites for Configuring ClusterXL in Load-Sharing Mode |
|
|
241 | (1) |
|
Configuration of ClusterXL in Load-Sharing Mode |
|
|
242 | (1) |
|
Testing ClusterXL in Load-Sharing Mode |
|
|
242 | (1) |
|
Test 1: Pinging the Virtual IP Address for Each Interface |
|
|
242 | (1) |
|
Test 2: Using SmartView Status to Examine the Status of the Cluster Members |
|
|
242 | (1) |
|
Test 3: FTPing Through ClusterXL Load Sharing During Failover |
|
|
243 | (1) |
|
Command-Line Diagnostics for ClusterXL |
|
|
244 | (3) |
|
How ClusterXL Works in Load-Sharing Mode |
|
|
247 | (2) |
|
ClusterXL Load-Sharing Mode Failover |
|
|
249 | (2) |
|
Special Considerations for ClusterXL in Load-Sharing Mode |
|
|
251 | (1) |
|
Network Address Translation |
|
|
251 | (1) |
|
User Authentication and One-Time Passcodes |
|
|
251 | (1) |
|
|
251 | (24) |
|
|
251 | (2) |
|
A Few Points About Installing an Initial Configuration of NG FP3 on Nokia IPSO |
|
|
253 | (1) |
|
Check Point FireWall-1 Configuration for a Nokia Cluster |
|
|
254 | (1) |
|
Configuring the Gateway Cluster Object |
|
|
254 | (4) |
|
Nokia Cluster Configuration on Voyager |
|
|
258 | (1) |
|
|
258 | (5) |
|
Testing the Nokia Cluster |
|
|
263 | (1) |
|
Test 1: Pinging the Virtual IP Address of Each Interface |
|
|
263 | (1) |
|
Test 2: Determining the Status of Each Member in the Cluster |
|
|
264 | (1) |
|
Test 3: FTPing Through a Load-Sharing Nokia Cluster During Interface Failure |
|
|
265 | (2) |
|
|
267 | (2) |
|
How Nokia Clustering Works |
|
|
269 | (3) |
|
|
272 | (1) |
|
Nokia Failover Conditions |
|
|
273 | (1) |
|
Special Considerations for Nokia Clusters |
|
|
273 | (1) |
|
Network Address Translation |
|
|
274 | (1) |
|
Defining the Cluster Object Topology |
|
|
274 | (1) |
|
|
275 | (12) |
|
|
275 | (2) |
|
Nokia VRRP Configuration on Voyager |
|
|
277 | (1) |
|
|
277 | (4) |
|
Testing the Nokia VRRP Cluster |
|
|
281 | (1) |
|
Test 1: Pinging the Virtual IP Address for Interface |
|
|
281 | (1) |
|
Test 2: Finding Which Member Responds to Administrative Connections to the VIPs |
|
|
282 | (1) |
|
Test 3: Determining the Status of Each Member in the Cluster |
|
|
282 | (1) |
|
Test 4: FTPing Through a VRRP Cluster During Interface Failure |
|
|
282 | (1) |
|
|
283 | (1) |
|
|
284 | (2) |
|
Special Considerations for Nokia VRRP Clusters |
|
|
286 | (1) |
|
Network Address Translation |
|
|
286 | (1) |
|
Connections Originating from a Single Member in the Cluster |
|
|
287 | (1) |
|
Third-Party Clustering Solutions |
|
|
287 | (1) |
|
Clustering and HA Performance Tuning |
|
|
287 | (10) |
|
Data Throughput or Large Number of Connections |
|
|
288 | (1) |
|
Improving Data Throughput |
|
|
288 | (2) |
|
Improving for Large Number of Connections |
|
|
290 | (6) |
|
Final Tweaks to Get the Last Drop of Performance |
|
|
296 | (1) |
|
|
297 | (1) |
|
|
298 | (3) |
|
Frequently Asked Questions |
|
|
301 | (4) |
|
|
305 | (44) |
|
|
306 | (1) |
|
|
306 | (20) |
|
|
306 | (1) |
|
|
307 | (1) |
|
Web User Interface Configuration |
|
|
308 | (6) |
|
Command-Line Configuration |
|
|
314 | (7) |
|
|
321 | (2) |
|
|
323 | (1) |
|
Applying OS and Application Updates |
|
|
324 | (2) |
|
Adding Hardware to SecurePlatform |
|
|
326 | (12) |
|
|
326 | (1) |
|
|
327 | (1) |
|
Adding a Second Processor |
|
|
328 | (1) |
|
Configuring SecurePlatform for a Second Processor |
|
|
329 | (3) |
|
|
332 | (6) |
|
FireWall-1 Performance Counters |
|
|
338 | (6) |
|
|
338 | (1) |
|
|
338 | (2) |
|
|
340 | (2) |
|
|
342 | (1) |
|
|
342 | (2) |
|
|
344 | (1) |
|
|
344 | (1) |
|
Frequently Asked Questions |
|
|
345 | (4) |
|
SmartCenter Management Server, High Availability and Failover, and SMART Clients |
|
|
349 | (30) |
|
|
350 | (1) |
|
SmartCenter Server: The Roles of a Management Server |
|
|
350 | (2) |
|
Internal Certificate Authority |
|
|
352 | (1) |
|
|
352 | (1) |
|
Management Server Backup Options |
|
|
352 | (2) |
|
Protecting the Configuration |
|
|
353 | (1) |
|
Enforcement Point Functions |
|
|
353 | (1) |
|
|
354 | (1) |
|
Installing a Secondary Management Server |
|
|
354 | (4) |
|
|
358 | (16) |
|
|
359 | (1) |
|
|
359 | (3) |
|
|
362 | (1) |
|
|
363 | (2) |
|
|
365 | (1) |
|
|
366 | (1) |
|
|
366 | (1) |
|
|
367 | (1) |
|
|
367 | (7) |
|
|
374 | (1) |
|
|
374 | (2) |
|
Frequently Asked Questions |
|
|
376 | (3) |
|
Integration and Configuration of CVP / UFP |
|
|
379 | (22) |
|
|
380 | (1) |
|
Using CVP for Virus Scanning E-Mail |
|
|
380 | (8) |
|
|
380 | (1) |
|
|
381 | (6) |
|
|
387 | (1) |
|
URL Filtering for HTTP Content Screening |
|
|
388 | (7) |
|
Setting Up URL Filtering with UFP |
|
|
389 | (6) |
|
Using Screening without CVP |
|
|
395 | (2) |
|
|
397 | (1) |
|
|
397 | (1) |
|
Frequently Asked Questions |
|
|
398 | (3) |
|
SecureClient Packaging Tool |
|
|
401 | (24) |
|
|
402 | (2) |
|
Installing the SecureClient Packaging Tool |
|
|
403 | (1) |
|
|
403 | (1) |
|
|
403 | (1) |
|
Starting the SecureClient Packaging Tool |
|
|
403 | (1) |
|
|
404 | (12) |
|
|
404 | (1) |
|
|
405 | (1) |
|
|
406 | (1) |
|
|
407 | (1) |
|
|
407 | (1) |
|
|
408 | (1) |
|
|
408 | (1) |
|
The Additional Options Window |
|
|
409 | (1) |
|
|
410 | (2) |
|
|
412 | (1) |
|
The Silent Installation Window |
|
|
413 | (1) |
|
The Installation Options Window |
|
|
414 | (1) |
|
The Operating System Logon Window |
|
|
414 | (2) |
|
|
416 | (1) |
|
Managing SecureClient Profiles |
|
|
416 | (2) |
|
Creating a New Profile From an Existing Profile |
|
|
416 | (1) |
|
|
417 | (1) |
|
|
418 | (1) |
|
Creating SecureClient Installation Packages |
|
|
418 | (2) |
|
|
418 | (1) |
|
The Package Generation Window |
|
|
419 | (1) |
|
Deploying SecuRemote Packages |
|
|
420 | (1) |
|
|
421 | (1) |
|
|
421 | (2) |
|
Frequently Asked Questions |
|
|
423 | (2) |
|
|
425 | (42) |
|
|
426 | (1) |
|
Understanding and Configuring SmartDefense |
|
|
427 | (36) |
|
|
427 | (2) |
|
Anti-Spoofing Configuration Status |
|
|
429 | (2) |
|
|
431 | (2) |
|
|
433 | (1) |
|
|
434 | (1) |
|
|
434 | (1) |
|
|
434 | (1) |
|
|
435 | (1) |
|
|
435 | (1) |
|
|
436 | (1) |
|
|
437 | (1) |
|
|
437 | (8) |
|
|
445 | (1) |
|
|
445 | (1) |
|
|
446 | (1) |
|
|
447 | (1) |
|
|
448 | (1) |
|
|
448 | (3) |
|
|
451 | (1) |
|
|
451 | (3) |
|
|
454 | (1) |
|
|
455 | (1) |
|
|
456 | (1) |
|
Mail and Recipient Content |
|
|
456 | (3) |
|
|
459 | (1) |
|
|
460 | (1) |
|
|
461 | (1) |
|
|
461 | (1) |
|
|
462 | (1) |
|
Successive Multiple Connections |
|
|
462 | (1) |
|
|
463 | (1) |
|
|
463 | (1) |
|
Frequently Asked Questions |
|
|
464 | (3) |
|
|
467 | (10) |
|
|
468 | (1) |
|
|
468 | (5) |
|
|
469 | (1) |
|
Installing Licenses via the Management Server |
|
|
470 | (1) |
|
Removing Licenses via the Management Server |
|
|
470 | (1) |
|
|
471 | (1) |
|
|
471 | (1) |
|
Installing Licenses via SmartUpdate |
|
|
471 | (1) |
|
Removing Licenses via SmartUpdate |
|
|
472 | (1) |
|
|
472 | (1) |
|
|
472 | (1) |
|
|
473 | (1) |
|
|
473 | (1) |
|
|
473 | (1) |
|
|
473 | (2) |
|
|
474 | (1) |
|
|
474 | (1) |
|
|
475 | (1) |
|
|
475 | (1) |
|
Frequently Asked Questions |
|
|
476 | (1) |
|
|
477 | (16) |
|
|
478 | (1) |
|
How Performance Pack works |
|
|
478 | (2) |
|
Working on Interfaces While Using Performance Pack |
|
|
479 | (1) |
|
Installing Performance Pack |
|
|
480 | (6) |
|
|
480 | (1) |
|
Performance Considerations |
|
|
481 | (1) |
|
Installing Performance Pack on Solaris 8 |
|
|
482 | (1) |
|
|
482 | (1) |
|
Installation Using the Solaris Comprehensive Install Package |
|
|
482 | (2) |
|
Installation as a Separate Package |
|
|
484 | (1) |
|
Uninstalling Performance Pack |
|
|
485 | (1) |
|
Installing Performance Pack on SecurePlatform |
|
|
485 | (1) |
|
|
486 | (1) |
|
Installing the rpm Package |
|
|
486 | (1) |
|
Command-Line Options for Performance Pack |
|
|
486 | (2) |
|
Stopping and Starting SecureXL |
|
|
486 | (1) |
|
Checking the Status of SecureXL |
|
|
486 | (1) |
|
|
487 | (1) |
|
Troubleshooting Performance Pack |
|
|
488 | (1) |
|
|
489 | (1) |
|
|
489 | (2) |
|
Frequently Asked Questions |
|
|
491 | (2) |
|
|
493 | (54) |
|
|
494 | (1) |
|
|
494 | (4) |
|
|
496 | (1) |
|
|
497 | (1) |
|
|
498 | (13) |
|
Installing the UserAuthority Server |
|
|
498 | (1) |
|
UserAuthority Server on a FireWall-1 Enforcement Module |
|
|
498 | (1) |
|
UserAuthority Server on a Windows Domain Controller |
|
|
499 | (3) |
|
Installing UserAuthority SecureAgent |
|
|
502 | (1) |
|
Manual Installation on Desktop |
|
|
502 | (1) |
|
Automatic Installation on Login to the Domain |
|
|
503 | (1) |
|
Installing the UserAuthority WebAccess Plug-In |
|
|
504 | (1) |
|
Prerequisites for the WebAccess Plug-In |
|
|
504 | (1) |
|
Installing the WebAccess Plug-In |
|
|
505 | (6) |
|
Implementing UserAuthority Chaining |
|
|
511 | (2) |
|
Utilizing UserAuthority Logging |
|
|
513 | (2) |
|
FireWall-1 SSO Policy Rules |
|
|
514 | (1) |
|
|
514 | (1) |
|
|
515 | (1) |
|
Understanding Credentials Management and Domain Equality |
|
|
515 | (2) |
|
|
516 | (1) |
|
Configuring Domain Equality |
|
|
517 | (1) |
|
|
517 | (25) |
|
Authenticated Internet Access |
|
|
518 | (1) |
|
Configuring Objects in the SmartDashboard GUI |
|
|
519 | (1) |
|
Configuring Domain Equivalence Between the Firewall UAS and the Domain Controller UAS |
|
|
519 | (1) |
|
Creating Users on the Firewall |
|
|
520 | (2) |
|
|
522 | (1) |
|
Testing the Configuration |
|
|
522 | (1) |
|
|
523 | (1) |
|
Creating a Simple WebAccess Policy |
|
|
523 | (10) |
|
SSO Internet Access and Web Server |
|
|
533 | (1) |
|
|
533 | (5) |
|
Testing the Configuration |
|
|
538 | (4) |
|
|
542 | (1) |
|
|
543 | (2) |
|
Frequently Asked Questions |
|
|
545 | (2) |
|
|
547 | (30) |
|
|
548 | (1) |
|
|
548 | (3) |
|
|
548 | (2) |
|
|
550 | (1) |
|
|
551 | (5) |
|
Monitoring Check Point System Counters |
|
|
552 | (1) |
|
|
553 | (1) |
|
Monitoring a Virtual Link |
|
|
554 | (1) |
|
|
555 | (1) |
|
|
556 | (6) |
|
|
557 | (1) |
|
Writing INSPECT Filters for fw monitor |
|
|
558 | (2) |
|
|
560 | (2) |
|
|
562 | (9) |
|
|
562 | (1) |
|
|
563 | (1) |
|
|
564 | (1) |
|
|
564 | (2) |
|
|
566 | (1) |
|
|
567 | (1) |
|
|
568 | (1) |
|
Operating System and Third-Party Tools |
|
|
568 | (1) |
|
Platform-Friendly Commands |
|
|
568 | (1) |
|
|
569 | (1) |
|
|
570 | (1) |
|
|
571 | (1) |
|
|
572 | (1) |
|
Frequently Asked Questions |
|
|
573 | (4) |
Index |
|
577 | |