Check Point R75 Management Essentials Part 2. Check Point Training Course. Section Heading Index. Module 1 Encryption... 3

Transcription

1 Check Point R75 Management Essentials Part 2 Check Point R75 Management Essentials Part 2 Check Point Training Course Section Heading Index Module 1 - Encryption... 3 Module 2 Site to Site VPNs Module 3 Remote Access VPNs SecureClient Module 4 Clientless VPNs Secure Network Extender Module 5 High Availability Firewall Clusters Module 6 High Availability - SmartCenters Module 1 Encryption Securing Communications Symmetric Encryption Encryption Key & Algorithms Symmetric Key Problems Asymmetric Encryption Asymmetric Keys Asymmetric Key Problems Diffie-Hellman (DH) DH Special Asymmetric Algorithm Integrity and Authenticity Integrity Using Hashing Algorithms MD5/SHA Sending a Message using MD Authenticity Using Digital Signatures RSA Certificate Authorities Central & Distributed Authorities Check Point Internal Certificate Authority ICA Certificate Revocation Lists CRLs IKE and IPSEC ISAKMP/Oakley IKE IKE Phase IKE Phase Encryption & Authentication Algorithms Perfect Forward Secrecy PFS vpn debug & IKEView IPSec Process of Building a VPN Tunnel Encryption Mode -Tunnel or Transport Encryption and Authentication (Packet Integrity) Packet Integrity Problems & NAT _Index_CP_R75_Management_Essentials_Part2 Lezha Publications 2012

2 Module 2 Site to Site VPNs Check Point VPNs Types of VPN Intranet All Gateways Controlled by a Single SmartCenter Partner Different Vendor Devices, Partner Cooperation Gateway Authentication Shared Secret or Certificate Remote Access VPN Components of a VPN Configuration Gateway Endpoints Encryption Domain Networks, Hosts Encryption Parameters Remote/Partner - Check Point Gateway or Interoperable Device VPN Communities Mesh Communities Star Communities Remote Access Community VPN Rules Rules with Accept and VPN set to Any still Encrypt Limiting the Rule by Community Limiting the Rule by Source and Destination Directional VPNs Enabling Directional VPNs Directional Rule Match Conditions Resetting VPN Tunnels vpn tunnelutil Resetting tunnels Tunnel Monitoring Alerts Current Rules Check Network Diagram Firewall Control and Rules Check Create a New Policy Site1_P2_Module Base Rules Creating a Mesh VPN Gateways Under Your Control Setting Up the Local Endpoint Details Define the Local Gateway Encryption Domain Set the Local Gateway Properties Setting Up the Remote Endpoint Details Define the Remote Gateway Encryption Domain Set the Remote Gateway Properties Create the Mesh Community Create the Mesh Community & Add the Gateways Set the Mesh Community Properties Create the Security & NAT rules for the VPN Network Address Translation and VPNs Single Rule Testing the Any Rule Single Rule VPN Community restricted Multiple Rules Network to Network Restricted Multiple Rules Source & Destination Restricted Add the firewall Admin rule Star Community VPN Gateways Under your Control Create the Star Community Testing the Star Community VPN Star Community VPN Partners, IKE Shared Secrets Changing fw.site2.com Independently Managed Remove fw.site2.com from the SmartCenter Objects for Site Install the new SmartCenter for fw-site2 on Server Reset the SIC Communications on fw.site2.com Complete Installation of SmartCenter for Site Possible Connection Errors to New SmartCenter Create the Basic Objects for Site2 in the new SmartCenter Create a Basic Policy and install on fw.site2.com SmartCenter for Site1 - Local Endpoint Setup SmartCenter for Site1 - Remote Endpoint Setup Create an Interoperable Device Object called fw.site2.com Set the Encryption Domain in the Topology Tab SmartCenter for Site1 Create the Star VPN Community Create the Star Community VPN-PartnerSite Set the Encryption Parameters Set the IKE shared Secret SmartCenter for Site1 Create the VPN Rules Add the VPN rules for Site SmartCenter for Site2 - Local Endpoint Setup SmartCenter for Site2 - Remote Endpoint Setup Create an Interoperable Device Object called fw.site1.com _Index_CP_R75_Management_Essentials_Part2 2 Lezha Publications 2012

3 5.7.2 Set the Encryption Domain for the Partner Site SmartCenter for Site2 Create the Star VPN Community Create the Star Community VPN-PartnerSite Set the Encryption Parameters Set the IKE shared Secret SmartCenter for Site2 Create the VPN Rules Add the VPN rules Testing the Partner VPN Using Shared Secret Authentication Test Access using FTP Star Community VPN Partners, Certificates Certificate Relationship ICA and Gateway The ICA Server The Gateway Certificate Certificate Revocation Lists (CRLs) Changing from Shared Secret to Certificate Authentication Export the Site1 CA Certificate Install the Site1 CA Certificate on SmartCenter Site Export the Site2 CA Certificate Install the Site2 CA Certificate on SmartCenter Site Change the Community to use Certificates for Site Change the Community to use Certificates for Site Install the Policy for Site1 and Site Reset all VPN tunnels Test the VPN Community using Certificate Authentication Fetching the Internal CA using port Common Faults and Debugging VPNs Common Faults Common Faults VPN Log Files & IKEView Using IKEView...66 Module 3 RemoteAccess VPNs Rules Check New Policy and Rules Create a new Policy Package Create and Install the Base Rules Remote Access VPNs RemoteAccess Community Virtual Desktop Infrastructure Gateway Encryption Domain User Groups SecuRemote Client or SecureClient SecureClient License, EndPoint Security Blade Desktop Protection Office Mode Why Use Office Mode How Office Mode Works Office Mode IP address, Config file, Network Pool, DHCP Alternative to Office Mode Gateway IP Pools UDP Encapsulation & Visitor Mode VPN1_IPSEC_encapsulation, Port NAT-T, Port Visitor Mode, Port Configuring RemoteAccess VPNs User, Groups and Authentication Create the VPN User Groups User Authentication Create VPN Users Set the Gateway RemoteAccess Encryption Domain Configure the RemoteAccess Community Policy, Global Properties RemoteAccess Check Point Gateway RemoteAccess Properties Configure Office Mode Wireless Hotspot/Hotel Registration Add Remote Access Rules to the Security Policy Installing Endpoint Security VPN Client Endpoint Security Client Installation With or Without Desktop Protection Endpoint Security Secure Access Post Installation Checks Device Driver Check Point SecuRemote _Index_CP_R75_Management_Essentials_Part2 3 Lezha Publications 2012

4 4.2.2 Endpoint Security Show Client EndPoint Security Configuration Files Trac.defaults, Trac.config 5 Using Endpoint Security VPN No Desktop Policy Creating a Site Site IP Address and Name Authentication Method Testing Remote Access Connecting to the Gateway Office Mode IP Address Assigned Testing the Rules Trac.config file unencrypted Basic Problems and Debugging Global Properties Accept Remote Access Control Connections Is the Site Correctly Defined Trac.config Do not Clone Endpoint Security Laptops Multiple VPN Clients and Local Firewall Overlapping Sites Built in Packet Sniffer SecureClient only - srfw monitor Turning on Debugging for Endpoint Security Debugging SecureClient IKE Phase 1 & Using Endpoint Security VPN With a Desktop Policy Enabling the Policy Server Enable Policy Server on the Firewall Module Set the Policy Server User Group Writing Desktop Rules Inbound Rules Outbound Rules Installing Desktop Rules Updating the Remote Access Site Endpoint Security Site Update The Installed Rules Testing the Desktop Rules Different Users, Different Rules Outbound Desktop Rule for Updates Remote Support for VPN Users Enable Back Connections Testing Remote Support Using Visitor Mode Tunnel over HTTPS Check the WebGui is not using port Enable Visitor Mode on the Gateway SecureClient Packaging Tool Building Pre-packaged Configuration for Easy Deployment Overview Creating a Package Profile Module 4 Clientless VPNs SSL Network Extender SNX SSL Network Extender Network Extender License Requirements How SSL Network Extender Works Configuration Requirements Enable Gateway for Clientless VPNS Users & Groups for Authentication SSL Authentication and Encryption Options Remote Access VPN rule Supported Platforms and Web Browsers Configuring Clientless VPNs SSL Network Extender Check the Clientless Global Properties Settings Gateway Properties Check the Security Rules SNX and SecureClient on the same Desktop Check that the vpnd is running on port Testing SSL Network Extender Connecting to the Gateway Authentication Thin client Download and Install Connecting to Internal Networks User Certificate Authentication with SNX _Index_CP_R75_Management_Essentials_Part2 4 Lezha Publications 2012

5 Module 5 Firewall High Availability Firewall High Availability Firewall HA Firewall Licenses ClusterXL Cluster Control Protocol HA and Synchronization HA Interfaces Synchronization Interfaces Synchronization Restrictions HA Design Active/Passive Mode Load Sharing Multicast Mode Load Sharing Unicast Mode CPHA Commands cphaprob cphastart/cphastop Cluster Member States Converting an Existing Gateway to a Cluster Member Cannot add Member to Cluster Configuring HA Active/Passive Clustering Active/Passive Diagram of Cluster Configuration Change IP Address of fw.site1.com Create the Virtual Machines for Firewalls fwa, fwb Install SecurePlatform on Firewalls fwa, fwb Create the Firewall Objects fwa & fwb Create the Cluster object Site1-Cluster Create a Base Cluster Security Policy Check Cluster Status and State Table Synchronization Testing Cluster Failover Configuring HA Load Sharing Clustering Load sharing, Multicast Edit the Cluster Configuration Load Sharing Multicast Check Load Distribution and Test the Cluster Clustering Load sharing, Unicast Edit the Cluster Configuration Load Sharing Unicast Check Load Distribution and Test the Cluster Clusters and VPNs Site to Site VPN Site2 Firewall Control Cluster VPN endpoint IP Address VPN Community Setup Test the VPN Link, Check SAs using vpn tu RemoteAccess VPN Office Mode Networks for each Cluster Member Edit the RemoteAccess Community - Add Site1-Cluster Editing Policy with fw.site.com to Site1-Cluster Testing RemoteAccess VPN with a Cluster Cluster Failover and RemoteAccess Office Mode IP fw tab t om_assigned_ip f Module 6 SmartCenter High Availability Management HA The Management High Availability Solution The Need for Management HA The Secondary SmartCenter What Data is Stored on the Standby SmartCenter Synchronization Methods & Status Configuring Management HA Configuring Management HA Secondary SmartCenter Virtual Machines and Network Diagram Checking Connectivity for all the Servers & Firewalls Installing the Secondary SmartCenter SmartCenter Object Gateway or Host Synchronization of Primary and Secondary Changing the Status of the Primary Testing Policy Changes & Installs by the Standby SmartCenter Site1 Cluster Install Problem from the Secondary FW IP s Recovering the Primary Checking Synchronization Management HA Collision State Resetting SIC from the Standby SmartCenter Cluster Member... 00_Index_CP_R75_Management_Essentials_Part2 5 Lezha Publications 2012