Essential Check Point FireWall-1

Transcription

1 pp.i-xxiv r1pj.ps //1 1: PM Page i Essential Check Point FireWall-1 An Installation, Configuration, and Troubleshooting Guide Dameon D. Welch-Abernathy Boston San Francisco New York Toronto Montreal London Munich Paris Madrid Capetown Sydney Tokyo Singapore Mexico City

2 pp.i-xxiv r1pj.ps //1 1: PM Page ii Check Point Software Technologies Ltd. All rights reserved. Check Point, the Check Point logo, FireWall-1, FireWall-1 SecureServer, FloodGate-1, INSPECT, IQ Engine, Meta IP, MultiGate, Open Security Extension, OPSEC, Provider-1, SVN, User-to-Address Mapping, VPN-1, VPN-1 Accelerator Card, VPN-1 Appliance, VPN-1 Certificate Manager, VPN-1 Gateway, VPN-1 SecuRemote, VPN-1 SecureServer, and ConnectControl are trademarks or registered trademarks of Check Point Software Technologies Ltd. or its affiliates. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and Addison-Wesley was aware of a trademark claim, the designations have been printed in initial capital letters or in all capitals. Although we have made every effort to ensure the correctness and completeness of the material contained in this book, we cannot provide any warranties. The information provided is on an as is basis. The author and the publisher shall have neither liability nor responsibility if a person or an entity suffers a loss or damage from correctly or incorrectly applying the information contained in this book. The publisher offers discounts on this book when ordered in quantity for special sales. For more information, please contact: Pearson Education Corporate Sales Division One Lake Street Upper Saddle River, NJ () -1 corpsales@pearsontechgroup.com Visit AW on the Web: Library of Congress Cataloging-in-Publication Data Welch-Abernathy, Dameon D. Essential Check Point FireWall-1 : an installation, configuration, and troubleshooting guide / Dameon D. Welch-Abernathy. p. cm. Includes bibliographical references and index. ISBN -1-- (alk. paper) 1. Computer networks Security measures Computer programs.. Computer security Computer programs.. Fire Wall-1. I. Title. TK 1..W 1. dc1 11 Copyright by Pearson Education, Inc. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form, or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior consent of the publisher. Printed in the United States of America. Published simultaneously in Canada. ISBN -1-- Text printed on recycled paper 1 1 CRS 1 First printing, October 1

3 pp.i-xxiv r1pj.ps //1 1: PM Page iii Foreword Preface Contents xvii xix Chapter 1 Introduction to Firewalls 1 What Is a Firewall? 1 What a Firewall Cannot Do Overview of Firewall Security Technologies Packet Filters Application Proxies Stateful Inspection Technology Comparison: Passive FTP Technology Comparison: Traceroute What Kind of Firewall Is FireWall-1? Do You Really Need FireWall-1? More Information Chapter Planning Your Firewall Installation 11 Network Topology 11 A Word about Subnetting 1 Developing a Sitewide Security Policy 1 The What, Who, and How 1 Implementing Firewalls without a Written Security Policy 1 An Example of a Security Policy 1 Fun with Check Point Licensing 1 Node-Limited Firewall Licenses 1 Single-Gateway Product 1 Inspection Module 1 FireWall-1 Host 1 Management Console 1 iii

4 pp.i-xxiv r1pj.ps //1 1: PM Page iv iv Motif GUI Licenses 1 Small-Office Products Getting Licenses Summary 1 Chapter Installing FireWall-1 Selecting an Operating System Windows NT/ Sparc Solaris x Solaris AIX and HP/UX Nokia Security Platform (IPSO) Linux Installing the Operating System Preparing for the OS Installation Guidelines for the OS Installation 1 Securing the Operating System Installing FireWall-1 UNIX-Based Systems Windows NT/ 1 Summary Chapter Building Your Rulebase 1 The Management GUIs 1 Configuring a Management User Configuring Which Hosts Can Use Management GUIs Files Modified by the GUIs Security Policy Editor Restrictions GUI Demonstration Mode Rulebase Components Objects Anti-Spoofing Policy Properties Rules Sample Rules Order of Operations Making Your First Rulebase Knowing Your Network

5 pp.i-xxiv r1pj.ps //1 1: PM Page v v Defining Objects Defining the Rules Tweaking the Policy Properties Rules That Should Be in Every Rulebase Installing the Policy Frequently Asked Questions.1: Which Files Make up My Security Policy?.: How Do I Editobjects.C and rulebases.fws Manually?.: Does Any Service Really Mean Any Service? 1.: When Should I Reinstall My Security Policy? 1.: Which Characters or Words Cannot Be Used When Naming Objects? 1.: Are the Rulebase Properties per Firewall or Global?.: How Do I Enable DNS Verification When I Use the Rulebase Property to Allow DNS Queries?.: Why Are Some Services Slow in Connecting? Troubleshooting.: Client Is a Non-VPN, Whereas Management Server Is a VPN Version.1: My Rulebases Have Disappeared!.11: Log Viewer Does Not Show All Fields.1: Using the GUI over Slow Links.1: I Cannot Fetch a Host s Interfaces Summary Chapter Logging and Alerts The System Status Viewer System Status Information from the Command Line 1 The Log Viewer 1 Viewing Logs from the Command Line 1 Active Mode and Blocking Connections 1 Alerts 111 Messages in the Log 11 Rule 11 len xx 11 The Service ident 11

6 pp.i-xxiv r1pj.ps //1 1: PM Page vi vi lvfile_open: failed to open logfile c:\winnt\fw\log\ fw.log log ptrs problem 11 Log Maintenance 11 Automating fw logswitch on UNIX and IPSO 11 Automating fw logswitch on Windows NT 11 Rotate and Download Logs from Firewall to Management Console 11 Summary 11 Chapter Remote Management 11 The Components 11 The Management Console to Firewall Module Connection 11 The control.map File 1 Commands and Authentication Types Supported in control.map 1 The Workings of Different Authentication Schemes 1 The fw putkey Command 1 Establishing an Authenticated Control Connection 1 Special Remote Management Conditions 1 What You Can Do with Remote Management 1 Control Policy on a Firewall Module 1 View State Tables of Firewall Modules 1 Updating Licenses 1 Moving Management Consoles 1 Moving a Firewall Module off the Management Console 1 Moving the Management Console off the Firewall Module 1 Troubleshooting Remote Management Issues 1.1: General Tips 1.: Peer Asked for Deny Authentication or Authentication for Command X Failed 1.: IP Address a.b.c.d Tries to Exchange a Control Security Key, but Has One (or Doesn t Have Any) 1.: WARNING: Using S/Key Authentication Instead of FWA1: No Encryption License 1.: Failed to Install xxxx Control Key: Bad Signature 1.: Operation Would Block 1

7 pp.i-xxiv r1pj.ps //1 1: PM Page vii vii.: If You Have Recently Changed IP Addresses for One of Your Modules 1.: If All Else Fails 1 Large-Scale Management Issues 11 Security Policies 1 Number of Firewalls 1 Having a Large Amount of Logs 1 Summary 1 Sample Configurations 1 Adding a New Firewall Module to Manage 1 Changing the Default Authentication Scheme to SSL 1 Moving the Firewall off the Management Console 1 Moving the Management Console off the Firewall 1 Chapter Authentication 1 Passwords 1 FireWall-1 Password 1 OS Password 1 S/Key 1 SecurID 1 Axent Pathways Defender 1 Remote Access Dial-In User Service (RADIUS) 1 Terminal Access Controller Access Control System (TACACS/TACACS+) 1 Lightweight Directory Access Protocol (LDAP) 1 How Users Authenticate 1 User Authentication 1 Session Authentication 11 Client Authentication 1 Which Authentication Type Should You Use? 1 Setting Up Authentication 1 Creating Users 1 Creating Groups 1 Setting Supported Authentication Schemes 1 User Authentication 1 The Importance of Rule Order in User Authentication 1 Session Authentication 1

8 pp.i-xxiv r1pj.ps //1 1: PM Page viii viii Client Authentication 1 Integrating External Authentication Servers 1 SecurID 1 Axent Pathways Defender 1 RADIUS 1 TACACS/TACACS+ 1 LDAP 1 Frequently Asked Questions 1.1: How Do I Use All the Users in My External Authentication Server without Entering Them into FireWall-1? 1.: How Do I Integrate FireWall-1 into a Windows NT Domain? 1.: How Do I Allow People Access Based on What They Are Logged in As on Their Windows Workstation? 1.: How Do I Import or Export Users from a FireWall-1 User Database? 1.: How Do I Add My Own Custom Message for Authentication? 1.: How Do I Forward Authenticated HTTP Requests to an HTTP Proxy? 1.: Can I Use FireWall-1 As a Reverse HTTP Proxy? 1.: How Do I Remove the Check Point Banner from Authentication? 1.: Can I Use FireWall-1 As a Proxy? 1.1: Can I Use FireWall-1 As an FTP Proxy for My Web Browser? 1.11: How Do I Authenticate HTTP over Different Ports?.1: How Do I Authenticate Outbound HTTPS Traffic?.1: Can I Authenticate Access to Internal HTTPS Servers? 1.1: How Can I Authenticate with HTTP to a Site Requiring Its Own Authentication?.1: How Can Users Change Their Own Passwords?.1: Can a User Reset His Own S/Key Chain?.1: Can I Customize the HTTP Client Authentication Pages?

9 pp.i-xxiv r1pj.ps //1 1: PM Page ix ix Troubleshooting Authentication Problems.1: This Gateway Does Not Suppoort X.1: The Connection Is Closed by a Session Authentication Agent.: Authenticated FTP Connections Stop If a Download Takes Longer Than 1 Minutes.1: Authentication Services Are Unavailable. Connection Refused..: Session Authentication Is Not Secure.: Using Session Authentication with Content Security.: Authenticating on Each URL.: No Client Auth Rules Available.: Policy Install Logs out Client Auth Users.: Partially Automatic Client Authentication Redirects Site to an IP Address.: in a Username or Password with Client Auth via HTTP.: FW-1 Form Has Expired.: Users Are Not Being Prompted for Authentication.1: Request to Proxy Other Than Next Proxy Resource Cannot Telnet to the Firewall.: My User s Group Association Is Being Ignored.: When Accessing Certain Sites, the Connections Are Dropped with the Following in the Logs: Content-Encoding Type Not Allowed Summary 1 Sample Configurations 1 A User Authentication Example 1 A Session Authentication Example 1 A Client Authentication Example 1 Chapter Content Security 1 The Security Servers 1 A Word about Licensing and Third-Party Products 1 CVP and UFP Resources and Wildcards 1

10 pp.i-xxiv r1pj.ps //1 1: PM Page x x HTTP Security Server 1 Filtering HTTP without a UFP or CVP Server UFP with the HTTP Security Server CVP with the HTTP Security Server Frequently Asked Questions about the HTTP Security Server 1 Performance Tuning the HTTP Security Server Troubleshooting Issues with the HTTP Security Server FTP Security Server Frequently Asked Questions about the FTP Security Server SMTP Security Server $FWDIR/conf/smtp.conf SMTP Resources Frequently Asked Questions about the SMTP Security Server 1 Troubleshooting the SMTP Security Server TCP Security Server General Questions about the Security Servers :: Why Do All the Connections I Make through the Security Servers Appear to Originate from the Firewall Instead of the Client?.: Why Is the Security Server Used Even If the Rule Matched Does Not Use a Resource?.: Can I Mix User Authentication and Content Security?.: Can I Mix Session Authentication and Content Security? Debugging the Security Servers Summary Sample Configurations SMTP Content Security FTP Content Security HTTP Content Security Chapter Network Address Translation 1 Introduction 1 RFC-11 and Link Local Addresses How NAT Works in FireWall-1 The Order of Operations

11 pp.i-xxiv r1pj.ps //1 1: PM Page xi xi Implementing NAT: A Step-by-Step Example Determine Which IP Addresses Will Be Used Proxy-ARPs Static Host Routes Network Objects Anti-Spoofing Security Policy Rules Address Translation Rules Install the Security Policy and Test Limitations of NAT Dual NAT (Translating Both Source and Destination) Binding the NAT IP Address to the Loopback Interface Troubleshooting NAT ARPs 1 SYN Packets with No Response SYN Followed by RST Useful tcpdump Flags Useful snoop Flags Summary Sample Configurations A Simple Network with NAT Migrating to a Larger Net with NAT Double-Blind Network Configuration Chapter 1 Site-to-Site VPNs 1 Introduction to a VPN 1 Concepts 1 Encryption 1 Encryption Key 1 Symmetric Encryption 1 Asymmetric Encryption 1 Hash Function 1 Certificate Authority (CA) 1 Diffie-Hellman (DH) Keys 1 Encryption Domain 1 A Word about Licensing 1

12 pp.i-xxiv r1pj.ps //1 1: PM Page xii xii Contents Supported Key-Management and Encryption Schemes 1 FWZ 1 IPSec 1 How to Configure Encryption Planning Your Deployment Using IKE Using Manual IPSec SKIP and FWZ Gateway Clusters for High-Availability VPNs Frequently Asked Questions about VPNs in FireWall-1 1.1: Does FireWall-1 Interoperate with Third-Party VPN Products? 1.: Does the Gateway Clusters Feature Interoperate with Third-Party VPN Products? 1.: Can I Run Microsoft Networking Protocols through a VPN? 1.: Can I Set up a VPN with a Site without Giving It Access to All My Machines? 1.: Can I Set up More Than One VPN with Different Sites Each Using Different Encryption Schemes? 1.: Can I Set up More Than One VPN with Different Sites and Use a Different Source IP Address for Each Site? 1.: Does FireWall-1 Support a Hub and Spoke Model Like Some VPN Hardware Devices Support? 1.: How Does NAT Interact with Encryption? 1.: Can I Require User Authentication in Addition to Encryption? Troubleshooting VPN Problems 1.1: General Troubleshooting Guidelines for VPN Problems 1.11: Crypt Rule X Not Found 1 1.1: Encryption Failed: Gateway Connected to Both Endpoints 1 1.1: Encryption Failure: One of the Keys Is Not Yet A Valid Scheme: SKIP 1.1: Peer Failed to Reply

13 pp.i-xxiv r1pj.ps //1 1: PM Page xiii xiii 1.1: GUI Crashes When Editing Encryption Keys 1.1: ISAKMP AddNegotiation: Try to Handle Too Many Negotiations 1.1: Debugging Interoperability Issues with IKE 1.1: Traceroute Does Not Appear to Work through a VPN 1.1: VPN Fails When Transferring Large Packets Summary Sample Configurations A Three-Site VPN Adding a Business Partner to the VPN Mesh Switching the Spokane Firewall to a Gateway Cluster Configuration Chapter 11 SecuRemote and Secure Client Introduction A Word about Licensing Steps to Configure SecuRemote on FireWall-1 Choosing an Encryption Scheme Configuring Firewall Workstation Object for SecuRemote Creating Users for Use with SecuRemote Client Encryption Rules 1 Desktop Security Installing Secure Client High-Availability and Multiple Entry Point Configurations Hybrid Authentication Mode for IKE Microsoft Networking and Secure Client Frequently Asked Questions 11.1: Can I Use SecuRemote If My Client Is Subject to NAT? 11.: How Do I Initiate an Encrypted Session to a SecuRemote Client? 11.: What If My SecuRemote Client Must Pass through a FireWall-1 Gateway? 11.: How Can I Use SecuRemote When I Am behind a Proxy? 11.: How Do I Disable SecuRemote at Boot? 11.: How Do I Automate SecuRemote Configurations?

14 pp.i-xxiv r1pj.ps //1 1: PM Page xiv xiv 11.: How Can I Configure Secure Client to Access DNS or WINS Servers Inside My Encryption Domain without Manually Configuring the Clients? 11.: Can I Share an Internet Connection and Use SecuRemote? Troubleshooting 11.: SecuRemote Client Needs NAT or a Proxy 11.1: SecuRemote Communication Ports Are Blocked 11.11: ISP Uses a Custom Adapter to Connect 11.1: Problems Adding the New Site 11.1: Encapsulation and Packet Sizes 11.1: Windows NT and File Permissions 11.1: Mixing NICs and Dial-up Adapters Summary Sample Configurations A Simple Client-to-Site VPN Secure Client with Gateway Clusters Multiple Entry Point Secure Client Chapter 1 High Availability 1 State Synchronization s Role in High Availability 1 UDP State Synchronization 1 How Do I Know State Synchronization Is Working? 1 What Are the Limitations of State Synchronization? 1 Implementing High Availability 1 Asymmetric Routing HA Solution Providers 1 Load Balancing Summary Chapter 1 INSPECT 1 What Is INSPECT? 1 Basic INSPECT Syntax Conditions Constants Registers Manipulating Table Entries Creating Your Own Tables

15 pp.i-xxiv r1pj.ps //1 1: PM Page xv xv How Your Rulebase Is Converted to INSPECT Services of Type Other Sample INSPECT Code Allowing Outbound Connections to SecuRemote Clients Point-to-Point Tunneling Protocol (PPTP) Allowing a Connection Based on a Previous Connection HTTP Ping and Traceroute Different Rules for Different Interfaces Changing Your Default Filter fw monitor Summary AppendixA: Securing Your Bastion Host Appendix B: firewall-1.conf File for Use with OpenLDAP v1 Appendix C: firewall1.schema File for Use with OpenLDAP v Appendix D: Complete Program for Stateful Inspection of HTTP Appendix E: Complete Program for Stateful Inspection of Ping and Traceroute Appendix F: INSPECT Script for Different Policies on Different Interfaces Appendix G: Sample defaultfilter.pf File Appendix H: Sample Internet Usage Policy 1 Appendix I: Performance Tuning Appendix J: Other Resources Appendix K: Further Reading Index