CheckPoint Having Acceleration and Clustering Software Blade

The Check Point Acceleration and Clustering Software Blade delivers a set of advanced technologies, SecureXL and ClusterXL, that work together to maximize performance and security in high-performance environments. These work with CoreXL, which is included with the blade containers, to form the foundation of the Open Performance Architecture, which delivers throughput designed for data center applications and the high levels of security needed to protect against today’s application-level threats.

Check Point : SecurePlatform (SPLAT) Backup Options Available.

One aspect of the Check Point SecurePlatform OS that I struggle to get my head around is backups. There are a few different options, and during the course of researching an upgrade I came across the best explanation I’ve seen yet.  I’ve decided to grab a copy of the relevant text and post it in my blog for future reference here.

Oversimplified Executive Summary

• upgrade_export contains just Check Point configuration
• A backup is an upgrade_export plus SPLAT OS configuration
• A snapshot is a backup plus binary files, both Check Point and SPLAT OS
• As a general rule of thumb, if your restoring on the same hardware a snapshot would be the easiest to use since it contains the most info and an upgrade_export would be the worst, since you’d have to manually restore the most stuff.

Checkpoint : Mount USB Memory Stick / Pen Drive to Splat

Ever wanted to use an USB stick on OpenServer using SPLAT or an appliance?

Just connect the device to an USB port of your choice.

1. Load the appropriate kernel module for handling the USB device.

* modprobe usb-storage

2. Check which new device was bound, for example "/dev/sda1".

* fdisk -l

3. Create a mount point.

* mkdir /mnt/usbdisk

4. Mount USB device.

* mount /dev/sdb1 /mnt/usbdisk

5. Use the device to transfer data as you like.   "[DATA Transafer]"

6. Unmount USB device.

* umount /mnt/usbdisk







Top Ten Tips for Managing Your CheckPoint Firewall

This article discusses the Top ten tips that you can implement to best manage and fine tune your firewall. The purpose of this article is to get the best performance out of your firewall and increased security to your network.

1. Use the latest version of the OS software available for your particular firewall. Install the latest patches and if possible/applicable, the latest software version available.

2. Use a stealth Rule at the top of the rule base.

What is a stealth rule? A stealth rule is a rule which disallows any communication to the firewall itself from unauthorized networks/hosts. It is a rule to protect the firewall itself from attacks.

Different Types of Firewalls

Companies such as Cisco and other major vendors have introduced a multitude of firewall products that are capable of monitoring traffic using different techniques. Some of today's firewalls can inspect data packets up to Layer 4 (TCP layer). Others can inspect all layers (including the higher layers) and are referred to as deep packet firewalls. This section defines and explains these firewalls. 

The three types of inspection methodologies are as follows:

• Packet Filtering and Stateless Filtering.
• Stateful Filtering.
• Deep Packet Layer Inspection.

Checkpoint - Log File Corrupted

When log files get corrupted and we get the following error in the SmartView Tracker : "Failed to read record number" …

Note: "To repare the log file we need to know the log file name and then from the CLI on the CLM/CMA or from the Smartcenter "


Then use the following command :

[Expert@mlm]# fw repairlog


******************************************************************************************************

****************************************************************************************************** 

What Is SIC (Secure Internal Communication) in Checkpoint Firewall

SIC - Encryption, Authentication and Secure Channel

The following security measures are taken to ensure the safety of SIC:

• Certificates for authentication.

• Standards-based SSL for the creation of the secure channel.

• 3DES for encryption.


******************************************************************************************************

****************************************************************************************************** 

Checkpoint Firewall Logs from CLI

Syntax

fw log displays the content of log files.

The full syntax of the fw log command is as follows:

fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert_name|all)] [-g] [logfile]

Check Point Authentication Methods

Authentication feature of checkpoint ensures the users trying to access resources in your network are actually authorized to do so.With this feature instead of simply allowing a client access a device, the administrator can request the client to authenticate first before permitting access..................

Checkpoint supports the following three types of authentication methods:
1.Checkpoint User Authentication.
2.Checkpoint Client Authentication.

3.Checkpoint Session Authentication.

1.Checkpoint User Authentication:

In this type of authentication, for every traffic that passes through the firewall, the client user needs to first authenticate.This ensures that only valid authenticated users only are able to access the destination resources. The limitation is user authentication only supports Telnet, HTTP, FTP and RLOGIN attempts.

Checkpoint : Nokia Hardware - Model - Serial Number

Check Nokia Hardware Model Number with Serial Number

FW [Admin]# cat /var/etc/.nvram

---------------------------------------------------------------------

Vendor Nokia
Chassis serialnum: 88064000318
Model IP560

---------------------------------------------------------------------

FW [Admin]#

List Of Checkpoint Ports - Port Used In CheckPoint

TCP Port 256 is used for three important things: Exchange of CA and DH keys in FWZ and SKIP encryption between two FireWall-1 Management Consoles SecuRemote build 4005 and earlier uses this port to fetch the network topology and encryption keys from a FireWall-1 Management Console When instaling a policy, the management console uses this port to push the policy to the remote firewall. TCP Port 257 (FW1_log) is used for logging purposes.

Checkpoint : SPLAT - Disable CD/DVD Rom | Disable CD/DVD Rom From SPLAT (Checkpoint Secure-Platform)

How to disable the "CD/DVD ROM" from "CLI"

FW [Admin]# cd /lib/modules/2.6.18-92cp/kernel/drivers/cdrom

FW [Admin]# mv cdrom.ko cdrom.ko.orig

FW [Admin]# Reboot

or

FW [Admin]# modprobe -r sr_mod

******************************************************************************************************

******************************************************************************************************