Check Point Next Generation Security Administration

by Syngress

ISBN13: 9781928994749

ISBN10: 1928994741

Format: Paperback

Pub. Date: 2002-05-11

Publisher(s): Syngress Media Inc

Other versions by this Author

Free Shipping On All Orders!*

Free economy shipping applies to all orders shipped to residential addresses. Orders shipped to campus receive free standard shipping. Free shipping offers do not apply to Marketplace items.
Complimentary 7-Day eTextbook Access - Read more

When you rent or buy this book, you will receive complimentary 7-day online access to the eTextbook version from your PC, Mac, tablet, or smartphone. Feature not included on Marketplace Items.
eCampus.com Device Compatibility Matrix

Click the device icon to install or view instructions

Apple iOS | iPad, iPhone, iPod

Android Devices | Android Tables & Phones OS 2.2 or higher | *Kindle Fire

Windows 10 / 8 / 7 / Vista / XP

Mac OS X | **iMac / Macbook

Enjoy offline reading with these devices

iPad, iPhone, iPod

Android 2.2 +

Kindle Fire

Windows
10 / 8 / 7 / Vista / XP

Mac

List Price: ~~$62.95~~

Buy New

Usually Ships in 8 - 10 Business Days.

$62.89

Add to Cart

Rent Book

Select for Price

Add to Cart

There was a problem. Please try again later.

Rent Digital

Online:1825 Days access
Downloadable:Lifetime Access

$71.94

*To support the delivery of the digital material to you, a digital delivery fee of $3.99 will be charged on each digital item.

$71.94*

Add to Cart

Used Book

We're Sorry
Sold Out

Buy from our Marketplace starting at $24.64

Summary

Check Point NGX R65 is the next major release of Check Point's flagship firewall software product. Check Point's NGX is the underlying security software platform for all of the company's enterprise firewall, VPN, and management solutions. It enables enterprises of all sizes to reduce the cost and complexity of security management and ensure that their security systems can be easily extended to adapt to new and emerging threats. This title is a continuation of Syngress's best-selling references on Check Point's market leading firewall and VPN products. . Understand NGX R65 Operational Changes: SVN Architecture, New VPN-1 Features, Additional Features, VPN-1 Power VSX . Deploy SmartClients and SmartManagement: SmartDashboard, SmartMap, SmartView Tracker, SmartView Monitor, SmartUpdate, SmartLSM, Secure Client Packaging Tool, Management Plug-Ins, Check Point Configuration/cpconfig . Drive the Management Portal: A Tour of the Dashboard, What's New in SmartDashboard NGX, Your First Security Policy, Other Useful Controls on the Dashboard, Managing Connectra and Interspect Gateways, Smart Portal . Master Advanced Authentication: Authentication Overview, Users and Administrators, SmartDirectory, User Authentication, Session Authentication, Client Authentication . Use Advanced VPN Concepts for Tunnel Monitoring: Encryption Overview, VPN Communities, Policy-Based VPN, Route-Based VPN . Configure Advanced VPN Client Installations: SecuRemote, Secure Client, Office Mode, Visitor Mode, Windows L2TP Integration, SSL Network Extender, Backup Gateways, Multiple Entry Point VPNs . Deploy and Configure SmartDefense: Network Security, Application Intelligence, Web Intelligence . Get Inside Secure Platform: Installation, Configuration, Secure Platform Shell, Secure Shell . Learn Advanced Troubleshooting Techniques: NGX Debugging, Packet Analysis, Log Troubleshooting, VPN Analysis, VPN Client Analysis, ClusterXL Troubleshooting

Foreword

xxv

Introduction to Check Point Next Generation

(40)

Introduction

(1)

Introducing the Check Point Next Generation Suite of Products

(13)

VPN-1/Fire Wall-1

(3)

Account Management (LDAP)

(1)

SecuRemote/Secure Client

(1)

Reporting Module

(2)

Check Point High Availability (CPHA)

(1)

UserAuthority

(1)

FloodGate-1

(2)

Meta IP

(1)

Understanding VPN-1/Fire Wall-1 SVN Components

(12)

VPN-1/Fire Wall-1 Management Module

(1)

Central Management ofVPN-1/Fire Wall-1 Modules

(4)

SecureUpdate

(1)

SecureXL

(1)

Graphical User Interface

(1)

Security Dashboard

(4)

Policy Server

(1)

Desktop Security

(1)

Looking at Firewall Technology

(7)

Proxy Server vs. Packet Filter

(1)

Performance and Scalability

(1)

FireWall-1's Inspection Engine

(2)

Performance and Scalability

(2)

Summary

(2)

Solutions Fast Track

(3)

Frequently Asked Questions

(2)

Installing and Configuring VPN-1/FireWall-1 Next Generation

(100)

Introduction

(1)

Before You Begin

(18)

Obtaining Licenses

(1)

Securing the Host

(1)

Disabling Services

(3)

Routing and Network Interfaces

(1)

Enabling IP Forwarding

(1)

Configuring DNS

(1)

Preparing for VPN-1/FireWall-1 NG

(5)

Administrators

(1)

GUI Clients

(1)

Upgrading from a Previous Version

(1)

Installing Check Point VPN-1/FireWall-1 NG on Windows

(28)

Installing from CD

(12)

Configuring Check Point VPN-1/FireWall-1 NG on Windows

(1)

Licenses

(3)

Administrators

(2)

GUI Clients

(3)

Certificate Authority Initialization

(2)

Installation Complete

(2)

Getting Back to Configuration

(3)

Uninstalling Check Point VPN-1/FireWall-1 NG on Windows

(6)

Unistalling VPN-1 & FireWall-1

(3)

Uninstalling SVN Foundation

(2)

Uninstalling Management Clients

(1)

Installing Check Point VPN-1/FireWall-1 NG on Solaris

(32)

Installing from CD

(8)

Configuring Check Point VPN-1/FireWall-1 NG on Solaris

103

(1)

Licenses

103

(2)

Administrators

105

(2)

GUI Clients

107

(2)

SNMP Extension

109

(1)

Group Permission

110

(1)

Certificate Authority Initialization

111

(1)

Installation Complete

112

(4)

Getting Back to Configuration

116

(2)

Uninstalling VPN-1 & Fire Wall-1

118

(4)

Uninstalling SVN Foundation

122

(3)

Uninstalling Management Clients

125

(1)

Installing Check Point VPN-1/FireWall-1 NG on Nokia

126

(9)

Installing the VPN-1/FireWall-1 NG Package

127

(1)

Upgrading IPSO Images

128

(1)

Installing VPN-1/FireWall-1 NG

129

(3)

Configuring VPN-1/FireWall-1 NG on Nokia

132

(3)

Summary

135

(1)

Solutions Fast Track

136

(3)

Frequently Asked Questions

139

(2)

Using the Graphical Interface

141

(50)

Introduction

142

(1)

Managing Objects

142

(29)

Network Objects

144

(1)

Workstation

145

(3)

Network

148

(1)

Domain

149

(1)

OSE Device

150

(2)

Embedded Device

152

(1)

Group

153

(1)

Logical Server

154

(2)

Address Range

156

(1)

Gateway Cluster

156

(1)

Dynamic Object

157

(2)

Services

159

(1)

TCP

159

(1)

UDP

160

(1)

RPC

161

(1)

ICMP

161

(2)

Other

163

(1)

Group

164

(1)

DCE-RPC

164

(1)

Resources

165

(1)

URI

165

(1)

URI for QoS

165

(1)

SMTP

165

(1)

FTP

165

(1)

OPSEC Applications

166

(1)

Servers

166

(1)

Radius

166

(1)

Radius Group

167

(1)

TACACS

167

(1)

DEFENDER

167

(1)

LDAP Account Unit

168

(1)

Certificate Authority

168

(1)

SecuRemote DNS

169

(1)

Internal Users

169

(1)

Time

170

(1)

Group

170

(1)

Scheduled Event

171

(1)

Virtual Link

171

(1)

Adding Rules

171

(4)

Rules

172

(1)

Adding Rules

173

(1)

Source

173

(1)

Destination

173

(1)

Service

173

(1)

Action

174

(1)

Track

174

(1)

Install On

175

(1)

Time

175

(1)

Comment

175

(1)

Global Properties

175

(6)

FireWall-1 Implied Rules

175

(2)

Viewing Implied Rules

177

(1)

SYNDefender

177

(1)

Security Server

178

(1)

Authentication

179

(1)

VPN-1

179

(1)

Desktop Security

179

(1)

Visual Policy Editor

179

(1)

Gateway High Availability

179

(1)

Management High Availability

179

(1)

Stateful Inspection

180

(1)

LDAP Account Management

180

(1)

Network Address Translation

180

(1)

ConnectControl

180

(1)

Open Security Extension

180

(1)

Log and Alert

180

(1)

SecureUpdate

181

(2)

Log Viewer

183

(3)

Column Selections

185

(1)

System Status

186

(1)

Summary

187

(1)

Solutions Fast Track

187

(2)

Frequently Asked Questions

189

(2)

Creating a Security Policy

191

(38)

Introduction

192

(1)

Reasons for a Security Policy

192

(1)

How to Write a Security Policy

193

(9)

Security Design

196

(1)

Firewall Architecture

197

(1)

Writing the policy

197

(2)

Introduction

199

(1)

Guidelines

199

(1)

Standards

200

(1)

Procedures

200

(1)

Deployment

201

(1)

Enforcement

201

(1)

Modifications or Exceptions

202

(1)

Implementing a Security Policy

202

(18)

Default and Initial Policies

202

(1)

Translating Your Policy into Rules

203

(2)

Defining A Firewall Object

205

(6)

Define Rule Base

211

(4)

Manipulating Rules

215

(1)

Cut and Paste Rules

215

(1)

Disable Rules

215

(1)

Delete Rules

216

(1)

Hiding Rules

216

(1)

Drag and Drop

217

(1)

Querying the Rule Base

217

(1)

Policy Options

218

(1)

Verify

218

(1)

Install

218

(1)

Uninstall

219

(1)

View

219

(1)

Access Lists

219

(1)

Install Users Database

219

(1)

Management High Availability

220

(1)

Installing a Security Policy

220

(1)

Policy Files

221

(2)

Summary

223

(1)

Solutions Fast Track

223

(3)

Frequently Asked Questions

226

(3)

Applying Network Address Translation

229

(26)

Introduction

230

(1)

Hiding Network Objects

230

(6)

Routing and ARP

234

(2)

Configuring Static Address Translation

236

(6)

Static Source

236

(3)

Static Destination

239

(2)

Routing and ARP

241

(1)

Automatic NAT Rules

242

(5)

Automatic Hide

243

(1)

Automatic Static

244

(1)

Static NAT in Win2k

245

(1)

Routing and ARP

246

(1)

NAT Global Properties

247

(2)

Summary

249

(1)

Solutions Fast Track

249

(2)

Frequently Asked Questions

251

(4)

Authenticating Users

255

(52)

Introduction

256

(1)

FireWall-1 Authentication Schemes

256

(8)

S/Key

257

(1)

SecurID

258

(1)

OS Password

258

(1)

VPN-1 & FireWall-1 Password

259

(1)

RADIUS

260

(1)

AXENT Pathways Defender

261

(2)

TACACS

263

(1)

Defining Users

264

(5)

Creating a Wildcard User

264

(1)

Creating and Using Templates

265

(3)

Creating Groups of Users

268

(1)

User Authentication

269

(6)

Client Authentication

275

(7)

Client Authentication versus User Authentication

282

(1)

Session Authentication

282

(7)

Session Authentication versus Client and User Authentication

288

(1)

LDAP Authentication

289

(12)

LDAP Account Unit

291

(3)

LDAP Administration

294

(1)

Schema Configuration

294

(1)

Managing LDAP Users

295

(6)

Summary

301

(1)

Solutions Fast Track

302

(2)

Frequently Asked Questions

304

(3)

Open Security (OPSEC) and Content Filtering

307

(46)

Introduction

308

(1)

OPSEC Applications

308

(2)

Content Vectoring Protocol (CVP)

310

(8)

Defining Objects

310

(1)

Creating a CVP Resource

311

(3)

Using the Resource in a Rule

314

(2)

CVP Group

316

(2)

URI Filtering Protocol (UFP)

318

(6)

Defining Objects

318

(2)

Creating a URI Resource to Use UFP

320

(3)

Using the Resource in a Rule

323

(1)

UFP Group

324

(1)

Application Monitoring (AMON)

324

(2)

Client Side OPSEC Applications

326

(2)

Event Logging API

326

(1)

Log Export API

326

(1)

Suspicious Activities Monitoring

327

(1)

Object Management Interface

327

(1)

Check Point Management Interface

328

(1)

UserAuthority API

328

(1)

Other Resource Options

328

(16)

URI Resources

329

(1)

URI file

330

(2)

URI Wild Cards

332

(4)

SMTP Resources

336

(4)

FTP Resources

340

(1)

TCP

341

(3)

Summary

344

(1)

Solutions Fast Track

345

(4)

Frequently Asked Questions

349

(4)

Managing Policies and Logs

353

(40)

Introduction

354

(1)

Administering Check Point VPN-1/FireWall-1 NG for Performance

355

(13)

Configuring NG for Performance

355

(3)

Administering NG for Performance

358

(5)

Monitoring NG for Performance

363

(4)

Platform Specific Tools

367

(1)

Performance Conclusion

368

(1)

Administering Check Point VPN-1/FireWall-1 NG for Effectiveness

368

(12)

Quality Control

368

(2)

Patches and Updates

370

(1)

Policy Administration

371

(1)

Managing Multiple Policies

372

(1)

Editing Files

373

(2)

Managing Firewall Logs

375

(1)

Log Rotations

376

(4)

Log Maintenance

380

(1)

Administering Check Point VPN-1/FireWall-1 NG for Recoverability

380

(2)

Making Backups

380

(2)

Performing Advanced Administration Tasks

382

(6)

Firewall controls

382

(1)

fwstop

382

(1)

fwstart

382

(1)

cpstop

383

(1)

cpstart

383

(1)

cpconfig

383

(1)

cpstat

383

(1)

383

(2)

Firewall Processes

385

(1)

*NIX

385

(1)

Nokia

386

(1)

Windows

386

(1)

$FWDIR \tmp

386

(1)

fwd

386

(1)

fwm

387

(1)

in.ahttpd

387

(1)

in.asmtp.d

387

(1)

in.atelnetd

387

(1)

in.arlogind

387

(1)

in.aftpd

387

(1)

in.acliented

387

(1)

in.ahclientd

387

(1)

fw kill

387

(1)

Summary

388

(1)

Solutions Fast Track

388

(2)

Frequently Asked Questions

390

(3)

Tracking and Alerts

393

(22)

Introduction

394

(1)

Alerts Commands

394

(5)

Using Track Options

395

(1)

Logging Modifiers

396

(1)

Time Settings

396

(1)

Alerts Commands

397

(2)

User-Defined Tracking

399

(4)

alertf

400

(1)

Advanced User-Defined Alerts

400

(3)

Suspicious Activities Monitoring (SAM)

403

(3)

Check Point Malicious Activity Detection (CPMAD)

406

(6)

CPMAD Configuration

408

(1)

cpmad_config.conf

408

(2)

CPMAD Problems

410

(2)

Summary

412

(1)

Solutions Fast Track

412

(2)

Frequently Asked Questions

414

(1)

Configuring Virtual Private Networks

415

(36)

Introduction

416

(1)

Encryption Schemes

416

(6)

Encryption Algorithms; Symmetric vs. Asymmetric Cryptography

417

(2)

Key Exchange Methods: Tunneling vs. In-Place Encryption

419

(1)

Hash Functions and Digital Signatures

420

(1)

Certificates and Certificate Authorities

421

(1)

Types of VPNs

421

(1)

VPN domains

422

(1)

Configuring an FWZ VPN

422

(5)

Defining Objects

423

(1)

Local Gateway

423

(1)

Remote Gateway

423

(2)

Adding VPN Rules

425

(2)

FWZ Limitations

427

(1)

Configuring an IKE VPN

427

(8)

Defining Objects

428

(1)

Local Gateway

428

(1)

Remote Gateway

429

(1)

Adding VPN Rules

430

(2)

Testing the VPN

432

(1)

Debugging VPNs

433

(2)

Considerations for External Networks

435

(1)

Configuring a SecuRemote VPN

435

(5)

Local Gateway Object

436

(1)

User Encryption Properties

436

(1)

FWZ

437

(1)

IKE

437

(2)

Client Encryption Rules

439

(1)

Installing SecuRemote Client Software

440

(2)

Using SecuRemote Client Software

442

(5)

Secure Domain Login (SDL)

445

(2)

Summary

447

(1)

Solutions Fast Track

447

(2)

Frequently Asked Questions

449

(2)

Securing Remote Clients

451

(28)

Introduction

452

(1)

Installing and Configuring a Policy Server

452

(3)

Install from CD

453

(1)

Configuring a Policy Server

454

(1)

Desktop Security Options

455

(8)

Desktop Security Policy

455

(3)

Desktop Security Global Properties

458

(1)

Desktop Configuration Verification

459

(1)

Early Versions Compatibility

460

(1)

Client Encrypt Rules

461

(2)

Installing SecureClient Software

463

(10)

SecureClient Packaging Tool

465

(8)

Logging into the Policy Server

473

(2)

Summary

475

(1)

Solutions Fast Track

475

(2)

Frequently Asked Questions

477

(2)

Advanced Configurations

479

(32)

Introduction

480

(1)

Check Point High Availability (CPHA)

480

(8)

Enabling High Availability

481

(3)

Failing Over

484

(2)

Firewall Synchronization

486

(2)

Single Entry Point VPN Configurations (SEP)

488

(7)

Gateway Configuration

489

(6)

Policy Configuration

495

(1)

Multiple Entry Point VPN Configurations (MEP)

495

(9)

Overlapping VPN Domains

496

(3)

Gateway Configuration

499

(2)

Overlapping VPN Domains

501

(3)

Other High Availability Methods

504

(3)

Routing Failover

505

(1)

Hardware Options

505

(2)

Summary

507

(1)

Solutions Fast Track

507

(1)

Frequently Asked Questions

508

(3)

Appendix A Class C Subnet Mask Cheat Sheet

511

(8)

Appendix B Spoofing: Attacks on Trusted Identity

519

(84)

Introduction

520

(1)

What It Means to Spoof

520

(5)

Spoofing Is Identity Forgery

520

(1)

Spoofing Is an Active Attack against Identity Checking Procedures

521

(1)

Spoofing Is Possible at All Layers of Communication

521

(1)

Spoofing Is Always Intentional

522

(1)

Spoofing May Be Blind or Informed, but Usually Involved Only Partial Credentials

523

(1)

Spoofing Is Not the Same Thing as Betrayal

524

(1)

Spoofing Is Not Necessarily Malicious

524

(1)

Spoofing Is Nothing New

525

(1)

Background Theory

525

(2)

The Importance of Identity

526

(1)

The Evolution of Trust

527

(2)

Asymmetric Signatures between Human Beings

527

(2)

Establishing Identity within Computer Networks

529

(4)

Return to Sender

530

(1)

In the Beginning, There Was...a Transmission

531

(2)

Capability Challenges

533

(14)

Ability to Transmit: ``Can It Talk to Me?''

533

(2)

Ability to Respond: ``Can It Respond to Me?''

535

(4)

Ability to Encode: ``Can It Speak My Language?''

539

(2)

Ability to Prove a Shared Secret: ``Does It Share a Secret with Me?''

541

(2)

Ability to Prove a Private Keypair: ``Can I Recognize Your Voice?''

543

(1)

Ability to Prove an Identity Keypair: ``Is Its Identity Independently Represented in My Keypair?''

544

(2)

Configuration Methodologies: Building a Trusted Capability Index

546

(1)

Local Configuratios vs. Central Configurations

546

(1)

Desktop Spoofs

547

(2)

The Plague of Auto-Updating Applications

547

(2)

Impacts of Spoofs

549

(13)

Subtle Spoofs and Economic Sabotage

550

(1)

Flattery Will Get You Nowhere

550

(2)

Subtlety Will Get You Everywhere

552

(1)

Selective Failure for Selecting Recovery

552

(2)

Bait and Switch: Spoofing the Presence of SSL Itself

554

(8)

Down and Dirty: Engineering Spoofing Systems

562

(32)

Spitting into the Wind: Building a Skeleton Router in Userspace

562

(1)

Designing the Nonexistent: The Network Card That Didn't Exist but Responded Anyway

563

(1)

Implementation: DoxRoute, Section by Section

564

(22)

Bring Out the Halon: Spoofing Connectivity Through Asymmetric Firewalls

586

(1)

Symmetric Outgoing TCP: A Highly Experimental Framework for Handshake-Only TCP Connection Brokering

587

(7)

Summary

594

(1)

Solution Fast Track

595

(4)

Frequently Asked Questions

599

(4)

Index

603

Check Point Next Generation Security Administration

Buy New

Rent Book

Rent Digital

Used Book

How Marketplace Works:

Summary

Table of Contents

Digital License