Essential checkpoint firewall-1

Packed with practical, hands-on techniques, thisinsider's guide explains how to build, implement, and maintainthe world's best-selling firewall product, Check PointFireWall-1. Featuring tools, tips, and checklists not found inothersources, the book brings manageability, reliability, and efficiency totoday's standalone or distributed networks.

Essential Check Point FireWall-1™ coversevery major feature of the product providing working solutions toreal-world situations. Filled with screen shots and sampleconfigurations, the book features step-by-step instructions that canbe replicated on standard equipment easily. Developed through years ofactual product support, this guidebook is an invaluable resource fornetwork professionals working on UNIX or Windows NT platforms.

Key coverage includes:

• Firewall overview; planning,installation, and deployment of firewall security
• Building arulebase and using the Policy Editor application
• Logging andalerting
• Managing multiple firewall modules from a singlemanagement console
• Authentication and security issues
• Addressingtranslation (NAT)—why it's important and how it'sconfigured within FireWall-1
• Encryption (site-to-site andclient-to-site Virtual Private Networks)
• INSPECT—an overviewof the language at the heart of FireWall-1
  

Authoritative andpractical, this comprehensive guidebook provides real-world solutionsand techniques necessary for planning, installing, and deploying theworld's leading firewall product.

What I intend on talking about (and not).
Typographical Conventions.
Thanks.
1. Introduction to Check Point FireWall-1.
What is a Firewall?
What a Firewall Can Not Do.
Overview of Firewall Security Technologies.@AHEADS = Packet Filtering.
Application Proxies.
Stateful Inspection.
Technology Comparison: Passive FTP.
Technology Comparison: Traceroute.
What Kind of Firewall is FireWall-1?
Why Do You Need FireWall-1?
More Information.
2. Planning your FireWall-1 Installation.
Network Topology.@AHEADS = A Word about Subnetting.
Developing a Site-Wide Security Policy.@AHEADS = The What, Who, and How.
Implementing Firewalls Without a Written Security Policy.
An Example Security Policy.
Fun with Check Point Licensing.
Node-Limited Firewall Licenses.
Single Gateway Products.
Inspection Module.
FireWall-1 Host.
Management Console.
Motif GUI Licenses.
Small Office Products.
Getting Your Permanent License.
3. Installing FireWall-1.
Selecting an Operating System.@AHEADS = Windows NT.
Sparc Solaris.
x86 Solaris.
AIX and HPUX.
Nokia Security Platform (IPSO).
Linux.
Installing the Operating System.
Prepare for the OS Installation.
Guidelines for OS Installation.
Securing the Operating System.
Installing FireWall-1.
Unix Platforms.
Windows NT.
4. Building Your Rulebase.
Introducing the Management GUIs.@AHEADS = Configuring a User.
Configuring IPs to run the GUIs from.
What Files the GUI Modifies.
Security Policy Editor Restrictions.
GUI Demonstration Mode.
Rulebase Components.@AHEADS = Objects.
Anti-Spoofing.
Policy Properties.
Rules.
Order of Operations.
Making Your First Rulebase.
Knowing Your Network.
Defining Your Objects.
Determining Your Policy.
Rules That Should Be In Every Rulebase.
Installing the Policy.
Frequently Asked Questions.
5. Logging and  Alerting.
The System Status Viewer.
The Log Viewer.
Viewing Logs from the Command Line.
Active Mode and Blocking Connections.
Alerts.
Messages in the Log.
Log Maintenance.
6. Remote Management.
The Components.
The Management GUIS.
Configuring a User.
Configuring IPs to run from.
What Files the GUIs Modify.
Security Policy Editor Restrictions.
GUI Demonstration Mode.
The Management Console to Firewall Module Connection.
control.map file.
How Do the Different Authentication Schemes Work?
The fw putkey Command.
Establishing an Authenticated Control Connection.
Special Remote Management Conditions.
What Can You DO With Remote Management.
Control Policy on Firewall Module.
View State Tables of Firewall Modules.
Suspicious Activity Monitoring.
Updating Licenses.
Moving Management Consoles.
Moving a Firewall Module off the Management Console.
Moving the Management Console off a Firewall Module.
Troubleshooting Remote Management Issues.
GUI Issues.
Firewall/Management Module Issues.
Labs.
7. Authentication.
Passwords.
FireWall-1 Password.
OS Password.
S/Key.
SecurID.
Axent Pathways Defender.
RADIUS.
TACACS / TACACS+.
LDAP.
How Users Authenticate.
User Authentication.
Session Authentication.
Client Authentication.
Which Type Should You Choose?
Setting Up Authentication.
Creating Users.
Setting Supported Authentication Schemes.
User Authentication.
Session Authentication.
Client Authentication.
Integrating External Authentication Servers.
FAQs.
Troubleshooting Authentication Issues.
8. Content Security.
The Security Servers.@AHEADS = A Word About Licensing.
CVP and UFP.
Resources and Wildcards.
HTTP Security Server.
Filtering HTTP Without a UFP or CVP Server.
UFP with the HTTP Security Server.
CVP with the HTTP Security Server.
FTP Security Server.
SMTP Security Server.@AHEADS = $FWDIR/conf/smtp.conf.
SMTP Resources.
TCP Security Server.
Frequently Asked Questions.
General Security ServerQuestions.
FTP Security Server.
SMTP Security Server.
HTTP Security Server.
Performance Tuning for the Security Servers.
Troubleshooting Content Security Issues.
9. Network Address Translation.
Introduction.
RFC-1918.
How NAT Works in FireWall-1.
Order of Operations.
Implementing NAT: A Step-by-Step Example.
Determine which IP addresses will be used.
Proxy ARPs.
Static Host Routes.
Network Objects.
Anti-Spoofing.
Security Policy Rules.
Address Translation Rules.
Limitations of NAT.
Dual NAT.
Binding the NATted IP Address to the Loopback Interface.
Troubleshooting.
ARPs.
SYN Packets with No Response.
SYN Followed by RST.
Summary.
10. Encryption (Site-to-Site VPNs).
Introduction to VPNs.
Concepts.
Encryption.
Encryption Key.
Symmetric Encryption.
Asymmetric Encryption.
Certificate Authority.
Diffe-Hellman.
Encryption Domain..
A Word About Licensing.
Supported Key Management and Encryption Schemes.@AHEADS = FWZ.
IPSec.
Manual IPSec.
SKIP.
IKE (ISAKMP/OAKLEY).
How to Configure Encryption.@AHEADS = Planning Your Deployment.
IKE.
Manual IPSEC.
SKIP and FWZ.
Gateway Clusters and High Availability VPNs.
FAQs.
Troubleshooting VPN Problems.
Summary.
Labs.
Q and A.
11. SecuRemote and Secure Client (Client to FireWall-1 VPNs).
Introduction.
A Word About Licensing.
Steps to Configure SecuRemote on FireWall-1.
Choosing an Encryption Scheme.
Configuring Firewall Object for SecuRemote.
Creating Users for use with SecuRemote.
Client Encryption Rules.
Desktop Security Options.
Installing Secure Client.
High Availability and Multiple-Entry Point Configurations.
Hybrid Authentication Mode for IKE.
FAQs.
Troubleshooting.
12. High Availability.
What is High Availability.
State Synchronization.
HA Solutions.
Stonebeat.
Rainfinity.
Nokia.
Check Point's HA Module.
Issues with High Availability.
Licensing.
Managing Multiple Firewalls.
Load Balancing.
Asymmetric Routing.
13. Inspect.
What is INSPECT?
Basic INSPECT Syntax.
Conditions.
Constants.
Registers.
Manipulating Table Entries.
Creating Your Own Tables.
How Your Rulebase is Turned into INSPECT.@AHEADS = Services of Type Other.
Sample INSPECT Code.@AHEADS = Allowing Outbound Connections to a SecuRemote Client.
PPTP.
Allowing a Connection Based on a Previous Connection.
HTTP.
Ping and Traceroute.
Default filter.
fw monitor.
Appendix.
Securing Your Bastion Host.
firewall-1.conf file for use with OpenLDAP v1.
firewall-1.conf file for use with OpenLDAP v2.
Complete Program for Stateful Inspection of Ping and Traceroute.
Complete Program for Stateful Inspection of HTTP.
INSPECT Script for Different Policies on Different Interfaces.
Sample defaultfilter.pf file.
Sample Internet Usage Policy.
Performance Tuning.
Internet Resources.
Further Reading.