SBT v1.

1 (MAJ 2023)

©2022 Check Point Software Technologies Ltd. 1

CHECK POINT

ARCHITECTURE
COMPONENTS

©2022 Check Point Software Technologies Ltd. 2

 Check Point Security 101
▪ The Check Point Security Management Architecture is the core component of
the Check Point unified security architecture
▪ The Check Point core systems:
– SmartConsole
– Security Management Server
– Security Gateway Stores and distributes security
policy to Security Gateways and
receives security logs from them

Integrated network security

Windows client that enforcing access control and
manages security policy threat prevention policies in
and events on the Security physical and virtual
Management server environments

©2022 Check Point Software Technologies Ltd. 3

Check Point Security 101
Distributed Deployment
The Security Management Server (1) and the Security Gateway (3) are installed on
different computers, with a network connection (2).

©2022 Check Point Software Technologies Ltd. 4

Check Point Security 101
Management High Availability
A Primary Security Management Server (1) has a direct or indirect connection (2)
to a Secondary Security Management Server (3).

The databases of the Security Management Servers are synchronized, manually or

on a schedule, to back up one another.

The administrator makes one Security Management Server Active and the others
Standby.

If the Active Security Management Server is down, the administrator can promote
the Standby server to be Active.

©2022 Check Point Software Technologies Ltd. 5

Check Point Security 101
Standalone Deployment
The Security Management Server (1) and the Security Gateway (3) are
installed on the same computer (2).

Full High Availability

In a Full High Availability Cluster on two Check Point Appliances, each
appliance runs both as a ClusterXL Cluster Member and as a Security
Management Server, in High Availability mode.

This deployment lets you reduce the maintenance required for your
systems.

The two appliances are connected with a direct synchronization connection (2) and
work in High Availability mode

©2022 Check Point Software Technologies Ltd. 6

 Check Point Security 101
Bridge Mode

A bridge mode deployment adds a Security Gateway to an existing environment without changing IP Routing.

▪ sk101371 Bridge Mode on Gaia OS and SecurePlatform OS

©2022 Check Point Software Technologies Ltd. 7

CHECK POINT

GAiA

©2022 Check Point Software Technologies Ltd. 8

GAiA Overview

In Greek mythology, Gaia is the mother of all

• GAiA is the Check Point’s Operating System (“O.S.”) since 2012

• GAiA is an hardened Linux

• Least number of applications, hardened web portal (aka « WebUI »)
• Restricted Shell, Kernel Changes

©2022 Check Point Software Technologies Ltd. 9

GAiA: un GNU/Linux endurci

1. Introduction to the Command Line Interface (lien)

2. sk101878 cpview
• History
• 1er outil à utiliser!
3. sk97638 Check Point Processes and Daemons
4. /var/log/message*
• Liste la plupart des évènements GAiA

©2022 Check Point Software Technologies Ltd. 10

CHECK POINT

R81 > R81.10 > R81.20

VERSION ACTUELLES

©2022 Check Point Software Technologies Ltd. 11

Une version et son contexte

sk173903 Check Point R81.20

Release What’s new? Documentation Jumbo Hotfix Known Resolved
notes Accumulator limitation Issues
lien lien lien lien sk174965 sk174966

sk95746 Check Point Default Version and Release Terminology

Major/Minor releases – EA/GA – Ongoing/GA JHF - FAQ

sk152052 Check Point Release Map

Releases information – upgrade map – backward compatibility – upgrade/download wizard

Support life cycle policy

Latest announcements – software & hardware supports

©2022 Check Point Software Technologies Ltd. 12

[Confidential] For designated groups and individuals ©2022 Check Point Software Technologies Ltd. 13
CHECK POINT

SECURITY
MANAGEMENT
SERVER

©2022 Check Point Software Technologies Ltd. 14

Check Point Security 101
Security Management Server

▪ The Security Management Server (SMS) is used to manage the security policy.
▪ The Security Management Server maintains the database of objects and policies.
▪ Policies and objects are defined using SmartConsole or the web services API.
▪ Security Gateways send logs to the Security Management Server.
▪ Policies, objects and logs are indexed to facilitate lookups.
▪ The Internal Certificate Authority (ICA) on the SMS establishes trusted relations.

©2022 Check Point Software Technologies Ltd. 15

Check Point Security 101
Security Management Server

R81 Management Architecture Overview

©2022 Check Point Software Technologies Ltd. 16
 Check Point Security 101
Secure Internal Communications (SIC)

▪ Communication must be encrypted

▪ Communication must be authenticated
▪ Transmitted communication should have data integrity
▪ SIC setup process allowing the intercommunication to take place must be
user friendly

©2022 Check Point Software Technologies Ltd. 17

Check Point Security 101
SIC Between Management and Components

©2022 Check Point Software Technologies Ltd. 18

Security Management Platform Data Centers

6000-XL
Large Enterprise

Midsize Enterprise 6000-L

Small Enterprise 600-M
400 Managed Gateways
600-S 384 GB RAM | 12 x 4TB SSD
384 GB RAM | 6 x 1TB SSD
150 Managed Gateways
50 Managed Gateways 192 GB RAM | 12 x 4TB HDD

10 Managed Gateways 64 GB RAM | 2 x 4TB HDD

32 GB RAM | 1 x 2TB HDD

200% increase in managed 70% increase in peak 1080 GB of logs

gateway capacity index log rates per day

©2022 Check Point Software Technologies Ltd. 19

 Manage all Check Point
Products from the Cloud
Always the latest On-demand Zero
security management Expansion Maintenance

Newest features Seamlessly support more No installation, backups,

automatically updated gateways and storage monitoring or upgrades

©2022 Check Point Software Technologies Ltd. 20

CHECK POINT

SECURITY
GATEWAYS

©2022 Check Point Software Technologies Ltd. 21

 Telco and High-End

Quantum Security GatewaysTM Data Center

Maestro 140 | 170

A new lineup for businesses of all sizes

Large Enterprise 28000

16000
Midsize Enterprise Turbo Hyperscale Up to 1.5 Tera bps
Up to 30 Gbps

6900 Up to 17.6 Gbps

Small Enterprise 6600 +700%
16000
64000
6200
Branch Office Up to 7.4 Gbps
+50%
3600 Up to 2,500 Mbps +75% 44000
1500 23000

+25%
15000
Up to 1500 Mbps +75% 20 Gbps
5600 - 5900 Up to 190 Gbps
+180% 5100 - 5400
10 Gbps
3100 - 3200 6.1 Gbps
1,460 Mbps
T H R E AT P R E V E N T I O N T H R O U G H P U T
585 Mbps

©2022 Check Point Software Technologies Ltd. 22

Quantum Lightspeed+ Maestro Hyperscale Orchestrator
Scale throughput 7.5x to 3 Tbps
3.0 Tbps

MHO175
Maestro
Hyperscale Span

from 2 to 15
400 Gbps
Maestro Span

MLS200
Beginning

2x MLS200
2x MLS200
400 Gbps
400 Gbps

Maestro Base Configuration Scale from 400 Gbps to 3 Tbps with Maestro*
* Or achieve the same 3 Tbps with 8x MLS400 + Maestro

©2022 Check Point Software Technologies Ltd. 23

OpenServers?!?

• HCL pour Hardware Compatibility List lien: https://www.checkpoint.com/support-services/hcl/

• Bandwidth comparison? => per physical cores

• Some consideration:
• Two support vendors
• Higher cost for support
• No trade-in

©2022 Check Point Software Technologies Ltd. 24

Check Point Security 101
Security Gateway Packages

Next Generation Firewall (NGFW)

❑ Includes Firewall, Application Control, and IPS.

Next Generation Threat Prevention (NGTP)

❑ Includes Firewall, Application Control, URL Filtering, IPS, Anti-Bot, Antivirus, and Anti-Spam
and Email Security.

Threat Prevention + SandBlast Zero-Day Protection (aka NGTX)

❑ Includes NGTP + SandBlast Threat Emulation, CPU-level and OS-level sandboxing to detect
and block unknown malware. While the file is run in a sandbox, Threat Extraction
reconstructs incoming documents to deliver safe content to the user.

©2022 Check Point Software Technologies Ltd. 25

CHECK POINT

SmartConsole

©2022 Check Point Software Technologies Ltd. 26

Check Point Security 101
Check Point SmartConsole Client

SmartConsole is a single client, used to

manage the network security policy and
view all security events.

▪ The SmartEndpoint client manages

endpoint security policy.

©2022 Check Point Software Technologies Ltd. 27

Check Point Security 101
Check Point SmartConsole R81.20
SmartConsole provides access to:

▪ Gateways & Services

▪ Security Policies
▪ Logs & Monitoring
▪ Infinity Services
▪ Manage & Settings

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 28
individuals
Check Point Security 101
Check Point SmartConsole R81.20
SmartConsole provides access to:

▪ Gateways & Services

▪ Security Policies
▪ Logs & Monitoring
▪ Infinity Services
▪ Manage & Settings

[Confidential] For designated groups and individuals ©2022 Check Point Software Technologies Ltd. 29
Check Point Security 101
Check Point SmartConsole R81.20
SmartConsole provides access to:

▪ Gateways & Services

▪ Security Policy
▪ Logs & Monitoring
▪ Infinity Services
▪ Manage & Settings

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 30
individuals
Check Point Security 101
Check Point SmartConsole R81.20
SmartConsole provides access to:

▪ Gateways & Services

▪ Security Policy
▪ Logs & Monitoring
▪ Infinity Services
▪ Manage & Settings

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 31
individuals
Check Point Security 101
Check Point SmartConsole R81.20
SmartConsole provides access to:

▪ Gateways & Services

▪ Security Policy
▪ Logs & Monitoring
▪ Infinity Services
▪ Manage & Settings

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 32
individuals
CHECK POINT

POLICIES: BASICS

©2022 Check Point Software Technologies Ltd. 33

 Check Point Security 101
Objects Explorer
▪ Networks
▪ Hosts
▪ Groups
▪ Services
▪ Resources
▪ Servers and OPSEC Applications
▪ Users and Access Roles
▪ VPN Communities

©2022 Check Point Software Technologies Ltd. 34

Check Point Security 101
Creating Objects

▪ When creating objects, consider organizational needs:

– What are the physical components in the network?
– What are the logical components: services, applications?
– What components access the firewall?
– Who are the users, how should they be grouped?
– Who are the administrators, what are their roles?
– Will VPN be used, will it allow remote users

©2022 Check Point Software Technologies Ltd. 35

Check Point Security 101
Detecting IP Spoofing

▪ Spoofing is where an intruder attempts

to gain unauthorized access by altering a
packet’s IP address.

©2022 Check Point Software Technologies Ltd. 36

Check Point Security 101
Creating the Rule Base
▪ Each rule defines the packets that match the rule.

©2022 Check Point Software Technologies Ltd. 37

Check Point Security 101

Basic Rules
▪ Two rules used by nearly all administrators
– Stealth Rule
– Cleanup rule

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 38
individuals
Check Point Security 101
Implied Rules

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 39
individuals
Check Point Security 101
Rule Base Management

Before creating a rulebase:

▪ Which objects are in the network?

▪ Which user permissions and authentication schemes are needed?
▪ Which services, including customized services and sessions, are allowed across the network?

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 40
individuals
Check Point Security 101
Rule Base Order – Access Control
▪ IP spoofing / IP options
▪ First Implied Rule[s] - No explicit rules can be placed before it.
▪ Explicit Rules - These are the rules that you create.
▪ Before Last Implied Rule[s] - Applied before the last explicit rule.
▪ Last Explicit Rule - We recommend using a Cleanup rule as the last explicit rule.
– Note - If you use the Cleanup rule as the last explicit rule, the Last Implied Rule and the Implicit
Cleanup Rule are not enforced.
▪ Last Implied Rule[s] - Although this rule is applied after all other explicit and implied rules, the
Implicit Cleanup Rule is still applied last.
▪ Implicit Cleanup Rule - The default rule that is applied if none of the rules in the Policy Layer match.

©2022 Check
[Confidential] For designated Pointand
groups Software Technologies Ltd. 41
individuals
©2022 Check Point Software Technologies Ltd. 42