Check Point Firewall Security Solution

Overview of Firewall Features

Firewalls control the traffic between the internal and external networks and are the core of a strong network security policy. Check Point Software Blades are a set of security features that makes sure that the Security Gateway or Security Management Server gives the correct functionality and performance. The Check Point Firewall is part of the Software Blade architecture that supplies "next-generation" firewall features, including:

• VPN and mobile device connectivity
• Identity and computer awareness
• Internet access and filtering
• Application control
• Intrusion and threat prevention
• Data Loss Prevention

Components of the Check Point Solution

These are the primary components of a Check Point solution:

• Security Gateway - The engine that enforces the organization’s security policy, is an entry point to the LAN, and is managed by the Security Management Server.
• Security Management Server - The application that manages, stores, and distributes the security policy to Security Gateways.
• SmartDashboard - A Check Point client used to create and manage the security policy.

Dual Stack (IPv4 and IPv6) Network Configuration

You can easily configure the Firewall to support a dual stack network that uses IPv4 and IPv6 addresses. Configure one or more interfaces with the applicable IPv4 and IPv6 addresses.

Access Control and the Rule Base

A primary goal of a firewall is to control access and traffic to and from the internal and external networks. The Firewall lets system administrators securely control access to computers, clients, servers and applications. The Firewall Rule Base defines the quality of the access control and network performance. Rules that are designed correctly make sure that a network:

• Only allows authorized connections and prevents vulnerabilities in a network
• Gives authorized users access to the correct internal networks
• Optimizes network performance and efficiently inspects connections

Licenses

Some LTE features require special licenses installed on the Security Gateways. The management server does not require special licenses.

• GTP features require a Carrier license, or the earlier GX/GTP license.
• CGNAT requires the Carrier license.
• SCTP and Diameter inspection require the Carrier license.

If there is no Carrier license on the Security Gateway, you cannot install a policy that has these rules:

• CGNAT rules
• Rules with SCTP or Diameter services
• Rules with Service = Any and Match for any attribute is enabled for an SCTP service.

Notes

• Services defined in Services > Other do not require a Carrier license.
• SCTP Connections matching Other services are not inspected.

How to Use this Guide

When you configure a Firewall, it is necessary that you understand how it is connected to the other Software Blades. For example, you must add a rule for the Firewall to allow remote users to connect to the internal network. In addition, you can enable Software Blades to supply advanced protection for the network, such as IPS and Anti-Bot.

Some of the sections in this guide tell you how to enable a sample configuration of a Software Blade. Make sure that you read the applicable Administration Guide for the Software Blade before you configure the feature for a production environment. Each section also explains rules that you must add to the Firewall Rule Base to complete the configuration for that feature.

Software Blades in this Guide

SmartDashboard Toolbar

You can use the SmartDashboard toolbar to do these actions: