Open Frames Download Complete PDF Send Feedback Print This Page



Check Point Firewall Security Solution

In This Section:

Overview of Firewall Features


How to Use this Guide

SmartDashboard Toolbar

Overview of Firewall Features

Firewalls control the traffic between the internal and external networks and are the core of a strong network security policy. Check Point Software Blades are a set of security features that makes sure that the Security Gateway or Security Management Server gives the correct functionality and performance. The Check Point Firewall is part of the Software Blade architecture that supplies "next-generation" firewall features, including:

  • VPN and mobile device connectivity
  • Identity and computer awareness
  • Internet access and filtering
  • Application control
  • Intrusion and threat prevention
  • Data Loss Prevention

Components of the Check Point Solution




Internet and external networks


Security Gateway




Security Management Server


Internal network

These are the primary components of a Check Point solution:

  • Security Gateway - The engine that enforces the organization’s security policy, is an entry point to the LAN, and is managed by the Security Management Server.
  • Security Management Server - The application that manages, stores, and distributes the security policy to Security Gateways.
  • SmartDashboard - A Check Point client used to create and manage the security policy.

Dual Stack (IPv4 and IPv6) Network Configuration

You can easily configure the Firewall to support a dual stack network that uses IPv4 and IPv6 addresses. Configure one or more interfaces with the applicable IPv4 and IPv6 addresses.



IPv4 network traffic

IPv6 network traffic


Security Gateway for dual stack network


Internal network (IPv6 traffic)


Dual stack web server in the DMZ


Security Gateway for IPv4 network


Security Gateway for IPv6 network


Mobile device (IPv4 traffic)


Mobile devices (IPv6 traffic)

Note - For R76 Security Gateways and higher, you can configure the interfaces to use only IPv6 addresses.

Access Control and the Rule Base

A primary goal of a firewall is to control access and traffic to and from the internal and external networks. The Firewall lets system administrators securely control access to computers, clients, servers and applications. The Firewall Rule Base defines the quality of the access control and network performance. Rules that are designed correctly make sure that a network:

  • Only allows authorized connections and prevents vulnerabilities in a network
  • Gives authorized users access to the correct internal networks
  • Optimizes network performance and efficiently inspects connections


Some LTE features require special licenses installed on the Security Gateways. The management server does not require special licenses.

  • GTP features require a Carrier license, or the earlier GX/GTP license.
  • CGNAT requires the Carrier license.
  • SCTP and Diameter inspection require the Carrier license.

If there is no Carrier license on the Security Gateway, you cannot install a policy that has these rules:

  • CGNAT rules
  • Rules with SCTP or Diameter services
  • Rules with Service = Any and Match for any attribute is enabled for an SCTP service.


  • Services defined in Services > Other do not require a Carrier license.
  • SCTP Connections matching Other services are not inspected.

How to Use this Guide

When you configure a Firewall, it is necessary that you understand how it is connected to the other Software Blades. For example, you must add a rule for the Firewall to allow remote users to connect to the internal network. In addition, you can enable Software Blades to supply advanced protection for the network, such as IPS and Anti-Bot.

Some of the sections in this guide tell you how to enable a sample configuration of a Software Blade. Make sure that you read the applicable Administration Guide for the Software Blade before you configure the feature for a production environment. Each section also explains rules that you must add to the Firewall Rule Base to complete the configuration for that feature.

Software Blades in this Guide





Creating a Strong Firewall Security Policy

Configuring the NAT Policy

Mobile Access

Remote Access to the Network


Creating VPN Policies

Identity Awareness

Adding Users to the Security Policy

URL Filtering

Defining an Internet Access Policy

Application Control




Defending against Network Intrusions




Threat Prevention Policies



Data Loss Prevention

Securing Data

Advanced Networking & Clustering

Maximizing Network Performance


Monitoring and Logging



SmartDashboard Toolbar

You can use the SmartDashboard toolbar to do these actions:



Open the SmartDashboard menu. When instructed to select menu options, click this button to show the menu.

For example, if you are instructed to select Manage > Users and Administrators, click this button to open the Manage menu and then select the Users and Administrators option.

Save current policy and all system objects.

Open a policy package, which is a collection of Policies saved together with the same name.

Refresh policy from the Security Management Server.

Open the Database Revision Control window.

Change global properties.

Verify Rule Base consistency.

Install the policy on Security Gateways or VSX Gateways.

Open SmartConsole.

Top of Page ©2015 Check Point Software Technologies Ltd. All rights reserved. Download PDF Send Feedback Print