Multi-Domain Security Management Overview

Multi-Domain Security Management is a centralized management solution for large-scale, distributed environments with many different network Domains. This best-of-breed solution is ideal for enterprises with many subsidiaries, branches, partners and networks. Multi-Domain Security Management is also an ideal solution for managed service providers, cloud computing providers, and data centers.

Centralized management gives administrators the flexibility to manage polices for many diverse entities. Security policies should be applicable to the requirements of different departments, business units, branches and partners, balanced with enterprise-wide requirements.

Key Features

Basic Architecture

Multi-Domain Security Management uses tiered architecture to manage Domain network deployments.

• The Security Gateway enforces the security policy to protect network resources.
• A Domain is a network or group of networks belonging to a specified entity, such as a company, business unit, department, branch, or organization. For a cloud computing provider, one Domain can be defined for each customer.
• A Domain Management Server is a virtual Security Management Server that manages security policies and Security Gateways for a specified Domain.
• The Multi-Domain Server is a physical server that hosts the Domain Management Server databases and Multi-Domain Security Management system databases.
• The SmartDomain Manager is a management client that administrators use to manage domain security and the Multi-Domain Security Management system.

The Multi-Domain Servers and SmartDomain Manager are typically located at central Network Operation Centers (NOCs). Security Gateways are typically located together with protected network resources, often in another city or country.

The Multi-Domain Server

The Multi-Domain Server is a physical computer that hosts Domain Management Servers, system databases, and the Multi-Domain Log Server. The system databases include Multi-Domain Security Management network data, administrators, Global Policies, and domain management information.

A Multi-Domain Server can host a large amount of network and policy data on one server. To increase performance in large deployments, distribute traffic load, and configure high availability, you can use multiple Multi-Domain Servers.

Domain Management Servers

A Domain Management Server is the Multi-Domain Security Management functional equivalent of a Security Management Server. Administrators use Domain Management Servers to define, change and install Domain security policies to Domain Security Gateways. A Domain can have multiple Domain Management Servers in a high availability deployment. One Domain Management Server is active, while the other, fully synchronized, Domain Management Servers are standbys. You can also use a Security Management Server as a backup for the Domain Management Server.

Typically, a Domain Management Server is located on the Multi-Domain Server in the Network Operations Center network.

After you define a Domain Management Server, you define Security Gateways, network objects, and security policies using the basic procedures in the R77 Security Management Administration Guide. You manage Security Gateways using the Domain Management Server SmartDashboard.

You must define routers to communicate between Domain Security Gateways and Domain Management Servers. Traffic must be allowed between the Multi-Domain Servers, network, Security Gateways and Domain Security Gateways. It should also be allowed for SmartConsole Client applications and Domain Management Server connections. Access rules must be set up as appropriate in Domain Security Gateway rule base.

If you are using Logging or High Availability Domain network, you must configure routing to support these functions.

Log Servers

This section shows how log servers operate in a Multi-Domain Security Management deployment.

Multi-Domain Log Server

A Multi-Domain Log Server hosts log files for multiple Domains. Typically, the Multi-Domain Log Server is hosted on a Multi-Domain Server dedicated for log traffic. This improves performance by isolating log traffic from management traffic.

You can optionally install a Multi-Domain Log Server on a Multi-Domain Server together with the Domain Management Servers and system databases. This option is appropriate for deployments with lighter traffic loads. You can also create a redundant log infrastructure by defining the Multi-Domain Log Server as the primary log server and the Multi-Domain Server as a backup.

You can have multiple Multi-Domain Log Servers in a Multi-Domain Security Management environment. You use the SmartDomain Manager to manage your Log Servers with a different log repository for each Domain.

Domain Log Server

A Domain Log Server is a virtual log server for a single Domain. Typically, Log Servers are virtual components installed on a Multi-Domain Log Server. You can also configure Log Servers to monitor specified Domain Security Gateways.

Security Policies

A Security Policy is a set of rules that are enforced by Security Gateways. In a Multi-Domain Security Management deployment, administrators use Domain Management Servers to define and manage security policies for Security Gateways included in Domains.

Global Policies

Global policies are a collection of rules and objects that are assigned to all Domains, or to specified groups of Domains. This is an important time saver because it lets administrators assign rules to any or all Domain Security Gateways without having to configure them individually.

The Management Model

Introduction to the Management Model

The Multi-Domain Security Management model is granular and lets you assign a variety of different access privileges to administrators. These privileges let administrators do specified management tasks for the entire deployment or for specified Domains.

Management Tools

The SmartDomain Manager

Administrators use the SmartDomain Manager to manage the Multi-Domain Security Management and to open the SmartConsole client applications for specific Domains. The SmartDomain Manager has many views to let administrators see information and do various tasks.

SmartConsole Client Applications

Administrators use SmartConsole clients to configure, manage and monitor security policies. SmartConsole clients include all the following:

• SmartDashboard lets administrators define and manage security policies.
• SmartView Tracker lets administrators see, manage and track log information.
• SmartUpdate lets administrators manage and maintain the license repository, as well as to update Check Point software.
• SmartView Monitor lets administrators monitor traffic on Multi-Domain Servers, Security Gateways, and QoS Security Gateways. They can also see alerts and test the status of various Check Point components throughout the system.
• SmartReporter lets administrators generate reports for different aspects of network activity.
• SmartProvisioning lets administrators manage many SmartProvisioning Security Gateways.

SmartDashboard Toolbar

You can use the SmartDashboard toolbar to do these actions:

High Availability

Multi-Domain Security Management High Availability gives uninterrupted management redundancy for all Domains. Multi-Domain Security Management High Availability operates at these levels:

• Multi-Domain Server High Availability - Multiple Multi-Domain Servers are, by default, automatically synchronized with each other. You can connect to any Multi-Domain Server to do Domain management tasks. One Multi-Domain Server is designated as the Active Multi-Domain Server. Other Multi-Domain Servers are designated as Standby Multi-Domain Servers.

  You can only do Global policy and global object management tasks using the active Multi-Domain Server. In the event that the active Multi-Domain Server is unavailable, you must change one of the standby Multi-Domain Servers to active.

• Domain Management Server High Availability - Multiple Domain Management Servers give Active/Standby redundancy for Domain management. One Domain Management Server for each Domain is Active. The other, fully synchronized Domain Management Servers for that Domain, are standbys. In the event that the Active Domain Management Server becomes unavailable, you must change one of the standby Domain Management Servers to active.

You can also use ClusterXL to give High Availability redundancy to your Domain Security Gateways. You use SmartDashboard to configure and manage Security Gateway High Availability for Domain Management Servers.