|
|
|
Network Objects are created in order to represent actual physical machines and components such as gateway, servers, as well as logical components such as IP Address Ranges and Dynamic Objects.
Objects are created and managed by the system administrator via SmartDashboard.
All objects are managed using SmartDashboard; therefore, it is recommended that the objects database must not be accessed or edited directly. In this appendix you will find general information about network objects, including configuration specifications, where necessary.
$FWDIR/conf/objects_5_0.c.objects.c file for the Security Gateway. This file is computed and derived from the objects_5_0.c file.objects.c file to the Security Gateway.When an object is created it is allocated an iconic representation that can be viewed and applied from any of the following locations:
A Security Gateway object is a gateway with more than one interface on which Check Point Software Blades are installed. At least a firewall blade is installed, although other Check Point Software Blade such as QoS or Monitoring may also be installed). This gateway sits on the network that serves as an entry point to the LAN and is managed by the Security Management server. A Security Gateway is characterized as follows:
If the Security Gateway that you defined does not need to perform IP forwarding or anti-spoofing, you can convert it to a Check Point host.
This procedure includes the basic steps for defining a Security Gateway object in SmartDashboard. You can find detailed procedures for Software Blade and feature configuration in the applicable Administration Guide. You can find explanations for fields and options in the Online Help for each window.
To configure a Security Gateway object:
This name must match the host name defined in the Security Gateway computer operating system.
If you select a Check Point appliance or Open Server, you must manually select the installed operating system later.
Dynamic address can be assigned for IPv4 and/or IPv6.
You can convert a Security Gateway to a Check Point host by right-clicking the Security Gateway in the Objects Tree and selecting Convert to Host.
A UTM-1 Edge gateway object is a network object that represents a UTM-1 Edge gateway. This gateway sits on the network and can be managed by the Security Management server or by an external management server.
A Check Point host is a host with only one interface, on which Check Point software has been installed, and which is managed by the Security Management server.
A Check Point host is characterized as follows:
If you have defined a Check Point host and you are trying to use it to perform IP forwarding or anti-spoofing, you must convert it to a Security Gateway.
You can convert a Check Point host to a Security Gateway by right-clicking the Check Point host in the Objects Tree and selecting Convert to Gateway.
A gateway cluster is a group of Security Gateway machines on which Check Point software has been installed which have been configured to provide failover services using ClusterXL or another Cluster solution.
You can detach a Cluster member from a gateway cluster and convert it into a Security Gateway:
The Gateway Properties window of the converted cluster member opens.
An Externally Managed Security Gateway or a Host is a gateway or a Host which has Check Point software installed on it. This Externally Managed gateway is managed by an external Security Management server. While it does not receive the Check Point Security Policy, it can participate in Check Point VPN communities and solutions.
A node can represent any network entity. The two most common uses of this object are to create non-Check Point Security Gateways and Hosts.
An Interoperable Device is a device which has no Check Point Software Blades installed. This device is managed by any Management Server, including Security Management server, although it cannot receive the Check Point Security Policy, and it can participate in Check Point VPN communities and solutions.
A Network is a group of IP addresses defined by a network address and a net mask. The net mask indicates the size of the network.
A Broadcast IP address is an IP address which is destined for all hosts on the specified network. If this address is included, the Broadcast IP address will be considered as part of the network.
This object defines a DNS domain name.
The format of the domain name is .x.y, where each section of the domain name is demarcated by a period. For instance .mysite.com or .mysite.co.uk. The domain name that is specified must be an actual domain name in order that it can be resolved to a valid IP address. The first time that a domain name is resolved by the Security Gateway, a brief delay may occur. Once the domain name has been resolved it is entered into the cache, and no further delays will take place on any subsequent access attempts. On account of the initial delays which may occur for each new domain name, the rules that contain Domain objects in their Source or Destination should be placed towards the end of the Rule Base.
A network objects group is a collection of hosts, gateways, networks or other groups.
Groups are used in cases where you cannot work with single objects, e.g. when working with VPN domains or with topology definitions.
In addition, groups can greatly facilitate and simplify network management, since they allow you to perform operations only once instead of repeating them for every group member.
The Group Properties window lists the network objects included from the group versus those excluded from the group. To configure the group, move objects between the lists as needed.
To include an unlisted network object in the group, create it now by clicking New.
This window shows collapsed sub-groups, without listing their members. For a list of all group members (including the sub-groups' members), click View Expanded Group.
The Open Security Extension features enable Check Point to manage third-party open security extension devices (OSE). The number of managed devices depends on your license. Devices include hardware and software packet filters. Check Point also supports hardware security devices which provide routing and additional security features, such as Network Address Translation and Authentication. Security devices are managed in the Security Policy as Embedded Devices. The Security Management server generates Access Lists from the Security Policy and downloads them to selected routers and open security device. Check Point supports these devices:
OSE Device |
Supported Versions |
|---|---|
Cisco Systems |
9.x, 10.x, 11.x, 12.x |
Nortel |
13.x, 14.x |
When working with a Cisco Router (that is, OSE object), the Rule Base should not contain one of the following. If one of the following is included in the Rule Base, the Security Management server will fail to generate Access Lists from the rules.
To add an interface, click New. The Interface Properties window opens.
Interface Properties > General:
You can define anti-spoofing parameters when installing Access Lists on Cisco routers (version 10.x and higher).
To implement anti-spoofing on Cisco routers:
Note - Only external interfaces log spoofing attempts.
For Cisco (Version 10.x and higher) and Nortel OSE devices, you must specify the direction of the filter rules generated from anti-spoofing parameters. The direction of enforcement is specified in the Setup tab of each router.
For Cisco routers, the direction of enforcement is defined by the Spoof Rules Interface Direction property.
Access List No — The number of Cisco access lists enforced. Cisco routers Version 12x and below support an ACL number range from 101-200. Cisco routers Version 12x and above support an ACL range number from 101-200 and also an ACL number range from 2000-2699. Inputting this ACL number range enables the support of more interfaces.
For each credential, select an option:
Username — The name required to logon to the OSE device.
Password — The Administrator password (Read only) as defined on the router.
Enable Username — The user name required to install Access Lists.
Enable Password — The password required to install Access Lists.
Version — The Cisco OSE device version (9.x, 10.x, 11.x, 12.x).
OSE Device Interface Direction — Installed rules are enforced on data packets traveling in this direction on all interfaces.
Spoof Rules Interface Direction — The spoof tracking rules are enforced on data packets traveling in this direction on all interfaces.
A Logical Server is a group of machines that provides the same services. The workload of this group is distributed between all its members.
When a Server group is stipulated in the Servers group field, the client is bound to this physical server. In Persistent server mode the client and the physical server are bound for the duration of the session.
The load balancing algorithm stipulates how the traffic is balanced between the servers. There are several types of balancing methods:
An Address Range object stipulates the range of IP addresses used in the network from the first to the last IP address.
This object is used when the networks themselves do not have IP address-net mask alignment, so an Address Range is necessary for the implementation of:
A dynamic object is a "logical" object where the IP address will be resolved differently per Security Gateway using the dynamic_objects command.
The following are the predefined Dynamic Objects:
cpconfig when configuring the ROBO gateway).cpconfig when configuring the ROBO gateway).cpconfig when configuring the ROBO gateway).cpconfig when configuring the ROBO gateway).For more information see the R77 Command Line Interface Reference Guide.
There are five types of VoIP Domain objects:
In many VoIP networks, the control signals follow a different route through the network than the media. This is the case when the call is managed by a signal routing device. Signal routing is done in SIP by the Redirect Server, Registrar, and/or Proxy. In SIP, signal routing is done by the Gatekeeper and/or gateway.
Enforcing signal routing locations is an important aspect of VoIP security. It is possible to specify the endpoints that the signal routing device is allowed to manage. This set of locations is called a VoIP Domain. For more information refer to R77 Command Line Interface Reference Guide.