SmartLSM Security Policies

Understanding Security Policies

A SmartLSM Security Gateway has a SmartLSM Security Profile (created in SmartDashboard), which fetches a Check Point Security Policy from the Security Management Server or Domain Management Server. This Security Policy determines the settings of the firewall.

Before you can add a SmartLSM Security Gateway to SmartProvisioning, the Security Policies must exist in SmartDashboard, and you must have at least one SmartLSM Security Profile that refers to a Security Policy for SmartLSM Security Gateways.

This section describes how to create a Security Policy for a SmartLSM Security Gateway to be managed by SmartProvisioning. We recommend that you define a separate Security Policy for every SmartLSM Security Profile. In the Installable Target field of the Security Policy, add only the SmartLSM Security Profile object.

For more about how to create Security Policies, see the R77 Security Management Administration Guide.

Configuring Default SmartLSM Security Profile

You can select a default profile to serve as the SmartLSM Security Gateway's profile. This SmartLSM Security Profile will be assigned to all new SmartLSM Security Gateways of the appropriate type (UTM-1 Edge or Security Gateway).

To configure a SmartLSM Security Gateway to reference a default SmartLSM Security Profiles:

1. From SmartDashboard, select Policy > Global Properties.

   The Global Properties window opens.

2. From the navigation tree, select SmartLSM Profile Based Management.
3. Select Use default SmartLSM Profile's properties.
4. From Default SmartLSM Security Profile, select a SmartLSM Security Profile that is the default profile for Security Gateways.
5. From the Default UTM-1 Edge, select an existing UTM-1 Edge Security Profile that is the default profile for UTM-1 Edge appliances.
6. Click OK and install the policy.

Guidelines for Basic SmartLSM Security Policies

The following procedure can be used as a guideline for creating a Security Policy for a SmartLSM Security Profile. The specific rules of the Security Policy depend on the needs of your environment and the requirements of the SmartLSM Security Gateways that will reference the SmartLSM Security Profile.

To define a Security Policy for a SmartLSM Security Profile object:

1. Use the LocalMachine dynamic object to represent any SmartLSM Security Gateway.
2. Use the InternalNet, DMZnet and AuxiliaryNet dynamic objects to represent the respective networks, behind any SmartLSM Security Gateway.
3. Add rules according to the needs of your organization and the requirements for the SmartLSM Security Gateways, using Dynamic Objects whenever possible.

   Dynamic Objects make the SmartLSM Security Profile applicable to numerous gateways.

4. To allow Push actions from SmartProvisioning, add a rule that allows an incoming FW1_CPRID service from the Security Management Server or Domain Management Server to LocalMachine.
5. Install the Policy on the SmartLSM Security Profile object.

   This action prepares the Security Policy on the Security Management Server or Domain Management Server to be fetched by the SmartLSM Security Gateways that reference this SmartLSM Security Profile.

Creating Security Policies for Management

You must specify explicit rules to allow management traffic between SmartLSM Security Gateways and the Security Management Server or Domain Management Server. These rules are part of the Security Policy installed on the gateway that protects the Security Management Server or Domain Management Server.

Because SmartLSM Security Gateways can have Dynamic IP addresses, you must use "ANY" to represent all possible SmartLSM Security Gateways addresses.

Rules for Traffic between SmartProvisioning Gateway and Management Server

Creating Security Policies for VPNs

To create a VPN tunnel from a SmartLSM Security Gateway to a CO gateway, create a Security Policy for this encrypted traffic. As in the basic Security Policy, use Dynamic Objects. This localizes the policy for each SmartLSM Security Gateway that references the SmartLSM Security Profile.

To create a VPN Security Policy for a SmartLSM Security Profile:

1. Define a Star VPN Community.

   Configure all the relevant authentication and encryption properties for it. To learn more, see the R77 VPN Administration Guide.

2. Add the CO gateway as a Central Gateway.

   Make sure the CO gateway is configured with a static IP address.

3. Add the SmartLSM Security Profile that represents the SmartLSM Security Gateways as a Satellite Gateway.
4. Add rules that allow relevant VPN traffic.

   Example: The following rule allows encrypted telnet traffic that matches the community criteria.

Example — Telnet Through VPN Traffic Rule

1. Add a rule to allow Push actions from SmartProvisioning: allow FW1_CPRID service from the Security Management Server/Domain Management Server to LocalMachine.
2. Install the Security Policy on the SmartLSM Security Profile object.
3. Update the CO gateway with the new or changed SmartLSM Security Profiles. In SmartProvisioning, click Update Corporate Office Gateway.

Downloading to UTM-1 Edge Devices

SmartLSM Security Gateways on UTM-1 Edge devices can get security policies from the Security Management Server or Domain Management Server through the UTM-1 Edge Portal. You can use this option if, for some reason, SmartProvisioning is unable to fetch the SmartLSM Security Profile or unable to push the Security Policy.

To download a Security Policy to a SmartLSM Security Gateway from the UTM-1 Edge Portal:

1. Log in from the UTM-1 Edge portal to my.firewall.
2. Select Services > Accounts > Refresh, or select Services > Software Updates > Update Now.
3. The UTM-1 Edge SmartLSM Security Gateway polls for updates, and downloads the latest Security Policy.

To verify a successful download:

1. Log in from the UTM-1 Edge portal to my.firewall.
2. Select Reports > Event Log.
3. Find the following message:
   Installed updated Security Policy (downloaded).
4. Select Setup > Tools > Diagnostics.
5. Verify that the SmartLSM Security Profile in the Policy field is the UTM-1 Edge Profile that references the correct Security Policy.