Working with Policy Packages

An organization has four sites, each with its own requirements. Each site has a different set of Software Blades installed on the Security Gateways:

Item	Security Gateway	Installed Software Blades
1	Sales California	Firewall, VPN
2	Sales Alaska	Firewall, VPN, IPS, DLP
3	Executive management	Firewall, VPN, QoS Check Point Software Blade on a Security Gateway that provides policy-based traffic bandwidth management to prioritize business-critical traffic and guarantee bandwidth and control latency., and Mobile Access Check Point Software Blade on a Security Gateway that provides a Remote Access VPN access for managed and unmanaged clients. Acronym: MAB.
4	Server farm	Firewall
5	Internet

To manage these different types of sites efficiently, you need to create three different Policy Packages . Each Package includes a combination of policy types that correspond to the Software Blades installed on the site's Security Gateway. For example:

• A policy package that includes the Access Control policy type. The Access Control policy type controls the firewall, NAT, Application & URL Filtering, and Content Awareness Software Blades. This package also determines the VPN configuration.

  Install the Access Control policy package on all Security Gateways.

• A policy package that includes the QoS policy type for the QoS blade on Security Gateway that manages bandwidth.

  Install this policy package on the executive management Security Gateway.

• A policy package that includes the Desktop Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. type for the Security Gateway that handles Mobile Access.

  Install this policy package on the executive management Security Gateway.

1. From the Menu, select Manage policies and layers.

   The Manage policies and layers window opens.

2. Click New.

   The New Policy window opens.

3. Enter a name for the policy package.

4. In the General page > Policy types section, select one or more of these policy types:

   • Access Control & HTTPS Inspection

   • Threat Prevention

   • QoS, select Recommended or Express

   • Desktop Security

   To see the QoS, and Desktop Security policy types, enable them on one or more Gateways:

   Go to gateway editor > General Properties > Network Security tab:

   • For QoS, select QoS

   • For Desktop Security, select IPSec VPN and Policy Server Pol

5. On the Installation targets page, select the gateways the policy will be installed on:

   • All gateways

   • Specific gateways - For each gateway, click the [+] sign and select it from the list.

   To install Policy Packages correctly and eliminate errors, each Policy Package Collection of different types of Security Policies, such as Access Control, Threat Prevention, QoS, and Desktop Security. After installation, Security Gateways enforce all Policies in the Policy Package. is associated with a set of appropriate installation targets.

6. Click OK.

7. Click Close.

   The new policy shows on the Security Policies page.

1. From the Menu, select Manage policies and layers.

   The Manage policies and layers window opens.

2. Select a policy package and click the Edit button.

3. The New Policy package window opens.

4. On the General > Policy types page, select the policy type to add:

   • Access Control & HTTPS Inspection

   • Threat Prevention

   • QoS, select Recommended or Express

   • Desktop Security

5. Click OK.

1. On the Global Toolbar, click Install Policy.

   The Install Policy window opens and shows the installation targets (Security Gateways).

2. From the Select a policy menu, select a policy package.

3. Select one or more policy types that are available in the package.

4. Select the Install Mode:

   • Install on each selected gateway independently - Install the policy on each target gateway independently of others, so that if the installation fails on one of them, it doesn't affect the installation on the rest of the target gateways.

     Note - If you select For Gateway clusters install on all the members, if fails do not install at all, the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. makes sure that it can install the policy on all cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. members before it begins the installation. If the policy cannot be installed on one of the members, policy installation fails for all of them.

   • Install on all selected gateways, if it fails do not install on gateways of the same version - Install the policy on all the target gateways. If the policy fails to install on one of the gateways, the policy is not installed on other target gateways.

5. Click Install.

When you make changes to user definitions through SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., they are saved to the user database on the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server.. User authentication methods and encryption keys are also saved in this database. The user database does not contain information about users defined externally to the Security Gateway (such as users in external User Directory Check Point Software Blade on a Management Server that integrates LDAP and other external user management servers with Check Point products and security solutions. groups), but it does contain information about the external groups themselves (for example, on which Account Unit the external group is defined). Changes to external groups take effect only after the policy is installed, or the user database is downloaded from the Security Management Server.

You must choose to install the policy or the user database, based on the changes you made:

• Install the policy, if you modified additional components of the Policy Package (for example, added new Security Policy rules) that are used by the installation targets

• Install the user database, if you only changed the user definitions or the administrator definitions - from the Menu, select Install Database

The user database is installed on:

• Security Gateways - during policy installation

• Check Point hosts with one or more Management Software Blades enabled - during database installation

You can also install the user database on Security Gateways and on a remote server, such as a Log Server Dedicated Check Point server that runs Check Point software to store and process logs., from the command line interface on the Security Management Server.

To install user database from the command line interface:

On the Security Management Server, run in the Expert mode:

fwm dbload <Main IP address of Name of Security Gateway Object>

For more information, see the R80.40 CLI Reference Guide - Chapter Security Management Server Commands - Section fwm - Sub-section fwm dbload.

Note - Check Point hosts that do not have active Management Software Blades do not get the user database installed on them.

You can uninstall the Access Control policy using the command line interface on the Security Gateway.