Connection Port to Services on an Endpoint Security Management Server

Background

Important:

  • A Security Management Server listens to SSL traffic for all services on the TCP port 443 in these cases:

    • If you performed a clean installation of a Security Management Server and enabled the Endpoint Policy ManagementSoftware Blade.

    • If you upgraded a Security Management Server with disabled Endpoint Policy Management Software Blade to and enabled this Software Blade after the upgrade.

    In these cases, when Endpoint Security SSL traffic arrives at the TCP port 443, the Security Management Server automatically redirects it (internally) to the TCP port 4434.

    Service

    URL and Port

    Gaia Portal

    https://<IP Address of Gaia Management Interface>

    SmartView Web Application

    https://<IP Address of Management Server>/smartview/

    Management API Web Services

    (see Check Point Management API Reference)

    https://<IP Address of Management Server>/web_api/<command>

  • If you upgraded a Security Management Server with enabled Endpoint Policy Management Software Blade to , then the SSL port configuration remains as it was in the previous version, from which you upgraded:

    • A Security Management Server listens to Endpoint Security SSL traffic on the TCP port 443

    • A Security Management Server listens to SSL traffic for all other services on the TCP port 4434:

      Service

      URL and Port

      Gaia Portal

      https://<IP Address of Gaia Management Interface>:4434

      SmartView Web Application

      https://<IP Address of Management Server>:4434/smartview/

      Management API Web Services

      (see Check Point Management API Reference)

      https://<IP Address of Management Server>:4434/web_api/<command>

    In R81 and higher, an administrator can manually configure different TCP ports for the Gaia Portal (and other services) and Endpoint Security - 443 or 4434. For the applicable procedures, see .

    For the applicable procedures, see the R81 Harmony Endpoint Security Server Administration Guide > Chapter Endpoint Security Architecture > Section Connection Port to Services on an Endpoint Security Management Server.

    In R81 and higher, an administrator can manually configure different TCP ports for the Gaia Portal (and other services) and Endpoint Security - 443 or 4434. See the applicable procedures below.

  • When you enable the Endpoint Policy Management Software Blade on a Security Management Server, the SSL connection port to these services automatically changes from the default TCP port 443 to the TCP port 4434:

    • Gaia Portal

      Configuration

      URL and Port

      Default

      https://<IP Address of Gaia Management Interface>

      New

      https://<IP Address of Gaia Management Interface>:4434

    • SmartView Web Application

      Configuration

      URL and Port

      Default

      https://<IP Address of Management Server>/smartview/

      New

      https://<IP Address of Management Server>:4434/smartview/

    • Management API Web Services (see Check Point Management API Reference)

      Configuration

      URL and Port

      Default

      https://<IP Address of Management Server>/web_api/<command>

      New

      https://<IP Address of Management Server>:4434/web_api/<command>

  • When you disable the Endpoint Policy Management Software Blade on a Security Management Server, the SSL connection port automatically changes back to the default TCP port 443.

Procedures

Possible configuration scenarios are:

Scenario

Gaia Portal Certificate

Gaia Portal Listening Port

Endpoint Security Listening Port

1

Self-signed SSL certificate

443

4434

2

External SSL certificate

443

4434

3

Self-signed SSL certificate

4434

443

4

External SSL certificate

4434

443

  1. Connect to the command line on the Endpoint Security Management Server.

  2. Log in to the Expert mode.

  3. Modify the $UEPMDIR/apache/conf/ssl.conf file:

    1. Back up the current file:

      cp -v $UEPMDIR/apache/conf/ssl.conf{,_BKP}

    2. Edit the current file:

      vi $UEPMDIR/apache/conf/ssl.conf

    3. Configure this value in the "Listen" directive:

      Listen  0.0.0.0:4434

    4. In the "SSL Virtual Host Context" section, configure this value in the "VirtualHost" directive:

      <VirtualHost _default_:4434>

    5. Save the changes in the file and exit the editor.

  4. Modify the /web/templates/httpd-ssl.conf.templ file:

    1. Back up the current file:

      cp -v /web/templates/httpd-ssl.conf.templ{,_BKP}

    2. Edit the current file:

      vi /web/templates/httpd-ssl.conf.templ

    3. In the "Pass Phrase Dialog" section, configure this value in the "SSLPassPhraseDialog" directive:

      SSLPassPhraseDialog "exec:/opt/CPuepm-R81.20/apache/bin/SSLPassPhraseDialog"

    4. In the "Server Certificate" section, configure this value in the "SSLCertificateFile" directive:

      SSLCertificateFile "/opt/CPuepm-R81.20/engine/conf/ssl/sic_cert.pem"

    5. In the "Server Private Key" section, configure this value in the "SSLCertificateKeyFile" directive:

      SSLCertificateKeyFile "/opt/CPuepm-R81.20/engine/conf/ssl/sic_cert-key.pem"

    6. In the "Server Certificate Chain" section, configure this value in the "SSLCertificateChainFile" directive:

      SSLCertificateChainFile "/opt/CPuepm-R81.20/engine/conf/ssl/root_sic_cert.pem"

    7. Save the changes in the file and exit the editor.

  5. Configure the SSL port to 443 in the Gaia database.

    Run these two commands:

    dbset httpd:ssl_port 443

    dbset :save

  6. Generate the Apache configuration. Run:

    $UEPMDIR/system/install/gaia_apache_conf_regenerate

  7. Restart Check Point services. Run:

    cpstop && cpstart

  1. Import and install the certificates:

    1. Obtain the CA certificate that generated the custom SSL certificate for the Gaia Portal.

    2. Import the applicable CA certificate on the Endpoint Security Management Server.

      Follow Importing External PKI Certificates.

    3. Import the new Gaia Portal SSL certificate on the Endpoint Security Management Server.

      Follow Importing External PKI Certificates.

    4. Install the new CA certificate on Endpoint Clients.

      Follow Installing CA Certificates on Clients.

    5. Install the new Gaia Portal SSL certificate on the Endpoint Security Management Server.

      Follow Installing SSL Certificates on Servers.

  2. Connect to the command line on the Endpoint Security Management Server.

  3. Log in to the Expert mode.

  4. Modify the $UEPMDIR/apache/conf/ssl.conf file:

    1. Back up the current file:

      cp -v $UEPMDIR/apache/conf/ssl.conf{,_BKP}

    2. Edit the current file:

      vi $UEPMDIR/apache/conf/ssl.conf

    3. Configure this value in the "Listen" directive:

      Listen  0.0.0.0:4434

    4. In the "SSL Virtual Host Context" section, configure this value in the "VirtualHost" directive:

      <VirtualHost _default_:4434>

    5. Save the changes in the file and exit the editor.

  5. Modify the /web/templates/httpd-ssl.conf.templ file:

    1. Back up the current file:

      cp -v /web/templates/httpd-ssl.conf.templ{,_BKP}

    2. Edit the current file:

      vi /web/templates/httpd-ssl.conf.templ

    3. In the "Pass Phrase Dialog" section, configure this value in the "SSLPassPhraseDialog" directive:

      SSLPassPhraseDialog "exec:/opt/CPuepm-R81.20/apache/bin/SSLPassPhraseDialog"

    4. In the "Server Certificate" section, configure this value in the "SSLCertificateFile" directive:

      SSLCertificateFile "/opt/CPuepm-R81.20/engine/conf/ssl/sic_cert.pem"

    5. In the "Server Private Key" section, configure this value in the "SSLCertificateKeyFile" directive:

      SSLCertificateKeyFile "/opt/CPuepm-R81.20/engine/conf/ssl/sic_cert-key.pem"

    6. In the "Server Certificate Chain" section, configure this value in the "SSLCertificateChainFile" directive:

      SSLCertificateChainFile "/opt/CPuepm-R81.20/engine/conf/ssl/root_sic_cert.pem"

    7. Save the changes in the file and exit the editor.

  6. Configure the SSL port to 443 in the Gaia database.

    Run these two commands:

    dbset httpd:ssl_port 443

    dbset :save

  7. Generate the Apache configuration. Run:

    $UEPMDIR/system/install/gaia_apache_conf_regenerate

  8. Restart Check Point services. Run:

    cpstop && cpstart

  1. Connect to the command line on the Endpoint Security Management Server.

  2. Log in to the Expert mode.

  3. Modify the $UEPMDIR/apache/conf/ssl.conf file:

    1. Back up the current file:

      cp -v $UEPMDIR/apache/conf/ssl.conf{,_BKP}

    2. Edit the current file:

      vi $UEPMDIR/apache/conf/ssl.conf

    3. Configure this value in the "Listen" directive:

      Listen  0.0.0.0:443

    4. In the "SSL Virtual Host Context" section, configure this value in the "VirtualHost" directive:

      <VirtualHost _default_:443>

    5. Save the changes in the file and exit the editor.

  4. Modify the /web/templates/httpd-ssl.conf.templ file:

    1. Back up the current file:

      cp -v /web/templates/httpd-ssl.conf.templ{,_BKP}

    2. Edit the current file:

      vi /web/templates/httpd-ssl.conf.templ

    3. In the "Pass Phrase Dialog" section, configure this value in the "SSLPassPhraseDialog" directive:

      SSLPassPhraseDialog exec:/bin/passphrase_xlate

    4. In the "Server Certificate" section, configure this value in the "SSLCertificateFile" directive:

      SSLCertificateFile /usr/local/apache2/conf/server.crt

    5. In the "Server Private Key" section, configure this value in the "SSLCertificateKeyFile" directive:

      SSLCertificateKeyFile /usr/local/apache2/conf/server.key

    6. In the "Server Certificate Chain" section, configure this value in the "SSLCertificateChainFile" directive:

      SSLCertificateChainFile /usr/local/apache2/conf/server-ca.crt

    7. Save the changes in the file and exit the editor.

  5. Configure the SSL port to 4434 in the Gaia database.

    Run these two commands:

    dbset httpd:ssl_port 4434

    dbset :save

  6. Generate the Apache configuration. Run:

    $UEPMDIR/system/install/gaia_apache_conf_regenerate

  7. Restart Check Point services. Run:

    cpstop && cpstart

  1. Import and install the certificates:

    1. Obtain the CA certificate that generated the custom SSL certificate for the Gaia Portal.

    2. Import the applicable CA certificate on the Endpoint Security Management Server.

      Follow Importing External PKI Certificates.

    3. Import the new Gaia Portal SSL certificate on the Endpoint Security Management Server.

      Follow Importing External PKI Certificates.

    4. Install the new CA certificate on Endpoint Clients.

      Follow Installing CA Certificates on Clients.

    5. Install the new Gaia Portal SSL certificate on the Endpoint Security Management Server.

      Follow Installing SSL Certificates on Servers.

  2. Connect to the command line on the Endpoint Security Management Server.

  3. Log in to the Expert mode.

  4. Modify the $UEPMDIR/apache/conf/ssl.conf file:

    1. Back up the current file:

      cp -v $UEPMDIR/apache/conf/ssl.conf{,_BKP}

    2. Edit the current file:

      vi $UEPMDIR/apache/conf/ssl.conf

    3. Configure this value in the "Listen" directive:

      Listen  0.0.0.0:4434

    4. In the "SSL Virtual Host Context" section, configure this value in the "VirtualHost" directive:

      <VirtualHost _default_:4434>

    5. Save the changes in the file and exit the editor.

  5. Modify the /web/templates/httpd-ssl.conf.templ file:

    1. Back up the current file:

      cp -v /web/templates/httpd-ssl.conf.templ{,_BKP}

    2. Edit the current file:

      vi /web/templates/httpd-ssl.conf.templ

    3. In the "Pass Phrase Dialog" section, configure this value in the "SSLPassPhraseDialog" directive:

      SSLPassPhraseDialog exec:/bin/passphrase_xlate

    4. In the "Server Certificate" section, configure this value in the "SSLCertificateFile" directive:

      SSLCertificateFile /usr/local/apache2/conf/server.crt

    5. In the "Server Private Key" section, configure this value in the "SSLCertificateKeyFile" directive:

      SSLCertificateKeyFile /usr/local/apache2/conf/server.key

    6. In the "Server Certificate Chain" section, configure this value in the "SSLCertificateChainFile" directive:

      SSLCertificateChainFile /usr/local/apache2/conf/server-ca.crt

    7. Save the changes in the file and exit the editor.

  6. Configure the SSL port to 4434 in the Gaia database.

    Run these two commands:

    dbset httpd:ssl_port 4434

    dbset :save

  7. Generate the Apache configuration. Run:

    $UEPMDIR/system/install/gaia_apache_conf_regenerate

  8. Restart Check Point services. Run:

    cpstop && cpstart