Installing a Security Gateway

Notes:

  • This procedure applies to both Check Point Appliances and Open Servers.

  • This procedure does not apply to Check Point Small Office Appliance models lower than 3000.

Procedure:

  1. Step

    Instructions

    1

    Install the GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Operating System:

    2

    Follow Configuring Gaia for the First Time.

    3

    During the First Time Configuration Wizard, you must configure these settings:

    4

    Install a valid license.

    See Working with Licenses.

    • Step

      Instructions

      1

      Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Domain Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that should manage this Security Gateway.

      2

      From the left navigation panel, click Gateways & Servers.

      3

      Create a new Security Gateway object in one of these ways:

      • From the top toolbar, click the New () > Gateway.

      • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > New Gateway.

      • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Gateway.

      4

      In the Check Point Security Gateway Creation window, click Wizard Mode.

      5

      On the General Properties page:

      1. In the Gateway name field, enter the applicable name for this Security Gateway object.

      2. In the Gateway platform field, select the correct hardware type.

      3. In the Gateway IP address section, select the applicable option:

      4. Click Next.

      6

      On the Trusted Communication page:

      1. Select the applicable option:

        • If you selected Initiate trusted communication now, enter the same Activation Key you entered during the Security Gateway's First Time Configuration Wizard.

        • If you selected Skip and initiate trusted communication later, make sure to follow Step 7.

      2. Click Next.

      7

      On the End page:

      1. Examine the Configuration Summary.

      2. Select Edit Gateway properties for further configuration.

      3. Click Finish.

      Check Point Gateway properties window opens on the General Properties page.

      8

      If during the Wizard Mode, you selected Skip and initiate trusted communication later:

      1. The Secure Internal Communication field shows Uninitialized.

      2. Click Communication.

      3. In the Platform field:

      4. Enter the same Activation Key you entered during the Security Gateway's First Time Configuration Wizard.

      5. Click Initialize.

        Make sure the Certificate state field shows Established.

      6. Click OK.

      9

      On the General Properties page:

      • On the Network Security tab, enable the applicable Software Blades.

      • On the Threat Prevention tab, enable the applicable Software Blades.

      10

      Click OK.

      11

      Publish the SmartConsole session.

    • Step

      Instructions

      1

      Connect with SmartConsole to the Security Management Server or Domain Management Server that should manage this Security Gateway.

      2

      From the left navigation panel, click Gateways & Servers.

      3

      Create a new Security Gateway object in one of these ways:

      • From the top toolbar, click the New () > Gateway.

      • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > New Gateway.

      • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Gateway.

      4

      In the Check Point Security Gateway Creation window, click Classic Mode.

      Check Point Gateway properties window opens on the General Properties page.

      5

      In the Name field, enter the applicable name for this Security Gateway object.

      6

      In the IPv4 address and IPv6 address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Security Gateway's First Time Configuration Wizard.

      Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

      If this Security Gateway receives its IP addresses from a DHCP server, select Dynamic Address.

      7

      Establish the Secure Internal Communication (SICClosed Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server.) between the Management Server and this Security Gateway:

      1. Near the Secure Internal Communication field, click Communication.

      2. In the Platform field:

        • Select Open server / Appliance for all Check Point models 3000 and higher.

        • Select Open server / Appliance for an Open Server.

      3. Enter the same Activation Key you entered during the Security Gateway's First Time Configuration Wizard.

      4. Click Initialize.

      5. Click OK.

       

      If the Certificate state field does not show Established, perform these steps:

      1. Connect to the command line on the Security Gateway.

      2. Make sure there is a physical connectivity between the Security Gateway and the Management Server (for example, pings can pass).

      3. Run:

        cpconfig

      4. Enter the number of this option:

        Secure Internal Communication

      5. Follow the instructions on the screen to change the Activation Key.

      6. In SmartConsole, click Reset.

      7. Enter the same Activation Key you entered in the cpconfig menu.

      8. In SmartConsole, click Initialize.

      8

      In the Platform section, select the correct options:

      1. In the Hardware field:

        • If you install the Security Gateway on a Check Point Appliance, select the correct appliances series.

        • If you install the Security Gateway on an Open Server, select Open server.

      2. In the Version field, select R81.

      3. In the OS field, select Gaia.

      9

      Enable the applicable Software Blades:

      • On the Network Security tab.

      • On the Threat Prevention tab.

      10

      Click OK.

      11

      Publish the SmartConsole session.

  3. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Domain Management Server that manages this Security Gateway.

    2

    From the left navigation panel, click Security Policies..

    3

    Create a new policy and configure the applicable layers:

    1. At the top, click the + tab (or press CTRL T).

    2. On the Manage Policies tab, click Manage policies and layers.

    3. In the Manage policies and layers window, create a new policy and configure the applicable layers.

    4. Click Close.

    5. On the Manage Policies tab, click the new policy you created.

    4

    Create the applicable Access Control rules.

    5

    Install the Access Control Policy on the Security Gateway object.

    6

    Create the applicable Threat Prevention rules.

    7

    Install the Threat Prevention Policy on the Security Gateway object.

For more information, see the: