Configuring a Security Group in Bridge Mode

Procedure:

  1. For more information, see the Quantum Maestro Getting Started Guide.

    Step

    Instructions

    1

    Install the Maestro environment.

    2

    Configure the applicable Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. and assign the applicable interfaces.

    3

    Run the GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. First Time Configuration Wizard for the Security Group.

    4

    During the First Time Configuration Wizard, you must configure these settings:

    • In the Management Connection window, select the interface, through which you connect to Gaia operating system.

    • In the Internet Connection window, do not configure IP addresses.

    • In the Installation Type window, select Security Gateway and/or Security Management.

    • In the Products window:

      1. In the Products section, select Security Gateway only.

      2. In the Clustering section, clear Unit is a part of a cluster, type.

    • In the Dynamically Assigned IP window, select No.

    • In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).

  2. You configure the Bridge interface in either in Gaia PortalClosed Web interface for the Check Point Gaia operating system., or Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group. of the Security Group.

    Note - You must connect to the Gaia Portal of the applicable Security Group.

    Step

    Instructions

    1

    In the navigation tree, click Network Management > Network Interfaces.

    2

    Make sure that the slave interfaces, which you wish to add to the Bridge interface, do not have IP addresses.

    3

    Click Add > Bridge.

    To configure an existing Bridge interface, select the Bridge interface and click Edit.

    4

    On the Bridge tab, enter or select a Bridge Group ID (unique integer between 1 and 1024).

    5

    Select the interfaces from the Available Interfaces list and then click Add.

    Notes:

    6

    On the IPv4 tab, enter the IPv4 address and subnet mask.

    Important - R81 does not support the option Obtain IPv4 address automatically (Known Limitation MBS-3246).

    7

    Optional: On the IPv6 tab, enter the IPv6 address and mask length.

    Important:

    • First, you must enable the IPv6 Support and reboot (see the R81 Scalable Platforms Gaia Administration Guide).

    • R81 does not support IPv6 Address on Gaia Management Interface (Known Limitation 01622840).

    • R81 does not support the option Obtain IPv6 address automatically (Known Limitation MBS-3246).

    8

    Click OK.

    Step

    Instructions

    1

    Connect to the command line on the applicable Security Group.

    2

    Log in to Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

    Go to Gaia gClish: enter gclish and press Enter.

    3

    Make sure that the slave interfaces, which you wish to add to the Bridge interface, do not have IP addresses assigned:

    show interface <Name of Slave Interface> ipv4-address

    show interface <Name of Slave Interface> ipv6-address

    4

    Add a new bridging group:

    add bridging group <Bridge Group ID 0 - 1024>

    Note - Do not change the state of bond interface manually using the "set interface <Bridge Group ID> state" command. This is done automatically by the bridging driver.

    5

    Add slave interfaces to the new bridging group:

    add bridging group <Bridge Group ID> interface <Name of First Slave Interface>

    add bridging group <Bridge Group ID> interface <Name of Second Slave Interface>

    Notes:

    • Do not select the interface that you configured as Gaia Management Interface.

    • Only Ethernet, VLAN, and Bond interfaces can be added to a bridge group.

    • A Bridge interface in Gaia can contain only two slave interfaces.

    6

    Assign an IP address to the bridging group.

    Note - You configure an IP address on a Bridging Group in the same way as you do on a physical interface (see the R81 Scalable Platforms Gaia Administration Guide).

    • To assign an IPv4 address, run:

      set interface <Name of Bridging Group> ipv4-address <IPv4 Address> {subnet-mask <Mask> | mask-length <Mask Length>}

      You can optionally configure the bridging group to obtain an IPv4 Address automatically.

    • To assign an IPv6 address, run:

      set interface <Name of Bridging Group> ipv6-address <IPv6 Address> mask-length <Mask Length>

      You can optionally configure the bridging group to obtain an IPv6 Address automatically.

      Important - First, you must enable the IPv6 Support and reboot (see the R81 Scalable Platforms Gaia Administration Guide).

    7

    Save the configuration:

    save config

  3. You can configure the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object in either Wizard Mode, or Classic Mode.

    Step

    Instructions

    1

    Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Domain Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that should manage this Security Group.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Create a new Security Gateway object in one of these ways:

    • From the top toolbar, click the New () > Gateway.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > New Gateway.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Gateway

    4

    In the Check Point Security Gateway Creation window, click Wizard Mode.

    5

    On the General Properties page:

    1. In the Gateway name field, enter the applicable name for this Security Gateway object.

    2. In the Gateway platform field, select Maestro.

    3. In the Gateway IP address section, select Static IP address and configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Security Group's First Time Configuration Wizard.

      Make sure the Security Management Server or Multi-Domain ServerClosed Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. can connect to these IP addresses.

    4. Click Next.

    6

    On the Trusted Communication page:

    1. Select the applicable option:

      • If you selected Initiate trusted communication now, enter the same Activation Key you entered during the Security Group's First Time Configuration Wizard.

      • If you selected Skip and initiate trusted communication later, make sure to follow Step 7.

    2. Click Next.

    7

    On the End page:

    1. Examine the Configuration Summary.

    2. Select Edit Gateway properties for further configuration.

    3. Click Finish.

    Check Point Gateway properties window opens on the General Properties page.

    8

    If during the Wizard Mode, you selected Skip and initiate trusted communication later:

    1. The Secure Internal Communication field shows Uninitialized.

    2. Click Communication.

    3. In the Platform field select Maestro.

    4. Enter the same Activation Key you entered during the Security Group's First Time Configuration Wizard.

    5. Click Initialize.

      Make sure the Certificate state field shows Established.

    6. Click OK.

    9

    On the General Properties page, on the Network Security tab, enable the applicable Software Blades.

    Important - See the Supported Software Blades in Bridge Mode and Limitations in Bridge Mode sections in Deploying a Security Group in Bridge Mode.

    10

    On the Network Management page, configure the Topology of the Bridge interface.

    Notes:

    • If a Bridge interface connects to the Internet, then set the Topology to External.

    • If you use this Bridge Security Gateway object in Access Control Policy rules with Internet objects, then set the Topology to External.

    11

    Click OK.

    12

    Publish the SmartConsole session.

    13

    This Security Gateway object is now ready to receive the Security PolicyClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

    Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Domain Management Server that should manage this Security Group.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Create a new Security Gateway object in one of these ways:

    • From the top toolbar, click the New () > Gateway.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > New Gateway.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Gateway

    4

    In the Check Point Security Gateway Creation window, click Classic Mode.

    Check Point Gateway properties window opens on the General Properties page.

    5

    In the Name field, enter the applicable name for this Security Gateway object.

    6

    In the IPv4 address and IPv6 address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Security Group's First Time Configuration Wizard.

    Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

    7

    Establish the Secure Internal Communication (SICClosed Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server.) between the Management Server and this Security Group:

    1. Near the Secure Internal Communication field, click Communication.

    2. In the Platform field select Maestro.

    3. Enter the same Activation Key you entered during the Security Group's First Time Configuration Wizard.

    4. Click Initialize.

    5. Click OK.

     

    If the Certificate state field does not show Established, perform these steps:

    1. Connect to the command line on the Security Group.

    2. Make sure there is a physical connectivity between the Security Group and the Management Server (for example, pings can pass).

    3. Run:

      cpconfig

    4. Enter the number of this option:

      Secure Internal Communication

    5. Follow the instructions on the screen to change the Activation Key.

    6. In SmartConsole, click Reset.

    7. Enter the same Activation Key you entered in the cpconfig menu.

    8. In SmartConsole, click Initialize.

    8

    In the Platform section, select the correct options:

    1. In the Hardware field, select Maestro.

    2. In the Version field, select R81.

    3. In the OS field, select Gaia.

    9

    On the General Properties page, on the Network Security tab, enable the applicable Software Blades.

    Important - See the Supported Software Blades in Bridge Mode and Limitations in Bridge Mode sections in Deploying a Security Group in Bridge Mode.

    10

    On the Network Management page, configure the Topology of the Bridge interface.

    Notes:

    • If a Bridge interface connects to the Internet, then set the Topology to External.

    • If you use this Bridge Security Gateway object in Access Control Policy rules with Internet objects, then set the Topology to External.

    11

    Click OK.

    12

    Publish the SmartConsole session.

    13

    This Security Gateway object is now ready to receive the Security Policy.

  4. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Domain Management Server that manages this Security Group.

    2

    From the left navigation panel, click Security Policies.

    3

    Create a new policy and configure the applicable layers:

    1. At the top, click the + tab (or press CTRL T).

    2. On the Manage Policies tab, click Manage policies and layers.

    3. In the Manage policies and layers window, create a new policy and configure the applicable layers.

    4. Click Close.

    5. On the Manage Policies tab, click the new policy you created.

    4

    Create the applicable rules in the Access Control and Threat Prevention policies.

    Important - See the Supported Software Blades in Bridge Mode and Limitations in Bridge Mode sections in Deploying a Security Group in Bridge Mode.

    5

    Install the Access Control Policy on the Security Gateway object.

    5

    Install the Threat Prevention Policy on the Security Gateway object.

For more information, see the: