Boot Security

Important - This section does not apply to Scalable Platforms (Maestro and Chassis).

The Boot Security protects the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. and its networks, during the boot:

  • Disables the IP Forwarding in Linux OS kernel

  • Loads the Default Filter Policy

Important - In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

The Default Filter Policy (defaultfilter) protects the Security Gateway from the time it boots up until it installs the user-defined Security PolicyClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

Boot Security disables IP Forwarding and loads the Default Filter Policy.

There are three Default Filters templates on the Security Gateway:

Default Filter Mode

Default Filter Policy File

Description

Boot Filter

$FWDIR/lib/defaultfilter.boot

This filter:

  • Drops all incoming packets that have the same source IP addresses as the IP addresses assigned to the Security Gateway interfaces

  • Allows all outbound packets from the Security Gateway

Drop Filter

$FWDIR/lib/defaultfilter.drop

This filter drops all inbound and outbound packets on the Security Gateway.

Best Practice - If the boot process requires that the Security Gateway communicate with other hosts, do not use the Drop Filter.

Filter for Dynamically Assigned Gateways (DAG)

$FWDIR/lib/defaultfilter.dag

This filter for Security Gateways with Dynamically Assigned IP address:

  • Allows all DHCP Requests

  • Allows all DHCP Replies

  • Uses Boot Filter:

    1. Drops all incoming packets that have the same source IP addresses as the IP addresses assigned to the Security Gateway interfaces

    2. Allows all outbound packets from the Security Gateway

Step

Instructions

1

Make sure to configure and install a Security Policy on the Security Gateway.

2

Connect to the command line on the Security Gateway.

3

Log in to the Expert mode.

4

Back up the current Default Filter Policy file:

cp -v $FWDIR/conf/defaultfilter.pf{,_BKP}

5

Create a new Default Filter Policy file.

  • To create a new Boot Filter, run:

    cp -v $FWDIR/lib/defaultfilter.boot $FWDIR/conf/defaultfilter.pf

  • To create a new Drop Filter, run:

    cp -v $FWDIR/lib/defaultfilter.drop $FWDIR/conf/defaultfilter.pf

  • To create a new DAG Filter, run:

    cp -v $FWDIR/lib/defaultfilter.dag $FWDIR/conf/defaultfilter.pf

6

Compile the new Default Filter file:

fw defaultgen

  • The new complied Default Filter file for IPv4 traffic is:

    $FWDIR/state/default.bin

  • The new complied Default Filter file for IPv6 traffic is:

    $FWDIR/state/default.bin6

7

Get the path of the Default Filter Policy file:

$FWDIR/boot/fwboot bootconf get_def

Example:

[Expert@MyGW:0]# $FWDIR/boot/fwboot bootconf get_def
/etc/fw.boot/default.bin
[Expert@MyGW:0]#

8

Copy new complied Default Filter file to the path of the Default Filter Policy file.

  • For IPv4 traffic, run:

    cp -v $FWDIR/state/default.bin /etc/fw.boot/default.bin

  • For IPv6 traffic, run:

    cp -v $FWDIR/state/default.bin6 /etc/fw.boot/default.bin6

9

Make sure to connect to the Security Gateway over a serial console.

Important - If the new Default Filter Policy fails and blocks all access through the network interfaces, you can unload that Default Filter Policy and install the working policy.

10

Reboot the Security Gateway.

Administrators with Check Point INSPECT language knowledge can define customized Default Filters.

Important - Make sure your customized Default Filter policy does not interfere with the Security Gateway boot process.

Step

Instructions

1

Make sure to configure and install a Security Policy on the Security Gateway.

2

Connect to the command line on the Security Gateway.

3

Log in to the Expert mode.

4

Back up the current Default Filter Policy file:

cp -v $FWDIR/conf/defaultfilter.pf{,_BKP}

5

Create a new Default Filter Policy file.

  • To use the Boot Filter as a template, run:

    cp -v $FWDIR/lib/defaultfilter.boot $FWDIR/conf/defaultfilter.pf

  • To use the Drop Filter as a template, run:

    cp -v $FWDIR/lib/defaultfilter.drop $FWDIR/conf/defaultfilter.pf

  • To use the DAG Filter as a template, run:

    cp -v $FWDIR/lib/defaultfilter.dag $FWDIR/conf/defaultfilter.pf

6

Edit the new Default Filter Policy file to include the applicable INSPECT code.

Important - Your customized Default Filter must not use these functions:

  • Logging

  • Authentication

  • Encryption

  • Content Security

7

Compile the new Default Filter file:

fw defaultgen

  • The new complied Default Filter file for IPv4 traffic is:

    $FWDIR/state/default.bin

  • The new complied Default Filter file for IPv6 traffic is:

    $FWDIR/state/default.bin6

8

Get the path of the Default Filter Policy file:

$FWDIR/boot/fwboot bootconf get_def

Example:

[Expert@MyGW:0]# $FWDIR/boot/fwboot bootconf get_def
/etc/fw.boot/default.bin
[Expert@MyGW:0]#

9

Copy new complied Default Filter file to the path of the Default Filter Policy file.

  • For IPv4 traffic, run:

    cp -v $FWDIR/state/default.bin /etc/fw.boot/default.bin

  • For IPv6 traffic, run:

    cp -v $FWDIR/state/default.bin6 /etc/fw.boot/default.bin6

10

Make sure to connect to the Security Gateway over a serial console.

Important - If the new Default Filter Policy fails and blocks all access through the network interfaces, you can unload that Default Filter Policy and install the working policy.

11

Reboot the Security Gateway.

It is sometimes necessary to stop the Security Gateway for maintenance. It is not always practical to disconnect the Security Gateway from the network (for example, if the Security Gateway is on a remote site).

To stop the Security Gateway for maintenance and maintain security, you can run:

Command

Description

cpstop -fwflag -default

  • Shuts down Check Point processes

  • Loads the Default Filter policy (defaultfilter)

cpstop -fwflag -proc

  • Shuts down Check Point processes

  • Keeps the currently loaded kernel policy

  • Maintains the Connections table, so that after you run the cpstart command, you do not experience dropped packets because they are "out of state"

Note - Only security rules that do not use user space processes continue to work.