Configuring Threat Prevention Settings on VSX Gateways

This section contains the instructions to enable Threat Prevention Software Blades on VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Virtual Systems.

For more information, see sk106496 and sk79700.

Important:

Step

Instructions

1

If applicable, configure proxy settings for the VSX Gateway or VSX Cluster (VS0) or the Virtual Systems (or both) in SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.:

  1. From the left navigation panel, click Gateways & Servers.

  2. Double-click the VSX Gateway or VSX Cluster object (or the applicable Virtual System object).

  3. From the navigation tree, click Topology > Proxy.

  4. Configure the proxy settings.

  5. Click OK

2

Enable the Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. on the VSX Gateway or VSX Cluster (VS0):

  1. Double-click the applicable VSX Gateway or VSX Cluster object.

  2. From the navigation tree, click General Properties.

  3. On the Threat Prevention tab, select any or all of these Software Blades:

    When you enable these Software Blades, the First Time Activation window opens.

    You must select:

    • According to the policy

    • Detect only

  4. From the navigation tree, click and configure the Software Blades you enabled.

  5. Click OK.

3

Enable the Software Blade on the applicable Virtual Systems:

  1. Expand the VSX Gateway or VSX Cluster object and double-click the applicable Virtual System object.

  2. From the navigation tree, click General Properties.

  3. On the Threat Prevention tab, select any or all of these Software Blades

    (the same you selected in the VSX Gateway or VSX Cluster object):

    When you enable these Software Blades, the First Time Activation window opens.

    You must select:

    • According to the policy

    • Detect only

  4. From the navigation tree, click and configure the Software Blades you enabled.

  5. Click OK.

4

Configure the Threat Prevention policies for:

  • The VSX Gateway or VSX Cluster (VS0).

  • The applicable Virtual Systems.

5

Install the default VSX policy on the VSX Gateway or VSX Cluster.

This policy is called:

<Name of VSX Gateway or VSX Cluster Object>_VSX

6

Install the Threat Prevention policy:

  • On the VSX Gateway or VSX Cluster (VS0).

  • On the applicable Virtual Systems (and Access Control Policy, if needed).

Important:

Step

Instructions

1

If applicable, configure proxy settings for the VSX Gateway or VSX Cluster (VS0), or the Virtual Systems (or both) in SmartConsole:

  1. From the left navigation panel, click Gateways & Servers.

  2. Double-click the VSX Gateway or VSX Cluster object (or the applicable Virtual System object).

  3. From the navigation tree, click Topology > Proxy.

  4. Configure the proxy settings.

  5. Click OK

2

Enable Threat Emulation on the applicable Virtual Systems:

  1. Expand the VSX Gateway or VSX Cluster object and double-click the applicable Virtual System object.

  2. From the navigation tree, click General Properties.

  3. On the Threat Prevention tab, select the Threat Emulation Software Blade.

    The Threat Emulation First Time Activation Wizard opens.

  4. Configure the Emulation Location.

  5. In the Summary window, click Finish.

  6. From the navigation tree, click and configure the Software Blades you enabled.

  7. Click OK.

3

Configure the Threat Prevention policies for the applicable Virtual Systems.

4

Install the Threat Prevention policy on the applicable Virtual Systems (and Access Control Policy, if needed).

Important:

Step

Instructions

1

If applicable, configure proxy settings for the VSX Gateway or VSX Cluster (VS0) or the Virtual Systems (or both) in SmartConsole:

  1. From the left navigation panel, click Gateways & Servers.

  2. Double-click the VSX Gateway or VSX Cluster object (or the applicable Virtual System object).

  3. From the navigation tree, click Topology > Proxy.

  4. Configure the proxy settings.

  5. Click OK

2

Enable Threat Extraction on the applicable Virtual Systems:

  1. Expand the VSX Gateway or VSX Cluster object and double-click the applicable Virtual System object.

  2. From the navigation tree, click General Properties.

  3. On the Threat Prevention tab, select the Threat Extraction Software Blade.

    The Threat Extraction First Time Activation Wizard opens.

  4. In the Next Hop Configuration window:

  5. In the Summary window, click Finish.

  6. From the navigation tree, click and configure the Software Blades you enabled.

  7. Click OK.

3

Enable Threat Extraction support for web traffic over the HTTP and HTTPS protocols:

  1. From the left navigation panel, click Security Policies.

  2. In the top section, click Threat Prevention.

  3. In the lower section Custom Policy Tools, click Profiles.

  4. Double-click the applicable profile with enabled Threat Extraction Software Blade.

  5. From the navigation tree, click Threat Extraction > General.

  6. In the Protocol section, select Web (HTTP/HTTPS).

  7. Click OK.

4

Configure the Threat Prevention policies for:

  • The VSX Gateway or VSX Cluster (VS0).

  • The applicable Virtual Systems.

5

Install the default VSX policy on the VSX Gateway or VSX Cluster.

This policy is called:

<Name of VSX Gateway or VSX Cluster Object>_VSX

6

Install the Threat Prevention policy:

  • On the VSX Gateway or VSX Cluster (VS0).

  • On the applicable Virtual Systems (and Access Control Policy, if needed).