Advanced Settings

Aggressive Aging helps manage the connections table capacity and memory consumption of the firewall to increase durability and stability.

Aggressive Aging introduces a new set of short timeouts called aggressive timeouts. When a connection is idle for more than its aggressive timeout it is marked as "eligible for deletion". When the connections table or memory consumption reaches the user defined threshold, Aggressive Aging begins to delete "eligible for deletion" connections, until memory consumption or connections capacity decreases back to the desired level.

Aggressive Aging allows the gateway machine to handle large amounts of unexpected traffic, especially during a Denial of Service attack.

If the defined threshold is exceeded, each incoming connection triggers the deletion of ten connections from the "eligible for deletion" list. An additional ten connections are deleted with every new connection until the memory consumption or the connections capacity falls below the enforcement limit. If there are no "eligible for deletion" connections, no connections are deleted at that time, but the list is checked after each subsequent connection that exceeds the threshold.

Timeout settings are a key factor in memory consumption configuration. When timeout values are low, connections are deleted faster from the table, enabling the firewall to handle more connections concurrently. When memory consumption exceeds its threshold, it is best to work with shorter timeouts that can maintain the connectivity of the vast majority of the traffic.

The major benefit of Aggressive Aging is that it starts to operate when the machine still has available memory and the connections table is not entirely full. This way, it reduces the chances of connectivity problems that might have occurred under low-resource conditions.

Mode for Anti ARP spoofing protection. The protection can be turned off, on, or in detect only mode.

The number of IP addresses assigned to the same MAC address during the Detection window time that will an indicate an ARP spoofing attack.

Tracking options for emails that are not considered spam or suspected spam. Tracking such emails can have a performance impact.

Indicates the timeout (in seconds) to wait for an answer from the cloud during content-based Anti-Spam inspection.

Indicates the action to take upon an internal error during Anti-Spam IP reputation test.

Scan the content of emails which are sent from the local network to the Internet.

Indicates if web requests are blocked when the Check Point categorization and widget definitions Online Web Service is unavailable.

Indicates whether custom URLs and applications will be matched over HTTPS traffic using SNI field. Important note: as SNI field in HTTPS traffic is browser-dependent and promiscuous, it does not guarantee 100% match.

Indicates the action to take on traffic in case of an internal system error or overload.

Indicates if the HTTP "referrer" header (originally a misspelling of referrer) is used by the inspection engine to improved application identification.

Indicates the size of the connections hash table in bytes.

This value must be an integer that is an exponential power of two and approximately four times the maximum concurrent connections parameter.

Indicates the maximum number of retries when failing to upgrade using the service.

Indicates if synchronization mechanism is enabled.

Switching the flag from false to true may cause failover.

Default: false

Supports ITU G.993.2 VDSL2.

Supports ITU G.992.2 ADSL Lite (G.lite).

Supports ITU G.992.5 Annex M ADSL2+M.

In an Annex A appliance: Combined with supported ADSL2+, it specifies Annex M ADSL2+. In an Annex B appliance: Combined with supported ADSL2, it specifies Annex J ADSL2.

Supports VDSL Profile 8a.

Supports VDSL Profile 8c.

Supports VDSL Profile 12a.

Supports VDSL Profile 17a.

Enhanced Impulse Noise Protection.

Action for blocked packets: Drop, reject or automatic (drop from external and reject from internal).

Controls the size (in MB) of the general temporary directory.

Select Disabled to disable the hotspot feature entirely.

Enable/Disable IP Resolving logs enrichment.

Indicates the maximal ping packet size that are allowed when the 'Max Ping Size' protection is active.

Normally, the IPS engine blocks protocols (e.g. POP3, IMAP, ...) commands that it does not recognize.

When the advanced setting is set to "true", IPS allows the traffic.

Some web based protections can show an error page upon detection. This error page is configurable.

The protections that support the error page:

• Malicious Code protector

• Cross-Site Scripting

• LDAP Injection

• SQL Injection

• Command Injection

• Directory Traversal

• Directory Listing

• Error Concealment

• HTTP Format Sizes

• ASCII Only Request

• ASCII Only Response Headers

• HTTP Methods

Select one of these options that applies to all such protections:

• Do not show

• Show pre-defined HTML error page - You can configure an HTML page that opens when an attack is detected. To configure the page, go to Advanced Settings > IPS engine settings > HTML error page configuration.

• Redirect to another URL - Enter a URL to which users are redirected when an attack is detected. You can also select to add an error code that provides more information about the detected attack. This is not recommended because the information can be misused by an attacker.

Indicates whether Sierra type USB modems will be reset when they send an invalid LSI signal

MAC filtering state

Indicates if an administrator can access the appliance from a remote Security Management Server without the need to enter an administrator user name and password.

Cloud server URL used for sending mobile notifications.

Indicates, when automatic ARP detection is enabled, to use the ARP definitions in a local file with higher priority. Manual proxy ARP configuration is required for manual Static NAT rules. If a manual ARP configuration is defined in the local.arp file and Automatic ARP configuration is enabled, both definitions are maintained. If there is a conflict between the definitions (the same NAT IP address appears in both), then the manual configuration is used.

When internal devices in the local network are defined using static NAT, the appliance must make sure packets to the static NAT IP address reach it. This option enables the appliance to automatically respond to ARP requests for those IP addresses.

Indicates if the device's NAT capabilities are enabled.

Indicates the maximum number of NAT cache entries.

Indicates the maximum number of connections with NAT.

Translates destination IP addresses on client side (for automatically generated NAT rules).

Notification language

tmpDirSize

Set IPv6 prefix selection mode in dynamic IPv6 internet connections. Select the IPv6 prefix with the highest preference. If there is more than one prefix with the same preference, select based on these options:

• Router preference - oldest. Select the oldest prefix unless its remaining lifetime is less than one hour. (Default)

• Router preference - newest. Select the newest prefix.

• Preferred lifetime - oldest. Select the prefix with the oldest preferred lifetime.

• Preferred lifetime - newest. Select the prefix with the newest preferred lifetime.

Specifies whether transfer of DHCP options from WAN to LAN is disabled.

Type: Boolean

Default: false

Specifies whether WiFi monitors are on.

Type: Boolean

Default: false

Specifies whether PPP0E destination check is enabled.

Type: Boolean

Default: false

Customer consent

Indicates if the SSL certificate should be ignored when running the access service.

Maximum period to collect and monitor data. You must reboot the appliance to apply changes.

Indicates whether to accel only trusted HTTPS domains.

Additional HTTPS ports for SSL inspection (a comma separated list of ports/ranges).

Indicates if the SSL inspection mechanism will perform its validations on all intermediate CA certificates in the certificate chain.

Indicates if the SSL inspection mechanism will drop connections that present a revoked certificate.

Indicates if the SSL inspection mechanism will drop connections that present a certificate with an unreachable CRL.

Indicates if TCP packets which are not consistent with the current state of the TCP connection are dropped (when set to 0) or accepted (when set to any other value).

Accept ICMP reply packets for ICMP requests that were accepted by the Rule Base.

Accept stateful other IP protocols replies for unknown services. In each service object it is possible to configure whether replies for it are accepted if the service is matched on a rule which accepts traffic. This parameter refers to all no TCP/UDP connections which are not covered by the service objects.

Allow Deep Packet Inspection in traffic between internal networks.

An ICMP virtual session is considered to have timed out after this time period (in seconds).

Indicates if dropped out of state TCP packets generate a log. See the "Accept out of state TCP packets" parameter.

Indicates the timeout (in seconds) for TCP session end. A TCP session is considered as "ended" following two FIN packets, one in each direction, or an RST packet.

Indicates the timeout (in seconds) for TCP session start. A TCP connection times out if the interval between the arrival of the first packet and establishment of the connection (TCP three-way handshake) exceeds this time period (in seconds).

These settings determine how the TCP streaming engine used by the various deep inspection blades (IPS, Application Control Check Point Software Blade on a Security Gateway that allows granular control over specific web-enabled applications by using deep packet inspection. Acronym: APPI., Anti-Bot Check Point Software Blade on a Security Gateway that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT., Anti-Virus Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV., etc.) handles protocol violations and events that prevent the streaming engine from further inspection.

We highly recommend that these settings always be in prevent mode. Using these settings in detect mode may significantly lower security as inspection stops when the event or violation occurs.

When the configuration is set to log such events, the logs are shown in Logs & Monitoring > Security Logs under the IPS blade.

For each violation or event configure the action and tracking mode.

The receiving host of a TCP stream buffers segments and retains only those segments within a specified window. Segments outside this window are not processed by the receiving host. TCP segments which are outside the TCP receiving window should not be processed by the gateway. All data from TCP segments that are outside of the window is either dropped or removed. If the segment is near the window, data is stripped. If the segment is far from the window, the segment is dropped.

The gateway does not need to inspect packets with an invalid TCP checksum because these packets are dropped by the receiving host's TCP stack. This blocks TCP packets with an invalid checksum. Due to malfunctioning networking equipment, it is normal to see some packets with an incorrect checksum on the network. This does not indicate an attempted attack and for this reason, the default is to NOT log such events.

Some TCP protocols, such as Telnet, send out-of-band data using the TCP URG bit as part of the protocol syntax, whereas most protocols don't use the TCP out-of-band functionality. Allowing packets with the URG bit may prevent the gateway from determining what data would be processed by the receiving application. This could lead to a situation where the data inspected by the gateway is not what the receiving application processes, thus allowing IPS protections to be bypassed. When a packet with the URG bit is received in a protocol that does not support out-of-band functionality, the gateway cannot determine whether the receiving application processes the data. This removes the URG bit from TCP segments with the URG bit set in protocols which do not support the TCP out-of-band functionality. When set to detect, usage of the URG bit causes the traffic to bypass deep inspection blades.

Indicates the size limit (in KB) of a file scanned by Anti-Virus engine. To specify no limit, set to 0.

If there are more nested levels of MIME content than the configured amount, select to Block or Allow the email file.

Indicates the strictness mode of the Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. engine over IMAP:

• Background - Connections are allowed while the file emulation runs (if needed) until emulation handling is complete.

• Hold - Connections are blocked until the file emulation is completed

Indicates the strictness mode of the Threat Emulation engine over SMTP:

• Background - Connections are allowed while the file emulation runs (if needed)

• Hold - Connections are blocked until the file emulation is completed.

Block web requests traffic when the Check Point ThreatCloud online web service is unavailable.

Indicates the size limit (in KB) of a file inspected by Threat Prevention engines.

Update Threat Prevention with the most up to date packages.

Indicates how often (in minutes) the USB modem watchdog probes the internet.

Indicates the maximum number of retries for a single update when the cloud is unavailable

Indicates the timeout (in minutes) for caching an association between a user and an IP address.

When Active Directory Queries is enabled in Users & Objects > User Awareness the parameter indicates that only one user can be identified from a single device. When two or more users connect from a device, only the last user to log on is identified.

Indicates if traffic to the VPN domain is handled when the Remote Access VPN An encrypted tunnel between remote access clients (such as Endpoint Security VPN) and a Security Gateway. client is not connected to the site is sent without encryption (clear) or dropped.

Indicates the amount of time (in minutes) the remote client's password remains valid if timeout is enabled.

Indicates if the client disconnects automatically to save resources when it connects from inside the secured internal network (local encryption domain).

Indicates the interval (in seconds) between keep-alive packets to the gateway required for gateway to client back connections.

Indicates if DNS queries sent by the remote client to a DNS server located in the encryption domain are passed through the VPN tunnel.

Indicates the time (in minutes) until the Endpoint Connect user's credentials are resent to the gateway to verify authorization.

Enables support of IKE over TCP.

Indicates if the Check Point proprietary NAT traversal mechanism (UDP encapsulation) is enabled for SecureClient.

Indicates the minimum TLS protocol version which the SSL VPN portal supports. For security reasons, we recommend to support TLS 1.2 and above.

• Office Mode Perform Anti-Spoofing - If this option is selected, VPN verifies that packets whose encapsulated IP address is an Office Mode IP address are indeed coming from an address of a client working in Office Mode. If the addresses are allocated by a DHCP server, VPN must know the range of allocated addresses from the DHCP scope for the Anti-Spoofing feature to work. Define a Network object that represents the DHCP scope and select it here.

• Single Office Mode Per Site - After a remote user connects and receives an Office Mode IP address from a gateway, every connection to that gateways encryption domain goes out with the Office Mode IP as the internal source IP. The Office Mode IP is what hosts in the encryption domain recognize as the remote user's IP address. The Office Mode IP address assigned by a specific gateway can be used in its own encryption domain and in neighboring encryption domains as well. The neighboring encryption domains should reside behind gateways that are members of the same VPN community as the assigning gateway. As the remote hosts connections are dependent on the Office Mode IP address it received, should the gateway that issued the IP become unavailable, all the connections to the site terminate.

Indicates if Office Mode (allocating IP addresses for Remote Access clients) is disabled. This is not recommended.

Prevent IP Pool NAT configuration from being applied to Office Mode users. This is needed when using SecureClient as well as other VPN clients (see sk20251).

The default remote access port is port 443. If there is a conflict with another server using this port number, configure a different Remote access port. You must change the default remote access port if the Check Point VPN client, Mobile client, or SSL VPN remote access methods are enabled as they use port 443 by default. If you change the default port number 443, make sure to select Reserve port 443 for port forwarding.

Indicates the time (in minutes) between re-authentication of SSL Network Extender remote access users.

Indicates if the RC4 encryption algorithm is supported in SSL clients as well as the default algorithms.

This parameter lets you configure under which conditions the SSL Network Extender client installs itself. The options are: Do not upgrade automatically, always upgrade, and ask the user (default).

Indicates if the configured topology updates settings override the default 'once a week' policy.

1. Select or clear the checkbox:

   • Cleared - The appliance sends the OTP by SMS and by Email (this is the default).

   • Selected - After an end-user clicks "Connect" in their Remote Access VPN client, in the next window the end-user must enter a mobile phone number to get the OTP by SMS, or enter an email to get the OTP by Email.

2. Click Apply.

Indicates if industry standard NAT traversal (UDP encapsulation) is enabled. This enables VPN tunnel establishment even when the remote site is behind a NAT device.

Indicated whether to check the validity of IPSec reply packets.

Copy DiffServ mark from encrypted/decrypted IPSec packet.

DPD triggers new IKE negotiation.

Delete IPsec SAs on IKE SA delete.

Packets whose original source or destination IP address is the local gateway's Internet Connection IP address will not go through a VPN tunnel. This parameter may be useful when the gateway behind hide NAT.

Indicates if encrypted packets are rerouted through the best interface according to the peer's IP address or probing. We do not recommend to change this value to false.

CRL grace period is required to resolve the issue of differing clock times between the appliance and the remote CA.

A grace period permits a wider window for CRL validity.

Indicates the time window (in seconds) where a certificate is considered valid prior to the time set by the CA.

Indicates if the IKE DoS from unidentified IP addresses protection is active and the method by which it detects potential attackers.

Key type used for IKEV2 communication.

Options:

• Key ID (default)

• IP Address

• FQDN - Select to support IKEv2 with key type FQDN. This lets you set up a VPN connection with Harmony Connect.

  For more information on how to set up this connection, see the Harmony Connect Administration Guide and the Harmony Connect for SMB Gateways Integration Guide.

Indicates if the "Don't Fragment" flag is kept on the packet during encryption/decryption.

Indicates how to log VPN configuration errors or key exchange errors.

Indicates the maximum number of concurrent VPN IKE negotiations.

Indicates the maximum number of open SAs per VPN peer.

Select this option to prevent administrator access to this appliance from being routed to the remote site even when the "Route all traffic to remote VPN site" is configured.

A Tunnel Test makes sure that the VPN tunnel between peer VPN Gateways is up.

By default, the test is done by making sure there is a connection between all the external IP addresses of the peer VPN Gateways.

You can configure this option to do the tunnel tests using the internal IP addresses of the Gateways that are part of the local encryption domain.

You can see the status of the VPN tunnel in the Logs and Monitoring tab.

Indicates how to log when the tunnel is up: Log, don't log, or alert.

When tunnel is initiated from remote site, reply from the same incoming interface when applicable (IKE and RDP sessions).

Indicates if IKE is performed using cluster IP address (when applicable).

Indicates if deep inspection over MGCP traffic automatically accepts MGCP connections to registered ports.