CHECK POINT · BLADES

Check Point-style: turn on blades, and use them

A gateway’s features are blades, and each is turned on per gateway. A rule can only name an application if Application Control is on, or a URL category if URL Filtering is on, and installing one without the other fails. IPS reads what your rules let through.

Check Point-style track · Check Point-style, Buddy Security Console, Cisco router · 4 objectives

Open in simulator More Check Point-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Try this: add rule NO-P2P at the top, source LAN, destination any, service bittorrent, Drop. Publish, and try to install: it fails, and says why.
On GW1: turn on Application Control, URL Filtering and IPS. Publish and install.
Add rule NO-SOCIAL at the top: source LAN, service social, Drop. Set threat profile Optimized on GW1. Publish and install.
From PC1: traffic tcp 198.51.100.1 80 payload "GET / Host: facebook.com", traffic tcp 198.51.100.1 6881 payload "BitTorrent protocol" and traffic tcp 198.51.100.1 80 payload "GET /../../etc/passwd" are stopped. traffic tcp 198.51.100.1 80 payload "GET / Host: www.example.org" arrives.

Start this lab

Before you start

A rule that names an application or a category only matches when it can read them, so it does nothing for a ping. Optimized prevents high and critical threats, and Strict prevents everything this model knows. These are RouteBuddy’s own short teaching lists, and show services names them.

Concept

Change, publish, install

A Check Point-style manager has three steps. A change is private in your session. Publish moves it into the manager’s database. Install Policy verifies it and sends it to a gateway. The gateway runs what was installed, so three places can disagree.

Concept

A port can’t say what a site or an application is

Social networks and ordinary sites all use port 80, and file sharing uses any port. A rule can name an application or a URL instead, and the firewall reads the traffic to find out. Order still matters: such a rule goes above the rule that allows the port, and it does nothing for traffic it can’t read, such as a ping.