Check Point NGX CCSA/CCSE Training Class

1. Security Principles

• Active vs. passive security policy


• Unenforceable policy


• Risk management


• Configuration management


• Packet filters


• Proxy firewalls


• Stateful inspection

2. Check Point FireWall-1 NGX Architecture

• Secure Virtual Network (SVN) foundation
  
  
  
  • Four key elements
  
  
  • Four functional product types
  
  
  • CPShared components
  
  
  
  


• Secure Internal Communications (SIC)
  
  
  
  • Communications between components
  
  
  • Internal Certificate Authority (ICA)
  
  
  • SIC operation
  
  
  • Communications with SmartDashboard
  
  
  
  


• SmartConsole (GUI clients)
  
  
  
  • SmartDashboard
  
  
  • SmartView Tracker
  
  
  • SmartView Monitor
  
  
  • SmartLSM
  
  
  • Smart Update
  
  
  • Eventia Reporter
  
  
  
  


• SmartCenter Server (Management server)


• Security Gateway (Enforcement module)


• VPN-1 and FireWall-1 enforcement module operation
  
  
  
  • INSPECT module
  
  
  • Security servers
  
  
  • Synchronization module
  
  
  
  

3. Installing Check Point FireWall-1 NGX

• Getting ready for a new installation
  
  
  
  • Check Point NGX supported platforms
  
  
  • Check Point NGX minimum hardware requirements
  
  
  • New licenses
  
  
  
  


• The bastion host process
  
  
  
  • Hardening against local attacks
  
  
  • Hardening against network attacks
  
  
  • Hardening the application
  
  
  
  


• Windows installation


• SecurePlatform installation


• UNIX installation


• Nokia installation


• Upgrading to NGX
  
  
  
  • Sequence
  
  
  • Managing previous versions
  
  
  • Minimizing downtime
  
  
  • Backing up a security policy
  
  
  
  


• Uninstalling NGX

4. Getting Started

• SmartDashboard
  
  
  
  • Login screen
  
  
  • Main screen
  
  
  • Objects tree
  
  
  • Creating and managing objects
  
  
  • Rule base
  
  
  • SmartMap
  
  
  
  


• Changing views
  
  
  
  • Viewing implied rules
  
  
  • Editing implied rules
  
  
  
  


• Installing a policy package


• Launching other SmartConsole clients from SmartDashboard

5. General Security Policy and System Management

• Define an enterprise security policy


• Managing a security policy


• Creating a security policy


• Completing the rule base


• Managing a complex rule base
  
  
  
  • Moving rules
  
  
  • Copying rules
  
  
  • Masking rules
  
  
  • Disabling rules
  
  
  • Adding section titles
  
  
  • Using time-based rules
  
  
  • Configuring tracking in the rule base
  
  
  
  


• Command-line interface (CLI)
  
  
  
  • cpstart and cpstop
  
  
  • cprestart
  
  
  • fwstart and fwstop
  
  
  • cplic print-type
  
  
  • fwm load and fwm unload
  
  
  • fw fetch and fw fetchlogs
  
  
  • fw clt pstat and fw clt debug
  
  
  • fw lichosts
  
  
  • fw log
  
  
  • fw logswitch
  
  
  • fwm logexport
  
  
  • fw putkey
  
  
  • fw monitor
  
  
  • fw tab
  
  
  • vpn tu and vpn debug
  
  
  
  

6. SmartView Tracker

• Logging components


• Log mode
  
  
  
  • Viewing records
  
  
  • Record details
  
  
  • Querying
  
  
  • Filtering
  
  
  • Creating custom commands
  
  
  
  


• Active mode
  
  
  
  • Viewing real-time connections
  
  
  • Blocking connections
  
  
  • Unblocking connections
  
  
  
  


• Audit mode


• Log file management
  
  
  
  • Exporting logs
  
  
  • Changing logs (log switch)
  
  
  • Configuring log and alert time settings in Global Properties
  
  
  
  

7. Network Address Translation

• Static NAT
  
  
  
  • How it works
  
  
  • Issues
  
  
  
  


• Dynamic NAT (Hide NAT)
  
  
  
  • How it works
  
  
  • Issues
  
  
  
  


• Configuring NAT
  
  
  
  • Automatic NAT
  
  
  • Manual NAT
  
  
  • Global properties
  
  
  
  

8. Check Point Authentication

• Authentication schemes


• Creating users, groups, and templates


• Installing the users database


• Configuring the user authentication rule
  
  
  
  • Configuring user access
  
  
  • Editing user authentication action properties
  
  
  
  


• Configuring the client authentication rule
  
  
  
  • Editing client authentication action properties
  
  
  • Manual client authentication
  
  
  
  


• Configuring the session authentication rule
  
  
  
  • Editing session authentication action properties
  
  
  • Configuring the session authentication agent
  
  
  
  


• Comparison of NGX authentication methods


• Properties that affect authentication


• LDAP servers
  
  
  
  • Creating the LDAP account unit
  
  
  • Managing the LDAP server from SmartDashboard
  
  
  
  

9. Configuration Management

• Backups


• Database revision control


• Policy package management


• Upgrading to NGX


• Backing up the current configuration


• Upgrading order


• SmartView Monitor
  
  
  
  • o Key features
  
  
  • o Suspicious activity rules
  
  
  
  


• Eventia Reporter
  
  
  
  • Key features
  
  
  • Standard vs. Express Reports
  
  
  
  

10. Threat Management

• SmartDefense
  
  
  
  • Network Security
  
  
  • Application Intelligence
  
  
  
  


• Web Intelligence
  
  
  
  • Malicious code
  
  
  • Application layer
  
  
  • Information disclosure
  
  
  • HTTP protocol inspection
  
  
  
  


• Content security
  
  
  
  • HTTP security servers
  
  
  • SMTP security servers
  
  
  • FTP security servers
  
  
  • CVP servers
  
  
  • UFP servers
  
  
  
  

11. Voice over IP (VoIP)

• VoIP Basics
  
  
  
  • VoIP protocols supported by NGX
  
  
  • VoIP handover
  
  
  • Control signaling and media connections
  
  
  • VoIP logging
  
  
  
  


• Configuring for H.323
  
  
  
  • H.323 architecture elements
  
  
  • H.323 protocols
  
  
  • Routing modes in H.323
  
  
  • H.323 services in N

Network engineers, security administrators, security analysts, systems
administrators, and anyon