Check Point UTM

 UTM (Unified Threat Management) solution deployed at the gateway level and scans all the malicious and suspicious traffic which passes through the network. UTM has multiple parameters such as

• URL Filtering
• Application Control
• Intrusion Prevention System
• Antivirus & Anti-Bot
• Data Loss Prevention

Let’s discuss all the features one-by-one.

URL Filtering: Check Point UTM

URL filtering applies to web-browsing traffic and divides traffic to multiple categories. Based on URL-Filtering Category we can allow/block traffic in Firewall policy. There are more than 100 Categories which are given by Checkpoint in the URL=Filtering like social-networking, banking, adult-sites, news etc.

TASK -> We will block CNN.COM News site by using URL Filtering

• Here we will first enable URL Filtering Blade in Checkpoint Firewall.

• Enable HTTPS Inspection in Checkpoint Firewall to inspect Web-browsing traffic.

• First Create Policy to allow news site in policy
• Security Policy -> URL+APP -> Policy Name -> Source Address -> Destination ->Services and Applications (Select News/Media) -> Action (Allow)

• Now Create another Policy above Access policy to deny rule for CNN.COM news
• Policy (Block CNN) -> Source -> Destination –
  > Services & Application –>(Create Customised Category CNN.COM) -> Action (Drop)

• Verify the access through logs -> Traffic dropped by firewall.

Application Control: Check Point UTM

Here, we will block sites based on Application.

Application control, identify and parse traffic uniquely from various applications in an organisation, Companies enable Application Control to filter malicious traffic and block all the suspicious content of the network. 

1. Security Policies🡪 URL + APP🡪 Source 🡪 Destination🡪 Services & Application (Select Application)

2. Select multiple applications like

• • Spyware

• • High Risk

• • Phishing

• • Bonnets

3. Action🡪 Drop

4. Install Policy

Validate the access from logs

Try to access drpbox.com and got below drop logs in Check point

IPS Intrusion Prevention System: Check Point UTM

IPS is the most effective and multilayer approach to protect your network. It tremendously reduces the risk of traffic exposure to exploitation.

1. Note -> Enable IPS Blade in Checkpoint Firewall

2. We have two options

• • Threat Prevention Policy
  • Detect Only

Select Threat Prevention Policy

3. Now Enable Policy to Activate IPS Profile in it

4. Go to -> Threat Protectionà Policy

5. We have two policy here , one is for MTA traffic

6. Second one is the default policy for IPS

7. Go down to Threat Tools 🡪 profiles🡪 Create Test Strict Clone (Customised) Profile

8. Apply Strict Clone Profile to Threat Prevention Policy

9. Install Policy in Checkpoint SmartConsole

10. Validate the logs

11. Go to 🡪 IPS Protection

12. Select Max Ping Size and add Strict Clone Profile in it.

13. If the Ping size is greater than 2500 bytes, signature will be triggered. Now install the policy in Checkpoint SmartConsole.

14. IPS allows normal ping from network, however blocks large packet through the firewall and gives Request Time Out in ping response.

15. Let’s Check Logs for the same in Firewall. Traffic is being dropped by a firewall with a message large ping.

Antivirus: Check Point UTM

Antivirus software is a firewall application that protects systems and removes harmful software or code which are created to damage data. Nowaday’s every second a new malware is created to destroy the network. So to detect and block such traffic in network Checkpoint uses advance Anti-virus and Anti-bot Application which blocks any suspicious traffic/content

1. Enable Anti-virus and Anti-bot Blade in the Checkpoint and Install the policy.

2. Go to Profiles which we have created above (in IPS section) and Check Anti-virus and Anti-Bot settings.

3. Now test your browser protect by using https://cpcheck.com to verify if the browser is protected or not and which services is being used.

4. Try to access any site and download content from there.

5. Now check the logs here in Checkpoint Log Monitor and you can see preventive log messages in the threat logs of the firewall. You can see the Checkpoint assessment report also.

Checkpoint UTM DLP (Data Loss Prevention) – R80.40

DLP is the part of Security Integrity which means if any data passes through the network it should be un-altered. And must be scanned by Firewall, like password protected files or any text document through emails.

Data Loss Prevention (DLP) solutions are designed to guarantee that any insightful data in a company/network must not be accessed by illegal/unprotected users, nor misplaced or stolen.

1. We need to enable DLP in Firewall Gateway by using SmartConsole

2. Enable DLP Client in below settings as well

3. Enable Email to transfer DLP emails 

4. Enable DLP over SmarttDashboard Security Policies 🡪 Shared Policies🡪 DLP

5. Here is SmartConsole trying to Connect with SmartDashboard

6. Select All  users in DLP🡪 Organisations Policy

7. Enable DLP Policy for Password Protected Files

8. Now we are trying to transfer file over FTP protocol which is password protected

9. Now check the firewall logs if firewall able to detect the file

DLP works as we have configured in the above policy.

Checkpoint Firewall Policy

 A firewall policy outlines the way an organization’s firewalls should handle the traffic that comes into and out of the specified IP addresses and address ranges, protocols, applications and content types governed by the organization’s security policies. Organizations should carry out a risk assessment to come up with a list of the types of traffic they need and how to secure them, such as which types of traffic can be allowed to pass through the firewall under certain conditions.

Checkpoint has multiple types of security policy to allow or Deny traffic from source to destination. 

Types of Rules in a Firewall

1. Implicit Rules – Default rules allowed/deny by firewall. For example, any-any traffic is by default dropped by all firewalls. It’s a general behaviour of a firewall. These rules are not visible in the security policy dashboard.
2. Explicit Rule – The rule which are created/configured by admin in firewall. 
3. Stealth Rule – It stops or denied access of any user to connect with Security Gateway
4. Cleanup Rule – Rules which are created to deal with unmatched traffic.

Moreover, make sure you understand the order of the rule enforcement to maximise the security of the firewall.

The firewall always enforces the first rule that matches a connection. It cannot enforce the last rule that can be more applicable.

The Order of Policy is:

• First Implied Rule – You cannot delete or edit rule and no explicit rules can be replaced before it. Implied Rule means which are already available in firewall by-default.
• Explicit Rule – These are rules that you create
• Before Last Implied Rule – These implied Rules are applied before the last explicit rule.
• Last Explicit Rule – We recommend that you use the Cleanup rule as the last explicit rule.

Let’s discuss the best practices to create Security Policy in Checkpoint Firewall.

Checkpoint Firewall Policy: Management Rule

Management Rule means policy allows access to specific IP addresses to take SSH/HTTPs access to Checkpoint Gateway.

1 Go to Left Most Tab -> Select Rule -> Add Rule ->Select Top

2 Give Name to the Security Policy -> Management_Rule ( As policy Created for Management Access )

3 Now Add Source Address by Clicking + sign in Source Address Tab and similarly add Destination address in Policy.

Here, we have selected Source Address -> 10.0.0.99 (Any Client Machine)

Destination Address -> Gateway IP address of the Firewall 

4 Add List of Services like SSH, HTTPS & HTTP in the Security Policy by clicking + sign on right most corner of the Service Tab.

5 Add Action -> Accept from the + of Action tab

6 Add Track -> Log, every traffic generated by Client access will be logged

7 Install the Policy.

Checkpoint Firewall Policy: Deny Rule | Stealth Rule

Here we will deny access to unauthorised users for Management Gateway.

1 Add new Rule below Management_Rule

2 In this rule we will use below values to stop access to unauthorised access

Rule name -> Stealth Rule

Source Address -> Any

Destination Address -> GWMGMT

Service -> Any

Action -> Drop

Checkpoint Firewall Policy: Internet Access

In this policy we will allow users to access Internet from Inside network

 

1. Add Policy Name-> Internet Rule
2. Add Source Address/Network -> Inside_hosts-> 192.168.1.0/24
3. Destination Address -> Any (Internet)
4. Service -> Internet Ports which are HTTP (port 80) and HTTPs (port 443)
5. Action -> Accept

Checkpoint Firewall Policy: Allow Specific Port

Here we will allow access to specific ports.

1. Source Address is any user machine-> Cli02
2. Destination Address -> RDP_Host-> Server
3. Service -> RDP
4. Action->Accept 

Checkpoint Firewall Policy: Inside to DMZ

To allow access from Inside network to DMZ network below policy will be used.

1. Policy Name ->Inside_to_DMZ_Access
2. Source -> Any source IP which needs to be access DMZ network
3. Destination Address -> DMZ_Network
4. Service -> DNS and Https
5. Action -> Accept

Checkpoint Firewall Policy: Cleanup Rule

Last Rule is a cleanup rule in which we deny all other traffic and apply it at the BOTTOM of all the firewall rules.

1. 1. Rule Location -> Bottom
   2. Rule Name -> Cleanup_Rule
   3. Source -> Any
   4. Destination -> Any
   5. Service -> Any
   6. Action -> Drop

Checkpoint Firewall Policy: Install Policy

Once all rules are configured, it’s time to install policy on the Gateways.

Select -> Install Policy

Once you select Install Policy it will prompt Gateway options 

Select Firewall Gateway -> Click OK

Installation done