http://www.techexams.net/technotes/networkplus/osimodel.shtml
Monday, January 16, 2012
Friday, September 9, 2011
Creating a basic Route Based VPN between 2 Check Point Firewalls
Within this example we will build a Route Based VPN between 2 SPLAT R65 NGX Check Point Firewalls. Static Routes will used to direct the traffic via the VPN Tunnel Interfaces.
In this example both Firewalls are managed by the same manager. The gateways are :
Site A - External 192.168.1.1 Inside 10.1.1.1
Site B - External 192.168.2.1 Inside 10.1.2.1
In order to build a route based vpn we need to create VPN Tunnel Interfaces. A VPN Tunnel Interface is a virtual interface on a VPN-1 module, which is associated with an existing VPN tunnel, and is used by IP routing as a point to point interface directly connected to a VPN peer gateway.
Virtual Tunnel Interfaces (VTI's)
VTIs can be created only on SPLAT and IPSO (3.9 or above). Though you can only create numbered VTIs within SPLAT. A numbered tunnel interface has a unique IP address assigned to it, while an unnumbered tunnel interface does not.
In order to create VTI`s you will need to ensure you are running SPLAT Pro. And that the Dynamic Routing feature is enabled. You will also need the nessecary license for this feature.
Steps
Create Object
Create a Group Object called Empty containing no objects within SmartDashboard
Site A
Create the VTI by running the command on Site A's CLI :
1.
vpn shell i a n 22.22.22.1 22.22.22.2 SiteB
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
Site B
Create the VTI by running the command on Site B's CLI :
1.
vpn shell i a n 22.22.22.2 22.22.22.1 SiteA
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
General
Create a new Meshed Site-2-Site Community within the VPN Community Tab.
Under General select Accept All Encrypted Traffic
Under Paricitpating Gateways add both Site A and Site B.
Push the Policy to both gateways.
Add Static Routes
On Site A add the following commands via the CLI :
1.
route add -net 10.1.1.0 netmask 255.255.255.0 dev vt-SiteB ; route --save
On Site B add the following commands via the CLI :
view sourceprint?
1.
route add -net 10.1.2.0 netmask 255.255.255.0 dev vt-SiteA ; route --save
In this example both Firewalls are managed by the same manager. The gateways are :
Site A - External 192.168.1.1 Inside 10.1.1.1
Site B - External 192.168.2.1 Inside 10.1.2.1
In order to build a route based vpn we need to create VPN Tunnel Interfaces. A VPN Tunnel Interface is a virtual interface on a VPN-1 module, which is associated with an existing VPN tunnel, and is used by IP routing as a point to point interface directly connected to a VPN peer gateway.
Virtual Tunnel Interfaces (VTI's)
VTIs can be created only on SPLAT and IPSO (3.9 or above). Though you can only create numbered VTIs within SPLAT. A numbered tunnel interface has a unique IP address assigned to it, while an unnumbered tunnel interface does not.
In order to create VTI`s you will need to ensure you are running SPLAT Pro. And that the Dynamic Routing feature is enabled. You will also need the nessecary license for this feature.
Steps
Create Object
Create a Group Object called Empty containing no objects within SmartDashboard
Site A
Create the VTI by running the command on Site A's CLI :
1.
vpn shell i a n 22.22.22.1 22.22.22.2 SiteB
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
Site B
Create the VTI by running the command on Site B's CLI :
1.
vpn shell i a n 22.22.22.2 22.22.22.1 SiteA
Within the Gateway Object under Topology add you Object named Empty as your VPN Domain.
Within the Gateway Object under Topology use the "Get" icon to retrive your new VPN Tunnel Interface (VTI).
General
Create a new Meshed Site-2-Site Community within the VPN Community Tab.
Under General select Accept All Encrypted Traffic
Under Paricitpating Gateways add both Site A and Site B.
Push the Policy to both gateways.
Add Static Routes
On Site A add the following commands via the CLI :
1.
route add -net 10.1.1.0 netmask 255.255.255.0 dev vt-SiteB ; route --save
On Site B add the following commands via the CLI :
view sourceprint?
1.
route add -net 10.1.2.0 netmask 255.255.255.0 dev vt-SiteA ; route --save
Tuesday, June 28, 2011
Check Point Authentication Methods
Authentication feature of checkpoint ensures the users trying to access resources in your network are actually authorized to do so.With this feature instead of simply allowing a client access a device, the administrator can request the client to authenticate first before permitting access.
Checkpoint supports the following three types of authentication methods:
Checkpoint User Authentication:
In this type of authentication, for every traffic that passes through the firewall, the client user needs to first authenticate.
This ensures that only valid authenticated users only are able to access the destination resources. The limitation is user authentication
only supports Telnet, HTTP, FTP and RLOGIN attempts.
Checkpoint Client Authentication:
In this type of authentication, the user needs to first telnet to the firewall on port 259 or http to port 900, once the user is authenticated the client IP is then permitted. The advantage of using client authentication over user authentication is that in this case all the protocols are permitted. The disadvantage is that its less secure since its based on client IP.
Checkpoint Session Authentication:
In this type of authentication, a session agent is installed on client machine, this agent communicates with the firewall on port 261 for user authentication. The advantage of using this authentication is that it works for all protocols, the disadvantage over the earlier types is that the session agent needs to be installed on every client which in turn leads to more support overhead.
The placement of authentication rules is also critical, make sure the authentication rule is placed above the stealth rule since the client needs to authenticate against the firewall.
Checkpoint supports the following three types of authentication methods:
Checkpoint User Authentication:
In this type of authentication, for every traffic that passes through the firewall, the client user needs to first authenticate.
This ensures that only valid authenticated users only are able to access the destination resources. The limitation is user authentication
only supports Telnet, HTTP, FTP and RLOGIN attempts.
Checkpoint Client Authentication:
In this type of authentication, the user needs to first telnet to the firewall on port 259 or http to port 900, once the user is authenticated the client IP is then permitted. The advantage of using client authentication over user authentication is that in this case all the protocols are permitted. The disadvantage is that its less secure since its based on client IP.
Checkpoint Session Authentication:
In this type of authentication, a session agent is installed on client machine, this agent communicates with the firewall on port 261 for user authentication. The advantage of using this authentication is that it works for all protocols, the disadvantage over the earlier types is that the session agent needs to be installed on every client which in turn leads to more support overhead.
The placement of authentication rules is also critical, make sure the authentication rule is placed above the stealth rule since the client needs to authenticate against the firewall.
Friday, June 24, 2011
XOSL Installation
How to Install XOSL .
Installation:
1. Boot the system with Xosl cd.
2.To create partitions for Xosl and windows operating system use pqmagic tool
3. Navigate to pqmagic folder and run pqmagic
4. Using pqmagic GUI screen create a fat32 partition and make its status to none and create another NTFS partition for server operating system, make its status to none. Reboot the system.
5. Load the system with Xosl CD, copy the Xosl folder from cd to Xosl partition. i.e. C:\ Xosl
6. Run the Xosl tool from c:\xosl folder
7. Select install on dos partition option and run Xosl tool, after installing copy system files from a:\ to c:\ using a command A:\sys C:
8. Reboot the pc with Xosl cd.
9. Open pqmagic tool and make Xosl partition to none. Make server operating system to Active and save and exit.
10. Install server operating system.
11. Load the pc again with Xosl cd and restore the Xosl software by selecting dos partition as installation partition.then A:\ sys c:
12. Login to server operating system and make Xosl partition as active.(Not compulsary)
Installation:
1. Boot the system with Xosl cd.
2.To create partitions for Xosl and windows operating system use pqmagic tool
3. Navigate to pqmagic folder and run pqmagic
4. Using pqmagic GUI screen create a fat32 partition and make its status to none and create another NTFS partition for server operating system, make its status to none. Reboot the system.
5. Load the system with Xosl CD, copy the Xosl folder from cd to Xosl partition. i.e. C:\ Xosl
6. Run the Xosl tool from c:\xosl folder
7. Select install on dos partition option and run Xosl tool, after installing copy system files from a:\ to c:\ using a command A:\sys C:
8. Reboot the pc with Xosl cd.
9. Open pqmagic tool and make Xosl partition to none. Make server operating system to Active and save and exit.
10. Install server operating system.
11. Load the pc again with Xosl cd and restore the Xosl software by selecting dos partition as installation partition.then A:\ sys c:
12. Login to server operating system and make Xosl partition as active.(Not compulsary)
Thursday, June 16, 2011
Setting up the ICA Management Tool
Print Email
Setting up the ICA Management Tool
Solution ID: sk30501
Product: Security Gateway, Security Management
Version: NG AI R54, NG AI R55
Last Modified: 25-Dec-2008
Did this solution solve your problem?
[Click on the stars to rate]
SOLUTION
Overview of Procedures:
====================
- Setting up the ICA Management Tool connection (creating a Certificate user)
- Enabling the ICA Management Tool on the SmartCenter Server
- Importing the user Certificate to the Client
- Accessing the ICA Management Tool
PROCEDURES:
===========
Setting up ICA Management Tool Connection:
-----------------------------------------------------
1) Log into SmartDashboard, and select Manage > Users and Administrators.
2) In the Users and Administrators dialog box, select New > User by Template > Default.
3) in the User Properties dialog box > General tab, enter the user login name (e.g., John_Smith) in the Login Name field.
4) Select the Personal tab, and verify the Expiration Date is set to a valid future date (e.g., 31-dec-2008).
5) Select the Certificates tab, and click the Generate and save button.
NOTE:
A dialog box with the following message will be displayed:
Check Point SmartDashboard
The generation of the certificate for the user cannot be undone, unless you click Revoke.
Ok to continue?
6) Click OK.
7) In the Enter Password dialog box, enter the desired user password in the Password field.
8) Confirm the user password.
9) Click OK.
10) In the dialog box Save Certificate File As, select the desired location to save the Certificate file.
11) Verify the user login name (e.g., John_Smith) is displayed in the File name field.
12) Verify that "Certificate Files (*.p12)" is selected in the Save as type drop-down list.
13) Click Save.
14) On the Certificates tab, observe the information in the DN field, which should look something like this:
CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo15) Click OK in the User Properties dialog box.
16) Click Close in the Users and Administrators dialog box.
17) Select File > Save.
18) Transfer the *.p12 file (e.g. (e.g., John_Smith.p12) to the Client that is connecting to the ICA Management Tool.
NOTE:
The *.p12 file is in the directory designated in step 10.
Enabling the ICA Management Tool on the SmartCenter Server:
--------------------------------------------------------------------------
1. On the SmartCenter Server, type at prompt:
cpca_client set_mgmt_tool on -a "CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo"
NOTE 1:
The following message will be displayed before the command prompt returns:
Successfully set the management tool.
The authorized administrators:
(
: ("CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo")
)
The authorized users:
()
Note 2:
Once the ICA Management Tool is started, the SmartCenter Server will be listening on TCP port 18265 (FW1_ica_mgmt_tools service).Importing the user Certificate to the Client:
-------------------------------------------------
1) Open Internet Options from the Windows Control Panel.
2) In the Internet Options dialog box, select the Content tab.
3) On the Content tab, click the Certificates button.
4) In the Certificates dialog box, select the Personal tab.
5) Click the Import button.
6) Click Next on the Welcome to the Certificate Import Wizard dialog box.
7) In the File to Import Window, browse to the the location of the *.p12 (e.g., John_Smith.p12) file.
8) In the Open dialog box, verify that "Personal Information Exchange (*.pfx,*.p12)" is selected in the Files of type drop-down list.
9) Select the file *.p12 in the window.
10) Click the Open button.
11) In the File to Import dialog box, click Next.
12) In the Password dialog box, enter the user Certificate password in the Password field.
NOTE: Clear the following two boxes:
Enable strong private key protection. You will be
prompted every time the private key is used by an
application if you enable this option.
Mark the private key as exportable
13) Click Next.
14) In the Certificate Store dialog box, verify that "Automatically select the certificate store based on the type of certificate" is selected.
15) Click Next.
16) In the Completing the Certificate Import Wizard dialog box, click Finish.
NOTE:
A message similar to the following will be displayed:
Root Certificate Store
Do you want to ADD the following certificate to the Root Store?
Subject: saturn.detroit.com.k7ekvo
Issuer: Self Issued
Time Validity: Saturday, January 15, 2005 through Friday, January 10, 2025
Serial Number: 01
Thumbprint (sha1): A776E94B CC724593 7573BC8D 08622B95 6F384CD0
Thumbprint (md5): 9AE76B7E 16CE87FF 46F2AEF9 BC9FD754
17) Click Yes.
NOTE:
A window with the following message will be displayed:
Certificate Import Wizard
The import was successful.
18) Click OK.Accessing the ICA Management Tool:
--------------------------------------------
1) Launch Internet Explorer from the Client, enter the appropriate URL, and connect to TCP port 18265 via the HTTPS protocol.
Example: https://192.168.2.100:18265
NOTE:
A dialog box with the following message will be displayed:
Client Authentication
Identification
The Web site you want to view requests identification.
Select the certificate to use when connecting.
2) Select the appropriate Certificate (e.g., John_Smith) for authenticating to the ICA Management Tool.
3) Click OK.
4) In the Security Alert dialog box, click Yes.
Setting up the ICA Management Tool
Solution ID: sk30501
Product: Security Gateway, Security Management
Version: NG AI R54, NG AI R55
Last Modified: 25-Dec-2008
Did this solution solve your problem?
[Click on the stars to rate]
SOLUTION
Overview of Procedures:
====================
- Setting up the ICA Management Tool connection (creating a Certificate user)
- Enabling the ICA Management Tool on the SmartCenter Server
- Importing the user Certificate to the Client
- Accessing the ICA Management Tool
PROCEDURES:
===========
Setting up ICA Management Tool Connection:
-----------------------------------------------------
1) Log into SmartDashboard, and select Manage > Users and Administrators.
2) In the Users and Administrators dialog box, select New > User by Template > Default.
3) in the User Properties dialog box > General tab, enter the user login name (e.g., John_Smith) in the Login Name field.
4) Select the Personal tab, and verify the Expiration Date is set to a valid future date (e.g., 31-dec-2008).
5) Select the Certificates tab, and click the Generate and save button.
NOTE:
A dialog box with the following message will be displayed:
Check Point SmartDashboard
The generation of the certificate for the user cannot be undone, unless you click Revoke.
Ok to continue?
6) Click OK.
7) In the Enter Password dialog box, enter the desired user password in the Password field.
8) Confirm the user password.
9) Click OK.
10) In the dialog box Save Certificate File As, select the desired location to save the Certificate file.
11) Verify the user login name (e.g., John_Smith) is displayed in the File name field.
12) Verify that "Certificate Files (*.p12)" is selected in the Save as type drop-down list.
13) Click Save.
14) On the Certificates tab, observe the information in the DN field, which should look something like this:
CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo15) Click OK in the User Properties dialog box.
16) Click Close in the Users and Administrators dialog box.
17) Select File > Save.
18) Transfer the *.p12 file (e.g. (e.g., John_Smith.p12) to the Client that is connecting to the ICA Management Tool.
NOTE:
The *.p12 file is in the directory designated in step 10.
Enabling the ICA Management Tool on the SmartCenter Server:
--------------------------------------------------------------------------
1. On the SmartCenter Server, type at prompt:
cpca_client set_mgmt_tool on -a "CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo"
NOTE 1:
The following message will be displayed before the command prompt returns:
Successfully set the management tool.
The authorized administrators:
(
: ("CN=John_Smith,OU=users,O=saturn.detroit.com.k7ekvo")
)
The authorized users:
()
Note 2:
Once the ICA Management Tool is started, the SmartCenter Server will be listening on TCP port 18265 (FW1_ica_mgmt_tools service).Importing the user Certificate to the Client:
-------------------------------------------------
1) Open Internet Options from the Windows Control Panel.
2) In the Internet Options dialog box, select the Content tab.
3) On the Content tab, click the Certificates button.
4) In the Certificates dialog box, select the Personal tab.
5) Click the Import button.
6) Click Next on the Welcome to the Certificate Import Wizard dialog box.
7) In the File to Import Window, browse to the the location of the *.p12 (e.g., John_Smith.p12) file.
8) In the Open dialog box, verify that "Personal Information Exchange (*.pfx,*.p12)" is selected in the Files of type drop-down list.
9) Select the file *.p12 in the window.
10) Click the Open button.
11) In the File to Import dialog box, click Next.
12) In the Password dialog box, enter the user Certificate password in the Password field.
NOTE: Clear the following two boxes:
Enable strong private key protection. You will be
prompted every time the private key is used by an
application if you enable this option.
Mark the private key as exportable
13) Click Next.
14) In the Certificate Store dialog box, verify that "Automatically select the certificate store based on the type of certificate" is selected.
15) Click Next.
16) In the Completing the Certificate Import Wizard dialog box, click Finish.
NOTE:
A message similar to the following will be displayed:
Root Certificate Store
Do you want to ADD the following certificate to the Root Store?
Subject: saturn.detroit.com.k7ekvo
Issuer: Self Issued
Time Validity: Saturday, January 15, 2005 through Friday, January 10, 2025
Serial Number: 01
Thumbprint (sha1): A776E94B CC724593 7573BC8D 08622B95 6F384CD0
Thumbprint (md5): 9AE76B7E 16CE87FF 46F2AEF9 BC9FD754
17) Click Yes.
NOTE:
A window with the following message will be displayed:
Certificate Import Wizard
The import was successful.
18) Click OK.Accessing the ICA Management Tool:
--------------------------------------------
1) Launch Internet Explorer from the Client, enter the appropriate URL, and connect to TCP port 18265 via the HTTPS protocol.
Example: https://192.168.2.100:18265
NOTE:
A dialog box with the following message will be displayed:
Client Authentication
Identification
The Web site you want to view requests identification.
Select the certificate to use when connecting.
2) Select the appropriate Certificate (e.g., John_Smith) for authenticating to the ICA Management Tool.
3) Click OK.
4) In the Security Alert dialog box, click Yes.
Wednesday, June 8, 2011
Enable email alerts for cluster failover
To enable an email alert for a cluster failover one must first configure internal sendmail script and then change the log tracking to mail alert.
1. Open smart dashboard
2.Click policy global services
3.Expand log and alert. Then click on alerts
4.Configure the sendmail script as
In SmartDashboard:
Select 'Global Properties > Log and Alert > Alert Commands'.
Check 'Send mail alert to SmartView Status'.
Check 'Run mail alert script'.
Enter script:
internal_sendmail [-s] [-t ] [-f ] ...
Example (default):
internal_sendmail -s alert -t mailserver_ip mail_account
In the Rule Base, define a rule that will generate an alert. In the Track field, enter 'Mail'.
Install the Security Policy.
5. Open the properties of the cluster. Then click on clusterXL and change tracking to mail alert. push policy
1. Open smart dashboard
2.Click policy global services
3.Expand log and alert. Then click on alerts
4.Configure the sendmail script as
In SmartDashboard:
Select 'Global Properties > Log and Alert > Alert Commands'.
Check 'Send mail alert to SmartView Status'.
Check 'Run mail alert script'.
Enter script:
internal_sendmail [-s
Example (default):
internal_sendmail -s alert -t mailserver_ip mail_account
In the Rule Base, define a rule that will generate an alert. In the Track field, enter 'Mail'.
Install the Security Policy.
5. Open the properties of the cluster. Then click on clusterXL and change tracking to mail alert. push policy
Creating mail alerts using internal_sendmail indicator
The internal_sendmail indicator is not a script. It is an internal Security Gateway indicator that directs the Check Point alerts daemon to send email, using the specified arguments. It does not require a mail server or mail client to be installed on the SmartCenter Server.
If the subject is longer than one word, it must be written within quotation marks.
The internal_sendmail indicator can be used in any of the script options on the 'Alert Commands' configuration page.
When choosing logging actions in rules or other Gateway logging properties, set the action to correspond to the alert you define on the 'Global Properties > Log and Alert > Alert Commands' property screen.
In SmartDashboard:
Select 'Global Properties > Log and Alert > Alert Commands'.
Check 'Send mail alert to SmartView Status'.
Check 'Run mail alert script'.
Enter script:
internal_sendmail [-s] [-t ] [-f ] ...
Example (default):
internal_sendmail -s alert -t mailserver_ip mail_account
In the Rule Base, define a rule that will generate an alert. In the Track field, enter 'Mail'.
Install the Security Policy.
If the subject is longer than one word, it must be written within quotation marks.
The internal_sendmail indicator can be used in any of the script options on the 'Alert Commands' configuration page.
When choosing logging actions in rules or other Gateway logging properties, set the action to correspond to the alert you define on the 'Global Properties > Log and Alert > Alert Commands' property screen.
In SmartDashboard:
Select 'Global Properties > Log and Alert > Alert Commands'.
Check 'Send mail alert to SmartView Status'.
Check 'Run mail alert script'.
Enter script:
internal_sendmail [-s
Example (default):
internal_sendmail -s alert -t mailserver_ip mail_account
In the Rule Base, define a rule that will generate an alert. In the Track field, enter 'Mail'.
Install the Security Policy.
Thursday, May 26, 2011
Crontab – Quick Reference
Setting up cron jobs in Unix and Solaris
cron is a unix, solaris utility that allows tasks to be automatically run in the background at regular intervals by the cron daemon. These tasks are often termed as cron jobs in unix , solaris. Crontab (CRON TABle) is a file which contains the schedule of cron entries to be run and at specified times.
This document covers following aspects of Unix cron jobs
1. Crontab Restrictions
2. Crontab Commands
3. Crontab file – syntax
4. Crontab Example
5. Crontab Environment
6. Disable Email
7. Generate log file for crontab activity
1. Crontab Restrictions
You can execute crontab if your name appears in the file /usr/lib/cron/cron.allow. If that file does not exist, you can use
crontab if your name does not appear in the file /usr/lib/cron/cron.deny.
If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.
2. Crontab Commands
export EDITOR=vi ;to specify a editor to open crontab file.
crontab -e Edit your crontab file, or create one if it doesn’t already exist.
crontab -l Display your crontab file.
crontab -r Remove your crontab file.
crontab -v Display the last time you edited your crontab file. (This option is only available on a few systems.)
3. Crontab file
Crontab syntax :
A crontab file has five fields for specifying day , date and time followed by the command to be run at that interval.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
* in the value field above means all legal values as in braces for that column.
The value column can have a * or a list of elements separated by commas. An element is either a number in the ranges shown above or two numbers in the range separated by a hyphen (meaning an inclusive range).
Notes
A. ) Repeat pattern like /2 for every 2 minutes or /10 for every 10 minutes is not supported by all operating systems. If you try to use it and crontab complains it is probably not supported.
B.) The specification of days can be made in two fields: month day and weekday. If both are specified in an entry, they are cumulative meaning both of the entries will get executed .
4. Crontab Example
A line in crontab file like below removes the tmp files from /home/someuser/tmp each day at 6:30 PM.
30 18 * * * rm /home/someuser/tmp/*
Changing the parameter values as below will cause this command to run at different time schedule below :
min hour day/month month day/week Execution time
30 0 1 1,6,12 * – 00:30 Hrs on 1st of Jan, June & Dec.
0 20 * 10 1-5 –8.00 PM every weekday (Mon-Fri) only in Oct.
0 0 1,10,15 * * – midnight on 1st ,10th & 15th of month
5,10 0 10 * 1 – At 12.05,12.10 every Monday & on 10th of every month
:
Note : If you inadvertently enter the crontab command with no argument(s), do not attempt to get out with Control-d. This removes all entries in your crontab file. Instead, exit with Control-c.
5. Crontab Environment
cron invokes the command from the user’s HOME directory with the shell, (/usr/bin/sh).
cron supplies a default environment for every shell, defining:
HOME=user’s-home-directory
LOGNAME=user’s-login-id
PATH=/usr/bin:/usr/sbin:.
SHELL=/usr/bin/sh
Users who desire to have their .profile executed must explicitly do so in the crontab entry or in a script called by the entry.
6. Disable Email
By default cron jobs sends a email to the user account executing the cronjob. If this is not needed put the following command At the end of the cron job line .
>/dev/null 2>&1
7. Generate log file
To collect the cron execution execution log in a file :
30 18 * * * rm /home/someuser/tmp/* > /home/someuser/cronlogs/clean_tmp_dir.log
cron is a unix, solaris utility that allows tasks to be automatically run in the background at regular intervals by the cron daemon. These tasks are often termed as cron jobs in unix , solaris. Crontab (CRON TABle) is a file which contains the schedule of cron entries to be run and at specified times.
This document covers following aspects of Unix cron jobs
1. Crontab Restrictions
2. Crontab Commands
3. Crontab file – syntax
4. Crontab Example
5. Crontab Environment
6. Disable Email
7. Generate log file for crontab activity
1. Crontab Restrictions
You can execute crontab if your name appears in the file /usr/lib/cron/cron.allow. If that file does not exist, you can use
crontab if your name does not appear in the file /usr/lib/cron/cron.deny.
If only cron.deny exists and is empty, all users can use crontab. If neither file exists, only the root user can use crontab. The allow/deny files consist of one user name per line.
2. Crontab Commands
export EDITOR=vi ;to specify a editor to open crontab file.
crontab -e Edit your crontab file, or create one if it doesn’t already exist.
crontab -l Display your crontab file.
crontab -r Remove your crontab file.
crontab -v Display the last time you edited your crontab file. (This option is only available on a few systems.)
3. Crontab file
Crontab syntax :
A crontab file has five fields for specifying day , date and time followed by the command to be run at that interval.
* * * * * command to be executed
- - - - -
| | | | |
| | | | +----- day of week (0 - 6) (Sunday=0)
| | | +------- month (1 - 12)
| | +--------- day of month (1 - 31)
| +----------- hour (0 - 23)
+------------- min (0 - 59)
* in the value field above means all legal values as in braces for that column.
The value column can have a * or a list of elements separated by commas. An element is either a number in the ranges shown above or two numbers in the range separated by a hyphen (meaning an inclusive range).
Notes
A. ) Repeat pattern like /2 for every 2 minutes or /10 for every 10 minutes is not supported by all operating systems. If you try to use it and crontab complains it is probably not supported.
B.) The specification of days can be made in two fields: month day and weekday. If both are specified in an entry, they are cumulative meaning both of the entries will get executed .
4. Crontab Example
A line in crontab file like below removes the tmp files from /home/someuser/tmp each day at 6:30 PM.
30 18 * * * rm /home/someuser/tmp/*
Changing the parameter values as below will cause this command to run at different time schedule below :
min hour day/month month day/week Execution time
30 0 1 1,6,12 * – 00:30 Hrs on 1st of Jan, June & Dec.
0 20 * 10 1-5 –8.00 PM every weekday (Mon-Fri) only in Oct.
0 0 1,10,15 * * – midnight on 1st ,10th & 15th of month
5,10 0 10 * 1 – At 12.05,12.10 every Monday & on 10th of every month
:
Note : If you inadvertently enter the crontab command with no argument(s), do not attempt to get out with Control-d. This removes all entries in your crontab file. Instead, exit with Control-c.
5. Crontab Environment
cron invokes the command from the user’s HOME directory with the shell, (/usr/bin/sh).
cron supplies a default environment for every shell, defining:
HOME=user’s-home-directory
LOGNAME=user’s-login-id
PATH=/usr/bin:/usr/sbin:.
SHELL=/usr/bin/sh
Users who desire to have their .profile executed must explicitly do so in the crontab entry or in a script called by the entry.
6. Disable Email
By default cron jobs sends a email to the user account executing the cronjob. If this is not needed put the following command At the end of the cron job line .
>/dev/null 2>&1
7. Generate log file
To collect the cron execution execution log in a file :
30 18 * * * rm /home/someuser/tmp/* > /home/someuser/cronlogs/clean_tmp_dir.log
SSL VPN on a Check Point Gateway
Create a new network object. This will be used as the remote users IP address. Name this "net_office-mode-IPs"
Within the Check Point Object under Tolopogy > VPN Domain add your local domain.
Within the Check Point Object under Remote Access make the following changes : Enable Support Vistor Mode
Within the Check Point Object under Office Mode - Select "Allow Office Mode to all users". Add this new network object under Manual (Allocate IP address from Network)
Within the Check Point Object Under Client VPN - Tick Support Clientless VPN. Under Certificate for gateway authentication select ICA_CERT.
Within the Check Point Object under SSL Clients - Tick the SSL Network Extender and select the ICA_CERT as the The gateway authenticates with this certificate.
Within the VPN community Tab under your Remote Access community. Add your Gateway as a paricipating gateway.
Within the Users Tab create your users and add these to a new user group.
Create a Rule for to allow access from your usergroups to your internal hosts (local encryption domain) and select your Remote Access Community
Within the Check Point Object under Tolopogy > VPN Domain add your local domain.
Within the Check Point Object under Remote Access make the following changes : Enable Support Vistor Mode
Within the Check Point Object under Office Mode - Select "Allow Office Mode to all users". Add this new network object under Manual (Allocate IP address from Network)
Within the Check Point Object Under Client VPN - Tick Support Clientless VPN. Under Certificate for gateway authentication select ICA_CERT.
Within the Check Point Object under SSL Clients - Tick the SSL Network Extender and select the ICA_CERT as the The gateway authenticates with this certificate.
Within the VPN community Tab under your Remote Access community. Add your Gateway as a paricipating gateway.
Within the Users Tab create your users and add these to a new user group.
Create a Rule for to allow access from your usergroups to your internal hosts (local encryption domain) and select your Remote Access Community
check which CP components are installed with the 'cpprod_util' command
admin]# cpprod_util CPPROD_GetKeyValues products 0
Wednesday, May 25, 2011
LDAP Configuration
Proceed as follows:
In SmartDashboard, select "Policy > Global Properties > SmartDirectory" and enable "Use SmartDirectory".
Create a node object. (In SmartDashboard, select 'Manage > Network Objects > New > Node > Host'.) Type in a descriptive name and the IP address of the LDAP Server.
Create a user template to represent the LDAP users. (Select 'Manage > Users and Administrators > New > Template'.) You need to enter the name and configure the authentication method to "Check Point Password". (No other modification is mandatory here.)
Create an LDAP account unit. (Select 'Manage > Servers and OPSEC applications > New > LDAP Account Unit'.)
In the General Tab: Enter the LDAP Account Unit name, set the profile to Microsoft_AD, and select both the 'CRL Retrieval' and the 'User management' options.
In the Servers Tab: Click 'Add' and specify the node object, created previously, from the drop down list. Leave the port as "389", specify the login DN (i.e. cn=useraccount, cn=users, DC=Domain, DC=org) and specify the password for the specified login. The 'Read data from this server' and 'Write data to this server' options are both selected. (Do not select the Encryption tab as this is relevant for encrypted SSL.) Click 'OK' and 'Add' and then specify 'Early Version Compatibility server' from the drop-down list.(Same object created earlier.)
In the Objects management tab: The 'Manage objects on' is enabled on the previously defined Node object (that represents the LDAP/MSAD server). Click 'fetch branches'. (This must work before the LDAP authentication works.) You should see the AD branches appear. The 'prompt for password' option is not selected, and the 'Return entries' is set at its default value of "500".
In the Authentication tab: The 'Use common group path for queries' option is not selected. The 'Allowed authentication schemes' selected must include the 'Check Point Password' scheme. The 'Users default template' option should be selected. Choose the user template that was created previously. All other options are not selected/checked.
Create the necessary LDAP group. (Select 'Manage > Users and Administrators > New > LDAP Group'.) Enter the LDAP group name, and specify the previously created LDAP Account Unit. The "Group's scope" is set to "All Account-Unit's Users".
Create a rule specifying the above LDAP group, as the source. (When you right click on the 'SOURCE' column, specify 'Add Users Access'.) The destination and service in this example are set to "ANY". The VPN column is set to the Remote Access VPN community (Secure client/Secure Remote). The Action is "ACCEPT" and Track is set to "LOG".
In SmartDashboard, select "Policy > Global Properties > SmartDirectory" and enable "Use SmartDirectory".
Create a node object. (In SmartDashboard, select 'Manage > Network Objects > New > Node > Host'.) Type in a descriptive name and the IP address of the LDAP Server.
Create a user template to represent the LDAP users. (Select 'Manage > Users and Administrators > New > Template'.) You need to enter the name and configure the authentication method to "Check Point Password". (No other modification is mandatory here.)
Create an LDAP account unit. (Select 'Manage > Servers and OPSEC applications > New > LDAP Account Unit'.)
In the General Tab: Enter the LDAP Account Unit name, set the profile to Microsoft_AD, and select both the 'CRL Retrieval' and the 'User management' options.
In the Servers Tab: Click 'Add' and specify the node object, created previously, from the drop down list. Leave the port as "389", specify the login DN (i.e. cn=useraccount, cn=users, DC=Domain, DC=org) and specify the password for the specified login. The 'Read data from this server' and 'Write data to this server' options are both selected. (Do not select the Encryption tab as this is relevant for encrypted SSL.) Click 'OK' and 'Add' and then specify 'Early Version Compatibility server' from the drop-down list.(Same object created earlier.)
In the Objects management tab: The 'Manage objects on' is enabled on the previously defined Node object (that represents the LDAP/MSAD server). Click 'fetch branches'. (This must work before the LDAP authentication works.) You should see the AD branches appear. The 'prompt for password' option is not selected, and the 'Return
In the Authentication tab: The 'Use common group path for queries' option is not selected. The 'Allowed authentication schemes' selected must include the 'Check Point Password' scheme. The 'Users default template' option should be selected. Choose the user template that was created previously. All other options are not selected/checked.
Create the necessary LDAP group. (Select 'Manage > Users and Administrators > New > LDAP Group'.) Enter the LDAP group name, and specify the previously created LDAP Account Unit. The "Group's scope" is set to "All Account-Unit's Users".
Create a rule specifying the above LDAP group, as the source. (When you right click on the 'SOURCE' column, specify 'Add Users Access'.) The destination and service in this example are set to "ANY". The VPN column is set to the Remote Access VPN community (Secure client/Secure Remote). The Action is "ACCEPT" and Track is set to "LOG".
Tuesday, May 24, 2011
Creating a Certificate Based Site to Site VPN between 2 Check Points Gateways
Site A
Create VPN Community
Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined"
Within Network Objects create a Externally Managed VPN gateway (For Site B) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Export the Certificate
Within the Servers and OPSEC applications tab right click "Servers > Trusted CAs > Internal CA" and select "New > CA > Trusted > New CA > Trusted."
Enter a name for your Certificate (such as VPN-CERT)
Under the Certificate Authority TYpe choose "External Check Point CA"
Click the External Check Point CA tab and select "Save As".
Save the Certificate
Site B
Create VPN Community
Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined".
Within Network Objects create a Externally Managed VPN gateway (For Site A) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Import the Certificate
Within the Servers and OPSEC applications tab right click Servers and select "New > CA > Trusted"
Enter a name such as VPN-CERT.
Under the Certificate Authority TYpe choose "External Check Point CA".
Click the External Check Point CA tab and select "Get".
Import the previously saved certificate from Site A.
Create VPN Community
Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined"
Within Network Objects create a Externally Managed VPN gateway (For Site B) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Export the Certificate
Within the Servers and OPSEC applications tab right click "Servers > Trusted CAs > Internal CA" and select "New > CA > Trusted > New CA > Trusted."
Enter a name for your Certificate (such as VPN-CERT)
Under the Certificate Authority TYpe choose "External Check Point CA"
Click the External Check Point CA tab and select "Save As".
Save the Certificate
Site B
Create VPN Community
Within your Gateway Object add you local domain to "Topology | VPN Domain | Manually Defined".
Within Network Objects create a Externally Managed VPN gateway (For Site A) and add its local domain.
Goto the VPN communities Tab and Right Click "Site To Site" and select "New" then "Mesh".
Give your Communitiy a name
Select "Accept all encypted traffic"
Within Participates add your Gateways.
Click Ok.
Import the Certificate
Within the Servers and OPSEC applications tab right click Servers and select "New > CA > Trusted"
Enter a name such as VPN-CERT.
Under the Certificate Authority TYpe choose "External Check Point CA".
Click the External Check Point CA tab and select "Get".
Import the previously saved certificate from Site A.
Monday, May 23, 2011
Negate Cell
1.It says match on anything BUT what you've got in the cell.
A classic use of the rule might be:
Src: h-web_proxy - Dst: NEGATED g-internal_networks - Service: http, https.
This says "the web proxy is allowed to connect to anywhere OTHER THAN our internal networks, on http and https.
2.It just does a reverse of what it would be normally.
ie
you create a rule that allows
src = internal net
dst = any
srv = http(negate)
action = accept
Instead of allowing http out to the Internet, it allows everything but http out to the internet.
It is quite common to see a group defined that contains all of the internal and dmz networks and then negate that group in the destination column to allow internet access.
This therefore allows access to anywhere but the networks group.
A classic use of the rule might be:
Src: h-web_proxy - Dst: NEGATED g-internal_networks - Service: http, https.
This says "the web proxy is allowed to connect to anywhere OTHER THAN our internal networks, on http and https.
2.It just does a reverse of what it would be normally.
ie
you create a rule that allows
src = internal net
dst = any
srv = http(negate)
action = accept
Instead of allowing http out to the Internet, it allows everything but http out to the internet.
It is quite common to see a group defined that contains all of the internal and dmz networks and then negate that group in the destination column to allow internet access.
This therefore allows access to anywhere but the networks group.
Rule Base Check Order
1.IP spoofing
2.Network address translation (NAT)
3.Implicit Rules (First)
4.Explicit rules in Rule Base(Not Last"Cleanup Rule")
5.Implicit rule (Before Last Rule,i.e Clean up from explicit)
6.Cleanup (last)
2.Network address translation (NAT)
3.Implicit Rules (First)
4.Explicit rules in Rule Base(Not Last"Cleanup Rule")
5.Implicit rule (Before Last Rule,i.e Clean up from explicit)
6.Cleanup (last)
Friday, May 20, 2011
Checkpoint Commands
1).View connections table: fw tab -t host_table –s
2).To pull the latest policy from the management station: fw fetch
3).The name of the policy installed and the date it was received: fw stat
4).Display cpu, memory, and disk usage: fw ctl pstat
5).Delete all hosts from the connections table: fw tab -t host_ip_addrs –x
6).Display logs on the firewall for a specific IP: fw log –n –ft | grep
7).Troubleshoot source/destination access issues: fw monitor -m test -e 'accept
src=x.x.x.x and dst=y.y.y.y;'
8).Manage VPN connections : vpn tu
9).Turn on debugging for VPN: vpndebug on and
vpn debug ikeon
This will create 2 files in $FWDIR/logs.
1.vpnd.elg
2. ike.elg
Turn off:
vpndebug off and
vpn debug ikeoff
10).Display SIC key: cp_conf sic get
11).High Availabiliy: cphaprob stat -display HA status
cphaprob -i -display HA interface stats
cphastop/cphastart -stop/start HA
12).View license key installed: cplic print
2).To pull the latest policy from the management station: fw fetch
3).The name of the policy installed and the date it was received: fw stat
4).Display cpu, memory, and disk usage: fw ctl pstat
5).Delete all hosts from the connections table: fw tab -t host_ip_addrs –x
6).Display logs on the firewall for a specific IP: fw log –n –ft | grep
7).Troubleshoot source/destination access issues: fw monitor -m test -e 'accept
src=x.x.x.x and dst=y.y.y.y;'
8).Manage VPN connections : vpn tu
9).Turn on debugging for VPN: vpndebug on and
vpn debug ikeon
This will create 2 files in $FWDIR/logs.
1.vpnd.elg
2. ike.elg
Turn off:
vpndebug off and
vpn debug ikeoff
10).Display SIC key: cp_conf sic get
11).High Availabiliy: cphaprob stat -display HA status
cphaprob -i -display HA interface stats
cphastop/cphastart -stop/start HA
12).View license key installed: cplic print
Basic difference between the Central and Local License
Local license is binded with ip address of the gateway. You can change the ip address for the license only for 5 times by default. This means if your isp changes the ip you have to change the license if you have used external ip for licenseing.
Central license is attached to management server ip and licenses are attached to the gateway from the management server. So there is no dependency for the gateway ip.Manageability is better.
Central license is attached to management server ip and licenses are attached to the gateway from the management server. So there is no dependency for the gateway ip.Manageability is better.
Tuesday, May 17, 2011
SecurePlatform Backup and Restore Commands
SecurePlatform provides a command line or Web GUI capability for conducting backups of your system
settings and products configuration.
The backup utility can store backups either locally on the SecurePlatform machine hard drive, or remotely
to a TFTP server or an SCP server. The backup can be performed on request, or it can be scheduled to
take place at set intervals.
The backup files are kept in tar gzip format (.tgz). Backup files, saved locally, are kept in
/var/CPbackup/backups.
The restore utility is used for restoring SecurePlatform settings and/or product configurations from backup
files.
Expert permissions are required to perform the backup and restore procedures.
SecurePlatform provides the option of backing up the entire SecurePlatform operating system and all of its
products using the snapshot command.
A snapshot of the system can be taken manually using the snapshot command or automatically during an
upgrade procedure using the SafeUpgrade option.
Having a snapshot of the entire operating system enables you to restore SecurePlatform if needed. Similar
to Backup and Restore, the Snapshot and Revert features ensure easy maintenance and management,
even if a situation arises that demands that you undo an upgrade and revert to a previous deployment.
The snapshot and revert commands can use a TFTP server or an SCP server to store snapshots.
Alternatively, snapshots can be stored locally.
settings and products configuration.
The backup utility can store backups either locally on the SecurePlatform machine hard drive, or remotely
to a TFTP server or an SCP server. The backup can be performed on request, or it can be scheduled to
take place at set intervals.
The backup files are kept in tar gzip format (.tgz). Backup files, saved locally, are kept in
/var/CPbackup/backups.
The restore utility is used for restoring SecurePlatform settings and/or product configurations from backup
files.
Expert permissions are required to perform the backup and restore procedures.
SecurePlatform provides the option of backing up the entire SecurePlatform operating system and all of its
products using the snapshot command.
A snapshot of the system can be taken manually using the snapshot command or automatically during an
upgrade procedure using the SafeUpgrade option.
Having a snapshot of the entire operating system enables you to restore SecurePlatform if needed. Similar
to Backup and Restore, the Snapshot and Revert features ensure easy maintenance and management,
even if a situation arises that demands that you undo an upgrade and revert to a previous deployment.
The snapshot and revert commands can use a TFTP server or an SCP server to store snapshots.
Alternatively, snapshots can be stored locally.
Check Point VPN-1/FireWall-1 TCP and UDP Ports used by Check Point R70
http://www.fw-1.de/aerasec/r70/ports-r70.html
Acceleration and Clustering Software Blade
The Check Point Acceleration and Clustering Software Blade delivers a set of advanced technologies, SecureXL and ClusterXL, that work together to maximize performance and security in high-performance environments. These work with CoreXL, which is included with the blade containers, to form the foundation of the Open Performance Architecture, which delivers throughput designed for data center applications and the high levels of security needed to protect against today’s application-level threats.
SecureXL: Security acceleration
Patented SecureXL is a technology interface that accelerates multiple, intensive security operations, including operations that are carried out by Check Point’s Stateful Inspection firewall. Using SecureXL, the firewall offloads operations to a performance-optimized software or hardware device, dramatically increasing throughput.
CoreXL: Multicore acceleration
As the first security technology to fully leverage general-purpose multi-core processors, CoreXL introduces advanced core-level load balancing that increases throughput for the deep inspection required to achieve intrusion prevention and high throughput on the firewall. With CoreXL, high performance and high security can be achieved simultaneously.
ClusterXL: Smart Load Balancing
ClusterXL provides high availability and load sharing that keeps businesses running without interruption. ClusterXL distributes traffic between clusters of redundant gateways, combining the computing capacity of multiple machines to increase total throughput. In the event of a gateway or network failure, connections are seamlessly redirected to a designated backup, maintaining business continuity.
Key Benefits
Enables organizations to deploy the highest levels of application security at the highest-performance levels without compromise
Delivers predictable performance as new threats appear
Accelerates performance for multimedia or transaction-oriented applications
Transparent failover for business continuity
Effective load distribution that scales at the processor and system level
Easy Software Blade deployment
SecureXL: Security acceleration
Patented SecureXL is a technology interface that accelerates multiple, intensive security operations, including operations that are carried out by Check Point’s Stateful Inspection firewall. Using SecureXL, the firewall offloads operations to a performance-optimized software or hardware device, dramatically increasing throughput.
CoreXL: Multicore acceleration
As the first security technology to fully leverage general-purpose multi-core processors, CoreXL introduces advanced core-level load balancing that increases throughput for the deep inspection required to achieve intrusion prevention and high throughput on the firewall. With CoreXL, high performance and high security can be achieved simultaneously.
ClusterXL: Smart Load Balancing
ClusterXL provides high availability and load sharing that keeps businesses running without interruption. ClusterXL distributes traffic between clusters of redundant gateways, combining the computing capacity of multiple machines to increase total throughput. In the event of a gateway or network failure, connections are seamlessly redirected to a designated backup, maintaining business continuity.
Key Benefits
Enables organizations to deploy the highest levels of application security at the highest-performance levels without compromise
Delivers predictable performance as new threats appear
Accelerates performance for multimedia or transaction-oriented applications
Transparent failover for business continuity
Effective load distribution that scales at the processor and system level
Easy Software Blade deployment
Subscribe to:
Posts (Atom)