Checkpoint Firewall Administration Training Part2

c
URI Filtering protocol (UFP)

• Studies have shown that unlimited Internet
Access during work hours has greatly
diminished employee productivity as they
spend more time browsing than actually
working.
• Organizations are now defining an Internet
Usage policy which specifies what exactly an
employee can access on the Internet during
work hours.
• URL filtering software is required to
implement these kind of policies.
• Checkpoint’s Firewall-1 can be configured to
redirect all web traffic to a URL server before
allowing it to pass through.
• This is done using the UFP protocol
ActiveX Controls and Java Applets
• Active X is a technology that enables self
contained S/W components to interact with a
wide variety of applications
• Some active X components can be
manipulated, or scripted from with in HTML
• These ActiveX controls get executed on client
machines and might be used by malicious
hackers to get a backdoor into the network.
• Java Applets are also small pieces of code
which get executed on client machines.
• They too pose a security threat to the
network.
Java and ActiveX Stripping
• FireWall-1’s extensive screening capabilities
effectively protect enterprise networks from
Java and ActiveX attacks.
• FireWall-1’s flexible Resource definition allows
administrators to
–strip Java applets and script from HTML pages
–strip ActiveX tags from HTML pages
–block Java code from incoming HTTP traffic
OPSEC API
• Network Security involves not only a firewall
but several other components like anti virus
server, URL filtering server and so on.
• No single vendor has the capability to offer all
the products for network security
• In order to better integrate with third party
vendors of anti virus and URL filtering
software, Checkpoint has developed APIs
(Application Programming Interfaces) under
the Open Platform for Security (OPSEC).
• Checkpoint’s OPSEC partners use these APIs to
integrate their products with Checkpoint
Firewall-1.
Content Vectoring Protocol (CVP)
• Viruses are a major cause for network outage
and can destroy precious resources like
corporate data.
• To guard against virus attacks , an anti virus
server is needed which will scan all traffic and
clean potentially infected files.
• Checkpoint integrates with anti virus servers
using the CVP protocol.
• If the firewall is configured for CVP , it can
redirect all SMTP, FTP, HTTP and other TCP
traffic to an anti virus server.
• If the anti virus server approves of the traffic ,
only then will the firewall allow the traffic to
pass through , otherwise, it will get discarded.
CVP
• To implement anti virus solutions with
Checkpoint, you have to create Resources.
• These Resources can be used exactly like a
Service in the Rule Base.
• For example, if an FTP Resource definition
specifies anti-virus checking, FireWall-1
intercepts FTP attempts and sends the
transferred files to a CVP server, which
examines the files.
• If the CVP server approves of the FTP data,
then the firewall will allow it to pass through.
• Authentication is the process by which the
firewall checks whether a user can access a
certain service or not.
• In its simplest form , authentication involves
sending a username and password to the
firewall which will then check whether this
user can access services or not.
• Checkpoint Firewall-1 supports both internal
and external authentication schemes
– Internal: The username and password are
stored on the firewall itself
– External: The firewall relies on some third
party security server which will be actually
doing the authentication.
Authentication Schemes
• Checkpoint Firewall-1 supports the following
authentication schemes
– Checkpoint Password (Internal)
– OS password (External)
– RADIUS (External)
– TACACS (External)
– SecureID (External)
VPN-1 , OS passwords
• Checkpoint Password :
– Using a Checkpoint Password simply means
that the username and password are being
stored on the firewall machine itself.
• OS Password :
– Authentication via operating system password
means that Fire-Wall-1 will refer to the user's
account in the operating system for
authentication.
– This may be a convenient method for you if all
the users you want to configure for firewall
authentication already have accounts on the
system.
RADIUS, TACACS
• RADIUS : Remote Authentication Dial-In User
Service,
– You must have a functional RADIUS sever,
which contains a database of all the users you
would like to authenticate.
• TACACS: Terminal access Controller Access
Control System
– Is another external authentication scheme you
can use to authenticate your users.
SecurID
• SecurID is a two-factor authentication method,
meaning two pieces of information are required
before access in granted : a password and a
token.
• The token is generally generated by a SecurID
token--a small electronic device the user keeps
with them that displays a new number every 60
seconds.
• Combining this number with the user's password
allows the SecurID server to determine whether
or not the user should be granted access
Authentication Methods
• Checkpoint supports the following
authentication methods
– User Authentication
– Session Authentication
– Client Authentication
User Authentication
• User authentication is transparent and is
available only for HTTP, Telnet, FTP and Rlogin
• When user authentication is configured for
these services, the firewall proxies all
connections.
• Since the firewall is acting as a proxy , all
traffic will appear to come from the firewall’s
IP address and any NAT translations will not
be implemented for these connections
Session Authentication
• Session Authentication is available for all
services.
• Session authentication is also transparent.
• A special agent called the session
authentication agent should be installed on
the client machine.
• When the user tries to access any service, the
firewall commands the authentication agent
to pop up on the client machine.
• The user has to supply the correct credentials
to the authentication agent which will pass
them to the firewall. If authentication
succeeds, then the user can access any
service.
Client authentication
• Client authentication is available for all
services.
• Client Authentication allows access from a
specific IP address. The user performs the
authentication by successfully meeting an
authentication challenge, but it is the client
machine that is granted access.
• It can function either in transparent or in non-
transparent mode.
• You can sign on for all services at the same
time or do a specific sign on for a single
service.
Client Authentication Sign on Methods
Sign on options
– Manual – the user must manually connect to the
firewall for authentication using either Telnet on
port 259 or HTTP on port 900 , before accessing
any service.
– Partially automatic- For authenticated services
like HTTP, FTP, Telnet and Rlogin , the user can
authenticate transparently with user
authentication. For all other services, the user
has to manually log on to the firewall
• Sign on options
– Fully automatic- For authenticated services like
HTTP, FTP, Telnet and Rlogin , the user can
authenticate transparently with user
authentication. For all other services, the session
authentication agent will pop up on the client
machine
– Agent Automatic Sign on- For all services, the
session authentication agent will pop up on the
client machine
Comparison

Checkpoint Firewall Administration Training Part2

Uploaded by

Copyright:

Available Formats

Checkpoint Firewall Administration Training Part2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Checkpoint Firewall Administration Training Part2

Uploaded by

Copyright:

Available Formats

c

URI Filtering protocol (UFP)

You might also like