Internet Security Appliance
Check Point UTM-1 Embedded
NGX
Internet Security Appliance
User Guide
Version 8.2
Part No: 700800, 06 May 2012
© 2012 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation.
No part of this product or related documentation may be reproduced in any form or by any
means without prior written authorization of Check Point. While every precaution has been
taken in the preparation of this book, Check Point assumes no responsibility for errors or
omissions. This publication and features described herein are subject to change without
notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page (http://www.checkpoint.com/copyright.html) for a list of our
trademarks.
Refer to the Third Party copyright notices
(http://www.checkpoint.com/3rd_party_copyright.html) for a list of relevant copyrights
and third-party licenses.
Latest Software
We recommend that you install the most recent software release to stay up-to-date with the
latest functional improvements, stability fixes, security enhancements and protection against
new and evolving attacks.
Latest Documentation
The latest version of this document is at:
http://supportcontent.checkpoint.com/documentation_download?ID=12394
For additional technical information, visit the Check Point Support Center
(http://supportcenter.checkpoint.com).
Revision History
Date
Description
06 May 2012
Added Edge N Industrial appliance
November 2010
First release of this document
Read the following warnings before setting up or using the appliance.
Warning: Do not block air vents. A minimum 1/2-inch clearance is required.
Warning: This appliance does not contain any user-serviceable parts. Do not remove
any covers or attempt to gain access to the inside of the product. Opening the device
or modifying it in any way has the risk of personal injury and will void your warranty.
The following instructions are for trained service personnel only.
To prevent damage to any system board, it is important to handle it with care. The following
measures are generally sufficient to protect your equipment from static electricity discharge:

When handling the board, to use a grounded wrist strap designed for static
discharge elimination.

Touch a grounded metal object before removing the board from the antistatic bag.

Handle the board by its edges only. Do not touch its components, peripheral chips,
memory modules or gold contacts.

When handling processor chips or memory modules, avoid touching their pins or
gold edge fingers.

Restore the communications appliance system board and peripherals back into the
antistatic bag when they are not in use or not installed in the chassis. Some
circuitry on the system board can continue operating even though the power is
switched off.

Under no circumstances should the lithium battery cell used to power the
real-time clock be allowed to short. The battery cell may heat up under these
conditions and present a burn hazard.
Warning: DANGER OF EXPLOSION IF BATTERY IS INCORRECTLY REPLACED.
REPLACE ONLY WITH SAME OR EQUIVALENT TYPE RECOMMENDED BY THE
MANUFACTURER.

Do not dispose of batteries in a fire or with household waste.

Contact your local waste disposal agency for the address of the nearest battery
deposit site.

Disconnect the system board power supply from its power source before you
connect or disconnect cables or install or remove any system board components.
Failure to do this can result in personnel injury or equipment damage.

Avoid short-circuiting the lithium battery; this can cause it to superheat and cause
burns if touched.

Do not operate the processor without a thermal solution. Damage to the processor
can occur in seconds.
For California:
Perchlorate Material - special handling may apply. See
http://www.dtsc.ca.gov/hazardouswaste/perchlorate
The foregoing notice is provided in accordance with California Code of Regulations Title
22, Division 4.5, Chapter 33. Best Management Practices for Perchlorate Materials. This
product, part, or both may include a lithium manganese dioxide battery which contains a
perchlorate substance.
Proposition 65 Chemical
Chemicals identified by the State of California, pursuant to the requirements of the
California Safe Drinking Water and Toxic Enforcement Act of 1986, California Health &
Safety Code s. 25249.5, et seq. ("Proposition 65"), that is "known to the State to cause cancer
or reproductive toxicity" (see http://www.calepa.ca.gov)
WARNING:
Handling the cord on this product will expose you to lead, a chemical known to the State of
California to cause cancer, and birth defects or other reproductive harm. Wash hands after
handling.
Contents
Contents
About This Guide ................................................................................................................................. ix
Introduction ........................................................................................................................................... 1
About Your Check Point UTM-1 Embedded NGX Appliance ........................................................... 1
UTM-1 Edge Series Products .............................................................................................................. 2
UTM-1 Edge N Series Features .......................................................................................................... 3
UTM-1 Edge NW Series Features ...................................................................................................... 8
UTM-1 Edge W Series Features ....................................................................................................... 14
Optional Security Services ................................................................................................................ 19
Software Requirements ..................................................................................................................... 20
Getting to Know Your UTM-1 Edge N Appliance ........................................................................... 20
Getting to Know Your UTM-1 Edge N ADSL Appliance ................................................................ 24
Getting to Know Your UTM-1 Edge N Industrial Appliance ........................................................... 30
Getting to Know Your UTM-1 Edge NW Appliance ....................................................................... 34
Getting to Know Your UTM-1 Edge NW ADSL Appliance ............................................................ 39
Getting to Know Your UTM-1 Edge W Appliance .......................................................................... 46
Getting to Know Your UTM-1 Edge W ADSL Appliance ............................................................... 50
Contacting Technical Support ........................................................................................................... 55
UTM-1 Security ................................................................................................................................... 57
Introduction to Information Security ................................................................................................. 57
The UTM-1 Firewall ......................................................................................................................... 61
Installing and Setting Up UTM-1 ...................................................................................................... 69
Before You Install the UTM-1 Appliance ......................................................................................... 69
UTM-1 Edge Installation .................................................................................................................. 83
Cascading Your Appliance ............................................................................................................... 98
Connecting the Appliance to Network Printers ................................................................................. 98
Setting Up the UTM-1 Appliance ..................................................................................................... 99
Contents
i
Contents
Getting Started .................................................................................................................................. 103
Initial Login to the UTM-1 Portal ................................................................................................... 103
Logging in to the UTM-1 Portal ..................................................................................................... 106
Accessing the UTM-1 Portal Remotely Using HTTPS ................................................................... 107
Using the UTM-1 Portal.................................................................................................................. 108
Logging Out .................................................................................................................................... 113
Configuring the Internet Connection .............................................................................................. 115
Overview ......................................................................................................................................... 115
Using the Internet Wizard ............................................................................................................... 116
Using Internet Setup ........................................................................................................................ 131
Setting Up Modems......................................................................................................................... 164
Viewing Internet Connection Information ...................................................................................... 173
Enabling/Disabling the Internet Connection ................................................................................... 175
Using Quick Internet Connection/Disconnection ............................................................................ 176
Configuring a Backup Internet Connection ..................................................................................... 176
Configuring WAN Load Balancing ................................................................................................ 178
Managing Your Network.................................................................................................................. 181
Configuring Network Settings ........................................................................................................ 181
Using the Internal DNS Server........................................................................................................ 208
Using Network Objects ................................................................................................................... 210
Configuring Network Service Objects ............................................................................................ 220
Using Static Routes ......................................................................................................................... 223
Managing Ports ............................................................................................................................... 228
Using the Terminal Server .............................................................................................................. 239
Using Bridges ..................................................................................................................................... 243
Overview ......................................................................................................................................... 243
Workflow ........................................................................................................................................ 248
ii
Check Point UTM-1 Embedded NGX User Guide
Contents
Adding and Editing Bridges ............................................................................................................ 249
Adding Internal Networks to Bridges ............................................................................................. 253
Adding Internet Connections to Bridges ......................................................................................... 256
Deleting Bridges ............................................................................................................................. 260
Configuring High Availability ......................................................................................................... 263
Overview ......................................................................................................................................... 263
Configuring High Availability on a Gateway ................................................................................. 265
Sample Implementation on Two Gateways ..................................................................................... 270
Using Traffic Shaper ......................................................................................................................... 275
Overview ......................................................................................................................................... 275
Setting Up Traffic Shaper ............................................................................................................... 276
Predefined QoS Classes .................................................................................................................. 277
Adding and Editing Classes ............................................................................................................ 278
Viewing and Deleting Classes......................................................................................................... 283
Restoring Traffic Shaper Defaults ................................................................................................... 283
Working with Wireless Networks .................................................................................................... 285
Overview ......................................................................................................................................... 285
Configuring Wireless Networks ...................................................................................................... 294
Troubleshooting Wireless Connectivity .......................................................................................... 321
Viewing Reports ................................................................................................................................ 325
Viewing the UTM-1 Appliance Status ............................................................................................ 325
Using the Traffic Monitor ............................................................................................................... 330
Viewing Computers ........................................................................................................................ 333
Viewing Connections ...................................................................................................................... 336
Viewing Network Statistics ............................................................................................................. 337
Viewing the Routing Table ............................................................................................................. 348
Viewing Wireless Station Statistics ................................................................................................ 350
Contents
iii
Contents
Viewing Logs ..................................................................................................................................... 353
Viewing the Event Log ................................................................................................................... 353
Viewing the Security Log ............................................................................................................... 357
Setting Your Security Policy ............................................................................................................ 365
The UTM-1 Firewall Security Policy .............................................................................................. 366
Default Security Policy ................................................................................................................... 367
Setting the Firewall Security Level ................................................................................................. 368
Configuring Servers ........................................................................................................................ 371
Using Rules ..................................................................................................................................... 374
Using Port-Based Security .............................................................................................................. 386
Using Secure HotSpot ..................................................................................................................... 391
Using NAT Rules ............................................................................................................................ 396
Using the EAP Authenticator .......................................................................................................... 404
Using SmartDefense .......................................................................................................................... 421
Overview ......................................................................................................................................... 421
Configuring SmartDefense .............................................................................................................. 422
SmartDefense Categories ................................................................................................................ 429
Resetting SmartDefense to its Defaults ........................................................................................... 475
Using Antivirus and Antispam Filtering ......................................................................................... 477
Overview ......................................................................................................................................... 477
Using VStream Antivirus ................................................................................................................ 479
Using VStream Antispam ............................................................................................................... 495
Using Centralized Email Filtering ................................................................................................... 525
Using Web Content Filtering ........................................................................................................... 531
Overview ......................................................................................................................................... 531
Using Web Rules ............................................................................................................................ 532
Using Web Filtering ........................................................................................................................ 539
iv
Check Point UTM-1 Embedded NGX User Guide
Contents
Customizing the Access Denied Page ............................................................................................. 545
Updating the Firmware .................................................................................................................... 547
Overview ......................................................................................................................................... 547
Using Software Updates .................................................................................................................. 548
Updating the Firmware Manually ................................................................................................... 550
SMART Management and Subscription Services .......................................................................... 553
Connecting to a Service Center ....................................................................................................... 554
Viewing Services Information ........................................................................................................ 559
Refreshing Your Service Center Connection .................................................................................. 560
Configuring Your Account ............................................................................................................. 560
Disconnecting from Your Service Center ....................................................................................... 561
Working with VPNs .......................................................................................................................... 563
Overview ......................................................................................................................................... 563
Setting Up Your UTM-1 Appliance as a VPN Server .................................................................... 570
Adding and Editing VPN Sites........................................................................................................ 583
Viewing and Deleting VPN Sites .................................................................................................... 615
Enabling/Disabling a VPN Site ....................................................................................................... 615
Logging in to a Remote Access VPN Site ...................................................................................... 616
Logging Out of a Remote Access VPN Site ................................................................................... 619
Using Certificates ............................................................................................................................ 619
Viewing VPN Tunnels .................................................................................................................... 629
Viewing IKE Traces for VPN Connections .................................................................................... 631
Viewing VPN Topology ................................................................................................................. 633
Managing Users ................................................................................................................................. 635
Changing Your Login Credentials .................................................................................................. 635
Adding and Editing Users ............................................................................................................... 637
Adding Quick Guest HotSpot Users ............................................................................................... 642
Contents
v
Contents
Viewing and Deleting Users ........................................................................................................... 643
Setting Up Remote VPN Access for Users ..................................................................................... 644
Using RADIUS Authentication ....................................................................................................... 645
Configuring RADIUS Attributes .................................................................................................... 650
Using Remote Desktop ...................................................................................................................... 655
Overview ......................................................................................................................................... 655
Workflow ........................................................................................................................................ 656
Configuring Remote Desktop.......................................................................................................... 656
Configuring the Host Computer ...................................................................................................... 659
Accessing a Remote Computer's Desktop ....................................................................................... 661
Controlling the Appliance via the Command Line ........................................................................ 665
Overview ......................................................................................................................................... 665
Using the UTM-1 Portal.................................................................................................................. 666
Using the Serial Console ................................................................................................................. 668
Configuring SSH ............................................................................................................................. 670
Maintenance ...................................................................................................................................... 673
Viewing Firmware Status ................................................................................................................ 673
Upgrading Your License ................................................................................................................. 675
Configuring a Gateway Hostname .................................................................................................. 677
Configuring Syslog Logging ........................................................................................................... 678
Configuring HTTPS ........................................................................................................................ 680
Configuring SNMP ......................................................................................................................... 683
Setting the Time on the Appliance .................................................................................................. 687
Using Diagnostic Tools ................................................................................................................... 691
Backing Up and Restoring the UTM-1 Appliance Configuration ................................................... 706
Using Rapid Deployment ................................................................................................................ 712
Resetting the UTM-1 Appliance to Defaults ................................................................................... 715
vi
Check Point UTM-1 Embedded NGX User Guide
Contents
Running Diagnostics ....................................................................................................................... 717
Rebooting the UTM-1 Appliance .................................................................................................... 718
Using Network Printers .................................................................................................................... 721
Overview ......................................................................................................................................... 721
Setting Up Network Printers ........................................................................................................... 722
Configuring Computers to Use Network Printers ........................................................................... 724
Viewing Network Printers ............................................................................................................... 741
Changing Network Printer Ports ..................................................................................................... 741
Resetting Network Printers ............................................................................................................. 743
Troubleshooting ................................................................................................................................ 745
Connectivity .................................................................................................................................... 745
Service Center and Upgrades .......................................................................................................... 749
Other Problems ............................................................................................................................... 749
Specifications ..................................................................................................................................... 751
Technical Specifications ................................................................................................................. 751
CE Declaration of Conformity ........................................................................................................ 762
Glossary of Terms ............................................................................................................................. 775
Index ................................................................................................................................................... 781
Contents
vii
About Your Check Point UTM-1 Embedded NGX Appliance
About This Guide
To make finding information in this guide easier, some types of information are marked with
special symbols or formatting.
Boldface type is used for command and button names.
Note: Notes are denoted by indented text and preceded by the Note icon.
Warning: Warnings are denoted by indented text and preceded by the Warning icon.
Each task is marked with an icon indicating the UTM-1 product required to perform the task,
as follows:
If this icon appears...
You can perform the task using these products...
All UTM-1 Edge N products
All UTM-1 Edge NW products
All UTM-1 Edge W products
Only UTM-1 products with USB ports
Only UTM-1 products with ADSL
Only UTM-1 products without ADSL
Chapter 1: About This Guide
ix
About Your Check Point UTM-1 Embedded NGX Appliance
Chapter 1
Introduction
This chapter introduces the Check Point UTM-1 appliance and this guide.
This chapter includes the following topics:
About Your Check Point UTM-1 Embedded NGX Appliance ....................1
UTM-1 Edge Series Products .......................................................................2
UTM-1 Edge N Series Features ....................................................................3
UTM-1 Edge NW Series Features ................................................................8
UTM-1 Edge W Series Features .................................................................14
Optional Security Services .........................................................................19
Software Requirements ..............................................................................20
Getting to Know Your UTM-1 Edge N Appliance .....................................20
Getting to Know Your UTM-1 Edge N ADSL Appliance ......................... 24
Getting to Know Your UTM-1 Edge N Industrial Appliance .................... 30
Getting to Know Your UTM-1 Edge NW Appliance .................................34
Getting to Know Your UTM-1 Edge NW ADSL Appliance...................... 39
Getting to Know Your UTM-1 Edge W Appliance ....................................46
Getting to Know Your UTM-1 Edge W ADSL Appliance ........................ 50
Contacting Technical Support ....................................................................55
About Your Check Point UTM-1 Embedded NGX
Appliance
UTM-1 Unified Threat Management appliances deliver proven, tightly integrated security
features, to provide the perfect blend of simplicity and security. Based on the same Check
Point technologies that secure the Fortune 100, UTM-1 appliances deliver uncompromising
security, while streamlining deployment and administration.
UTM-1 appliances integrate a complete set of security features into a single, easy-to-install
unit, including firewall, VPN, intrusion prevention, antivirus, antispam, Web filtering,
reporting & monitoring, and Network Access Control (NAC). In addition, UTM-1
appliances offer powerful networking capabilities, including advanced routing, traffic
shaping, high availability, redundant Internet connections, and extensive VLAN support.
Chapter 1: Introduction
1
UTM-1 Edge Series Products
All UTM-1 appliances can be integrated into an overall enterprise security policy for
maximum security. Check Point's Security Management Architecture (SMART) delivers a
single enterprise-wide security policy that you can centrally manage and automatically
deploy to an unlimited number of UTM-1 gateways.
The UTM-1 line of Embedded NGX appliances includes the following series:

UTM-1 Edge N Series

UTM-1 Edge NW Series

UTM-1 Edge W Series
UTM-1 Edge Series Products
The UTM-1 product families include various hardware series and models, as described in
the following tables. You can upgrade your UTM-1 Edge appliance to a more advanced
model within its hardware series, without replacing the hardware. Contact your reseller for
more details.
Table 1: UTM-1 Edge N Products
Hardware Series
Models
UTM-1 Edge N
UTM-1 Edge N16
UTM-1 Edge N32
UTM-1 Edge NU
UTM-1 Edge N ADSL
UTM-1 Edge N16 ADSL
UTM-1 Edge N32 ADSL
UTM-1 Edge NU ADSL
2
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge N Series Features
Table 2: UTM-1 Edge NW Products
Hardware Series
Models
UTM-1 Edge NW
UTM-1 Edge NW16
UTM-1 Edge NW32
UTM-1 Edge NWU
UTM-1 Edge NW ADSL
UTM-1 Edge NW16 ADSL
UTM-1 Edge NW32 ADSL
UTM-1 Edge NWU ADSL
Table 3: UTM-1 Edge W Products
Hardware Series
Models
UTM-1 Edge W
UTM-1 Edge W8
UTM-1 Edge W ADSL
UTM-1 Edge W8 ADSL
UTM-1 Edge N Series Features
Table 4: UTM-1 Edge N Series Features
Feature
SKU Prefix
Concurrent Users
UTM-1 Edge N
UTM-1 Edge N ADSL
CPUTM-EDGE-Nn
CPUTM-EDGE-Nn-ADSL
16 / 32 / Unlimited
Capacity
Firewall Throughput
Chapter 1: Introduction
1 Gbps
3
UTM-1 Edge N Series Features
VPN Throughput
200 Mbps
Concurrent Firewall
60,000
Connections
Hardware Features
4-Port LAN Switch
WAN Port
ADSL Standards
Ethernet, 10/100/1000 Mbps
Ethernet, 10/100/1000 Mbps
ADSL2+
—
ADSL2, ADSL2+, T.1413
G.DMT (G.992.1)
G.Lite (G.992.2)
Either:
ANNEX A (ADSL over POTS)
Or:
ANNEX B (ADSL over ISDN)
DMZ/WAN2 Port
Ethernet / SFP, 10/100/1000 Mbps
Dialup Backup
With external serial / USB modem
Console Port (Serial)
ExpressCard Port
—
Terminal Server
Print Server
—
USB 2.0 Ports
—
2
Firewall & Security Features
Check Point Stateful
4
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge N Series Features
Inspection Firewall
Application Intelligence
SmartDefense™ (IPS)
Network Address
Translation (NAT)
Four Preset Security
Policies
Anti-spoofing
Voice over IP Support
SIP, H.323
Unlimited INSPECT Policy
Rules
Instant Messenger
Blocking / Monitoring
P2P File Sharing Blocking /
Monitoring
Port-based and Tag-based
5 / 64
VLAN
Port-based Security
(802.1x)
EAP Authenticator
Web Rules
Secure HotSpot (Guest
Access)
Chapter 1: Introduction
5
UTM-1 Edge N Series Features
VPN
Remote Access Users
VPN Server with
Unlimited
Check Point VPN Clients, L2TP
OfficeMode and RADIUS
Support
Site-to-Site VPN Gateway
Route-based VPN
Backup VPN Gateways
Remote Access VPN Client
SecuRemote / SecureClient / L2TP / Endpoint Connect
Site-to-Site VPN Tunnels
400
(Managed)
IPSEC Features
Hardware accelerated DES, 3DES, AES, MD5, SHA-1, Hardware
Random Number Generator (RNG), Internet Key Exchange (IKE),
Perfect Forward Secrecy (PFS), IPSEC Compression, IPSEC NAT
Traversal (NAT-T)
Networking
Supported Internet
Connection Methods
Static IP, DHCP, PPPoE, PPTP,
Static IP, DHCP, PPPoE, PPTP,
Telstra, Cable, Dialup
Telstra, Cable, Dialup, EoA,
PPPoA, IPoA
Transparent Bridge Mode
Spanning Tree Protocol
(STP)
Traffic Shaper (QoS)
6
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge N Series Features
Traffic Monitoring
Dead Internet Connection
Detection (DCD)
WAN Load Balancing
Backup Internet
Connection
DHCP Server, Client, and
Relay
DHCP Leases
1024
DNS Server
MAC Cloning
Network Address
Translation (NAT) Rules
Static Routes, Source
Routes, and
Service-Based Routes
Ethernet Cable Type
Recognition
DiffServ Tagging
Automatic Gateway
Failover (HA)
Multicast Routing
Dynamic Routing
Chapter 1: Introduction
7
UTM-1 Edge NW Series Features
Management
Central Management
Check Point SmartCenter, Check Point SmartLSM, Check Point
SmartUpdate, Check Point Provider-1, Check Point SMP
Local Management
Remote Desktop
Local Diagnostics Tools
HTTP / HTTPS / SSH / SNMP / Serial CLI
Integrated Microsoft Terminal Services Client
Ping, WHOIS, Packet Sniffer, Status Monitor, Traffic Monitor, My
Computers Display, Connection Table Display, Network Interface
Monitor, VPN Tunnel Monitor, Routing Table Display, Event Log,
Security Log
NTP Automatic Time
Setting
Rapid Deployment
Hardware Specifications
Power
Mounting Options
100-240 VAC, 50-60 Hz (Depending on Country)
Desktop, Wall, or Rack Mounting*
Warranty
1 Year Hardware
* Rack mounting requires the optional rack mounting kit (sold separately).
UTM-1 Edge NW Series Features
Table 5: UTM-1 Edge NW Series Features
Feature
SKU Prefix
8
UTM-1 Edge NW
UTM-1 Edge NW ADSL
CPUTM-EDGE-NWn
CPUTM-EDGE-NWn-ADSL
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge NW Series Features
Concurrent Users
16 / 32 / Unlimited
Capacity
Firewall Throughput
1 Gbps
VPN Throughput
200 Mbps
Concurrent Firewall Connections
60,000
Hardware Features
4-Port LAN Switch
WAN Port
Ethernet 10/100/1,000 Mbps
Ethernet
ADSL2+
10/100/1000 Mbps
ADSL Standards
—
ADSL2, ADSL2+, T.1413
G.DMT (G.992.1)
G.Lite (G.992.2)
ANNEX A (ADSL over
POTS), ANNEX B (ADSL
over ISDN)
DMZ/WAN2 Port
Ethernet 10/100/1,000 Mbps
Dialup Backup (Req. Ext. Modem)
Console Port (Serial)
ExpressCard Port
—
Print Server
USB 2.0 Ports
Chapter 1: Introduction
2
1
9
UTM-1 Edge NW Series Features
Firewall & Security Features
Check Point Stateful Inspection
Firewall
Application Intelligence (IPS)
Intrusion Detection and
Prevention using Check Point
SmartDefense
Network Address Translation
(NAT)
Four Preset Security Policies
Anti-spoofing
Voice over IP Support
SIP, H.323
Unlimited INSPECT Policy Rules
Instant Messenger Blocking /
Monitoring
P2P File Sharing Blocking /
Monitoring
Port-based, Tag-based, and
5 / 64
Other VLAN
Port-based Security (802.1x)
Web Rules
Secure HotSpot (Guest Access)
10
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge NW Series Features
VPN
Remote Access Users
VPN Server with OfficeMode and
Unlimited
Check Point VPN Clients, L2TP
RADIUS Support
Site-to-Site VPN Gateway
Route-based VPN
Backup VPN Gateways
Remote Access VPN Client
SecuRemote / SecureClient / L2TP / Endpoint Connect
Site-to-Site VPN Tunnels
400
(Managed)
IPSEC Features
Hardware accelerated DES, 3DES, AES, MD5, SHA-1,
Hardware Random Number Generator (RNG), Internet Key
Exchange (IKE), Perfect Forward Secrecy (PFS), IPSEC
Compression, IPSEC NAT Traversal (NAT-T)
Networking
Supported Internet Connection
Methods
Static IP, DHCP, PPPoE,
Static IP, DHCP, PPPoE,
PPTP, Telstra, Cable,
PPTP, Telstra, Cable,
Dialup
Dialup, EoA, PPPoA, IPoA
Transparent Bridge Mode
Spanning Tree Protocol (STP)
Traffic Shaper (QoS)
Traffic Monitoring
Chapter 1: Introduction
11
UTM-1 Edge NW Series Features
Dead Internet Connection
Detection (DCD)
WAN Load Balancing
Backup Internet Connection
DHCP Server, Client, and Relay
DHCP Leases
1024
MAC Cloning
Network Address Translation
(NAT) Rules
Static Routes, Source Routes,
and Service-Based Routes
Ethernet Cable Type Recognition
DiffServ Tagging
Automatic Gateway Failover (HA)
Multicast Routing
Dynamic Routing
Wireless
Wireless Protocols
802.11b (11 Mbps), 802.11g (54 Mbps), 802.11n (300
Mbps)
Wireless Security
VPN over Wireless, WEP, WPA2 (802.11i), WPA-Personal,
WPA-Enterprise, 802.1x
12
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge NW Series Features
Wireless QoS (WMM)
Dual Diversity Antennas
Virtual Access Points (VAP)
Wireless Distribution System
(WDS) Links
Wireless Range (Standard Mode)
Wireless Range (XR Mode)*
Up to 100 m Indoors and 300 m Outdoors
Up to 300 m Indoors and 1 km Outdoors
Management
Central Management
Check Point SmartCenter, Check Point SmartLSM, Check
Point SmartUpdate, Check Point Provider-1, Check Point
SMP
Local Management
Remote Desktop
Local Diagnostics Tools
HTTP / HTTPS / SSH / SNMP / Serial CLI
Integrated Microsoft Terminal Services Client
Ping, WHOIS, Packet Sniffer, VPN Tunnel Monitor,
Connection Table Monitor, Wireless Monitor, My
Computers Display, Routing Table Display, Local Logs
NTP Automatic Time Setting
Rapid Deployment
Hardware Specifications
Power
Mounting Options
Chapter 1: Introduction
100-240 VAC, 50-60 Hz (Depending on Country)
Desktop, Wall, or Rack Mounting**
13
UTM-1 Edge W Series Features
Warranty
1 Year Hardware
* Super G and XR mode are only available with select wireless network adapters. Actual
ranges are subject to change in different environments.
** Rack mounting requires the optional rack mounting kit (sold separately).
UTM-1 Edge W Series Features
Table 6: UTM-1 Edge W Series Features
Feature
SKU Prefix
UTM-1 Edge W
UTM-1 Edge W ADSL
CPUTM-EDGE-WG
CPUTM-EDGE-WG-n-AD
SL
Concurrent Users
8/16/32/U
Capacity
Firewall Throughput
190 Mbps
VPN Throughput
35 Mbps
Concurrent Firewall Connections
8,000
Hardware Features
4-Port LAN Switch
WAN Port
ADSL Standards
10/100 Mbps
10/100 Mbps
ADSL2+
—
ADSL2, ADSL2+, T.1413
G.DMT (G.992.1)
G.Lite (G.992.2)
ANNEX A (ADSL over
14
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge W Series Features
POTS), ANNEX B (ADSL
over ISDN)
DMZ/WAN2 Port
10/100 Mbps
Dialup Backup (Req. Ext. Modem)
Console Port (Serial)
Print Server
USB 2.0 Ports
2
Firewall & Security Features
Check Point Stateful Inspection
Firewall
Application Intelligence (IPS)
Intrusion Detection and
Prevention using Check Point
SmartDefense
Network Address Translation
(NAT)
Four Preset Security Policies
Anti-spoofing
Voice over IP Support
SIP, H.323
Unlimited INSPECT Policy Rules
Instant Messenger Blocking /
Monitoring
Chapter 1: Introduction
15
UTM-1 Edge W Series Features
P2P File Sharing Blocking /
Monitoring
Port-based, Tag-based, and
32 (WU) / 10 (Other Models)
Other VLAN
Port-based Security (802.1x)
Web Rules
Secure HotSpot (Guest Access)
VPN
Remote Access Users
VPN Server with OfficeMode and
1/10/15/25
Check Point VPN Clients, L2TP
RADIUS Support
Site-to-Site VPN Gateway
Route-based VPN
Backup VPN Gateways
Remote Access VPN Client
Site-to-Site VPN Tunnels
SecuRemote / SecureClient / L2TP / Endpoint Connect
100
(Managed)
IPSEC Features
Hardware-accelerated DES, 3DES, AES, MD5, SHA-1,
Hardware Random Number Generator (RNG), Internet Key
Exchange (IKE), Perfect Forward Secrecy (PFS), IPSEC
Compression, IPSEC NAT Traversal (NAT-T), IPSEC VPN
Pass-through
16
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge W Series Features
Networking
Supported Internet Connection
Methods
Static IP, DHCP, PPPoE,
Static IP, DHCP, PPPoE,
PPTP, Telstra, Cable, Dialup
PPTP, Telstra, Cable,
Dialup, EoA, PPPoA, IPoA
Transparent Bridge Mode
Spanning Tree Protocol (STP)
Traffic Shaper (QoS)
Traffic Monitoring
Dead Internet Connection
Detection (DCD)
WAN Load Balancing
Backup Internet Connection
DHCP Server, Client, and Relay
MAC Cloning
Network Address Translation
(NAT) Rules
Static Routes, Source Routes,
and Service-Based Routes
Ethernet Cable Type Recognition
DiffServ Tagging
Automatic Gateway Failover (HA)
Chapter 1: Introduction
17
UTM-1 Edge W Series Features
Multicast Routing
Dynamic Routing
Wireless
Wireless Protocols
802.11b (11 Mbps), 802.11g (54 Mbps), Super G* (108
Mbps)
Wireless Security
VPN over Wireless, WEP, WPA2 (802.11i), WPA-Personal,
WPA-Enterprise, 802.1x
Wireless QoS (WMM)
Dual Diversity Antennas
Virtual Access Points (VAP)
Wireless Distribution System
(WDS) Links
Wireless Range (Standard Mode)
Wireless Range (XR Mode)*
Up to 100 m Indoors and 300 m Outdoors
Up to 300 m Indoors and 1 km Outdoors
Management
Central Management
Check Point SmartCenter, Check Point SmartLSM, Check
Point SmartUpdate, Check Point Provider-1, Check Point
SMP
Local Management
Remote Desktop
Local Diagnostics Tools
HTTP / HTTPS / SSH / SNMP / Serial CLI
Integrated Microsoft Terminal Services Client
Ping, WHOIS, Packet Sniffer, VPN Tunnel Monitor,
Connection Table Monitor, Wireless Monitor, My
18
Check Point UTM-1 Embedded NGX User Guide
Optional Security Services
Computers Display, Routing Table Display, Local Logs
NTP Automatic Time Setting
Rapid Deployment
Hardware Specifications
Power
100/110/120/210/220/230VAC (Linear Power Adapter) or
100~240VAC (Switched Power Adapter)
Mounting Options
Desktop, Wall, or Rack Mounting**
Warranty
1 Year Hardware
* Super G and XR mode are only available with select wireless network adapters. Actual
ranges are subject to change in different environments.
* Rack mounting requires the optional rack mounting kit (sold separately).
Optional Security Services
The following subscription security services are available to UTM-1 owners by connecting
to a Service Center:

Firewall Security and Software Updates

Web Filtering

Email Antivirus and Antispam Protection

VStream Embedded Antivirus Updates

VStream Embedded Antispam Service

Dynamic DNS Service

VPN Management

Security Reporting

Vulnerability Scanning Service
Chapter 1: Introduction
19
Software Requirements
These services require an additional purchase of subscription. For more information, contact
your Check Point reseller.
Software Requirements
One of the following browsers:

Microsoft Internet Explorer 6.0 or higher

Netscape Navigator 6.0 and higher

Mozilla Firefox
Note: For proper operation of the UTM-1 Portal, disable any pop-up blockers for
http://my.firewall.
Getting to Know Your UTM-1 Edge N Appliance
Package Contents
The UTM-1 Edge N package includes the following:

UTM-1 Edge N Internet Security Appliance

Power adapter

CAT5 Straight-through Ethernet cable

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9)
Network Requirements

20
10BaseT or 100BaseT or 1000BaseT Network Interface Card installed on each
computer
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N Appliance

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

A broadband Internet connection via cable or DSL modem with Ethernet interface
(RJ-45)
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 1: UTM-1 Edge N Appliance Rear Panel
The following table lists the UTM-1 Edge N appliance's rear panel elements.
Table 7: UTM-1 Edge N Appliance Rear Panel Elements
Label
LAN 1-4
Description
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices
DMZ/
A dedicated Ethernet port (RJ-45) used to connect a DMZ (Demilitarized Zone)
WAN2
computer or network. Alternatively, can serve as a secondary WAN port or as a
VLAN trunk.
WAN
Wide Area Network: An Ethernet port (RJ-45) used for connecting your broadband
modem, a wide area network router, or a network leading to the Internet
Chapter 1: Introduction
21
Getting to Know Your UTM-1 Edge N Appliance
Label
Serial
Description
A serial (RS-232) port used for connecting computers in order to access the UTM-1
CLI (Command Line Interface), for using the terminal server, or for connecting an
external dialup modem.
An RJ-45 to DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (10 seconds or until SYS LED begins to blink rapidly). Resets the
UTM-1 appliance to its factory defaults, and resets your firmware to the
version that shipped with the UTM-1 appliance. This results in the loss of
all security services and passwords and reverting to the factory default
firmware. You will have to re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
PWR
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
Front Panel
The UTM-1 Edge N appliance includes several status LEDs that enable you to monitor the
appliance’s operation.
Figure 2: UTM-1 Edge N Appliance Front Panel
For an explanation of the UTM-1 Edge N appliance’s status LEDs, see the table below.
22
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N Appliance
Table 8: UTM-1 Edge N Appliance Status LEDs
LED
State
Explanation
Power
Off
Power off
On (Green)
Normal operation
On (Red)
Boot failed or TFTP mode
Flashing quickly (Red)
High temperature or system failure
Flashing slowly (Orange)
Writing update to flash memory
Flashing quickly (Green)
System boot in progress
Flashing slowly (Green)
Establishing Internet connection
On (Green)
Normal operation
Off
Normal operation
Flashing for 5 sec (Orange)
Virus blocked
Flashing for 1 sec (Red)
Hacker attack blocked
System
Security
GbE Status
(WAN / DMZ /
LAN 1-4)
1000Mbps Off,
LINK/ACT Off
No Link
1000Mbps Off,
10 Mbps link established for the corresponding
LINK/ACT On (Green)
port
1000Mbps On (Orange),
100 Mbps link established for the corresponding
LINK/ACT On
port
1000Mbps On (Green),
1000 Mbps link established for the corresponding
LINK/ACT On
port
Chapter 1: Introduction
23
Getting to Know Your UTM-1 Edge N ADSL Appliance
1000Mbps Off,
LINK/ACT Flashing (Green)
1000Mbps On (Orange),
LINK/ACT Flashing (Green)
1000Mbps On (Green),
LINK/ACT Flashing (Green)
VPN
RS232/Serial
10 Mbps link established for the corresponding
port
Data is being transmitted/received
100 Mbps link established for the corresponding
port
Data is being transmitted/received
1000 Mbps link established for the corresponding
port
Data is being transmitted/received
Off
No VPN tunnel established
On (Green)
VPN idle / No activity
Flashing (Green)
VPN activity
Off
No data terminal connected
On (Green)
Data terminal ready
Flashing (Green)
Serial activity
Getting to Know Your UTM-1 Edge N ADSL
Appliance
Package Contents
The UTM-1 Edge N ADSL package includes the following:

UTM-1 Edge N ADSL Internet Security Appliance

Power adapter

CAT5 Straight-through Ethernet cable
24
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N ADSL Appliance

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9)

RJ11 telephone cable
Network Requirements

10BaseT or 100BaseT or 1000BaseT Network Interface Card installed on each
computer

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

An ADSL line suitable for your appliance model:


 For Annex A ADSL models, an ADSL over POTS line (regular telephone line)
 For Annex B ADSL models, an ADSL over ISDN line (digital line)
A splitter with a micro-filter, installed on all the jacks connected to the same
phone line
If desired, you can connect your appliance to an external broadband Internet
connection via a cable or DSL modem with an Ethernet interface (RJ-45).
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 3: UTM-1 Edge N ADSL Appliance Rear Panel
The following table lists the UTM-1 Edge N ADSL appliance's rear panel elements.
Chapter 1: Introduction
25
Getting to Know Your UTM-1 Edge N ADSL Appliance
Table 9: UTM-1 Edge N ADSL Appliance Rear Panel Elements
Label
LAN 1-4
Description
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices
DMZ/
DMZ/WAN2 switch: Two ports used for connecting a DMZ (Demilitarized Zone)
WAN2
computer or network:

An Ethernet port (RJ-45) on the left

An SFP (Small Form-factor Pluggable) port on the right
Alternatively, can serve as a secondary WAN port or as a VLAN trunk.
Only one of these ports can be used at a time.
DSL
An RJ-11 ADSL port used for connecting the integrated ADSL modem to an ADSL
line.
A splitter with a micro-filter is usually required when connecting this port to the
phone jack. If unsure, check with your ADSL service provider.
Before connecting this port to the line, make sure that you are using the correct
UTM-1 model for your phone line: Annex A for POTS (regular) phone lines, and
Annex B for ISDN (digital) phone lines. Your UTM-1 model's ADSL annex type
appears on the bottom of the appliance.
Serial
A serial (RS-232) port used for connecting computers in order to access the UTM-1
CLI (Command Line Interface), for using the terminal server, or for connecting an
external dialup modem.
An RJ-45 to DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
USB
Two USB 2.0 ports used for connecting USB-based printers or modems
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.
26
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N ADSL Appliance
Label
Description

Short press. Reboots the UTM-1 appliance

Long press (10 seconds or until the SYS LED begins to blink rapidly). Resets the
UTM-1 appliance to its factory defaults, and resets your firmware to the
version that shipped with the UTM-1 appliance. This results in the loss of
all security services and passwords and reverting to the factory default
firmware. You will have to re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
PWR
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
Side Panel
The side panel includes a slot for inserting an ExpressCard cellular modem.
Figure 4: UTM-1 Edge N ADSL Appliance Side Panel
Front Panel
The UTM-1 Edge N ADSL appliance includes several status LEDs that enable you to
monitor the appliance’s operation.
Figure 5: UTM-1 Edge N ADSL Appliance Front Panel
For an explanation of the UTM-1 Edge N ADSL appliance’s status LEDs, see the table
below.
Chapter 1: Introduction
27
Getting to Know Your UTM-1 Edge N ADSL Appliance
Table 10: UTM-1 Edge N ADSL Appliance Status LEDs
LED
State
Explanation
Power
Off
Power off
On (Green)
Normal operation
On (Red)
Boot failed or TFTP mode
Flashing quickly (Red)
High temperature or system failure
Flashing slowly (Orange)
Writing update to flash memory
Flashing quickly (Green)
System boot in progress
Flashing slowly (Green)
Establishing Internet connection
On (Green)
Normal operation
Off
Normal operation
Flashing for 5 sec (Orange)
Virus blocked
Flashing for 1 sec (Red)
Hacker attack blocked
System
Security
GbE Status
(LAN 1-4 /
DMZ/WAN2)
28
1000Mbps Off,
LINK/ACT Off
No Link
1000Mbps Off,
10 Mbps link established for the corresponding
LINK/ACT On (Green)
port
1000Mbps On (Orange),
100 Mbps link established for the corresponding
LINK/ACT On
port
1000Mbps On (Green),
1000 Mbps link established for the corresponding
LINK/ACT On
port
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N ADSL Appliance
1000Mbps Off,
LINK/ACT Flashing (Green)
1000Mbps On (Orange),
LINK/ACT Flashing (Green)
1000Mbps On (Green),
LINK/ACT Flashing (Green)
DSL
VPN
RS232/Serial
USB
10 Mbps link established for the corresponding
port
Data is being transmitted/received
100 Mbps link established for the corresponding
port
Data is being transmitted/received
1000 Mbps link established for the corresponding
port
Data is being transmitted/received
Link Off
Link is down
Link Flashing
Establishing ADSL connection
Link On
ADSL connection established
DAT Off
ADSL line is idle
DAT Flashing
Data is being transmitted/received
Off
No VPN tunnel established
On (Green)
VPN idle / No activity
Flashing (Green)
VPN activity
Off
No data terminal connected
On (Green)
Data terminal ready
Flashing (Green)
Serial activity
Off
No USB device connected
On (Green)
USB device connected
Chapter 1: Introduction
29
Getting to Know Your UTM-1 Edge N Industrial Appliance
EXC
Flashing (Green)
Activity on the USB device
Off
No ExpressCard connected
On (Green)
ExpressCard connected
Flashing (Green)
Activity on the ExpressCard
Getting to Know Your UTM-1 Edge N Industrial
Appliance
A growing number of manufacturing companies are controlling machines on the production
floor over Ethernet. When equipment is exposed to mixed networks of Industrial Ethernet
and TCP/IP, it is also exposed to the threat of network attacks, malware, and security
configuration errors, which can lead to downtime, equipment damage, or even personal
injury.
Especially designed for industrial use, the UTM-1 Edge N Industrial appliance protects
Industrial Ethernet environments, as well as supervisory control and data acquisition
(SCADA) equipment, from unauthorized access and attacks. The UTM-1 Edge N Industrial
appliance features the following design elements:

Designed solid state with no moving parts, for durability in extreme industrial
environments

Industrial enclosure with flexible DIN-rail and rack mounting options

Flexible power input options (12V or 24V DC)

Ports located on the appliance's front for easy access
Package Contents
The UTM-1 Edge N Industrial package includes the following:

UTM-1 Edge N Industrial Internet Security Appliance

12V DC power adapter and four plug adapters

Industrial DC connector plug

CAT5 Straight-through Ethernet cable
30
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N Industrial Appliance

Serial to Ethernet cable

USB extension cable

Wall mounting screws and anchors

DIN rail mounting bracket
Network Requirements

10BaseT or 100BaseT Network Interface Card installed on each computer

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

One of the following:


A broadband Internet connection via cable or DSL modem with Ethernet
interface (RJ-45)
A dialup modem with a USB or serial interface
Rear Panel
Figure 6: UTM-1 Edge N Industrial Appliance Rear Panel
The following table lists the UTM-1 Edge N Industrial appliance's rear panel elements.
Table 11: UTM-1 Edge N Industrial Appliance Rear Panel Elements
Element
12V, 2A
Description
A power jack used for supplying 12V power to the unit. Connect the supplied 12V
DC power adapter to this jack.
Circular holes
Holes for the DIN rail bracket's screws.
Chapter 1: Introduction
31
Getting to Know Your UTM-1 Edge N Industrial Appliance
Element
Description
Note: Additional holes appear on each of the appliance's side panels.
For information on mounting the appliance on a DIN rail, see Mounting the
UTM-1 N Industrial Appliance on a DIN Rail on page 90.
Front Panel
The UTM-1 Edge N Industrial appliance's front panel includes ports for network and power
connections, as well as status LEDs that enable you to monitor the appliance’s operation.
Figure 7: UTM-1 Edge N Industrial Appliance Front Panel
The following table lists the UTM-1 Edge N Industrial appliance's front panel elements.
Table 12: UTM-1 Edge N Industrial Appliance Front Panel Elements
Label
LAN 1-4
Description
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices.
DMZ/
A dedicated Ethernet port (RJ-45) and a fiber optic port can be used to connect a
WAN2
DMZ (Demilitarized Zone) computer or network. Alternatively, they can serve as a
secondary WAN port or as a VLAN trunk.
Do not use both of these ports at the same time.
WAN
Wide Area Network: An Ethernet port (RJ-45) used for connecting your broadband
modem, a wide area network router, or a network leading to the Internet.
32
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge N Industrial Appliance
Label
Serial
Description
An Ethernet (RJ-45) port used for connecting computers in order to access the
UTM-1 CLI (Command Line Interface), for using the terminal server, or for
connecting an external dialup modem.
USB
USB 2.0 port used for connecting USB-based printers or modems
Status
For an explanation of the UTM-1 Edge N Industrial appliance’s status LEDs, see the
LEDs
following table.
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (7 seconds). Resets the UTM-1 appliance to its factory defaults,
and resets your firmware to the version that shipped with the UTM-1
appliance. This results in the loss of all security services and passwords
and reverting to the factory default firmware. You will have to
re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
+12V ~
A power jack used for supplying +12V ~ +60V or -48V DC power to the unit. Connect
+60V or
the supplied DC connector plug to this jack.
-48V
Table 13: UTM-1 Edge N Industrial Appliance Status LEDs
LED
State
Explanation
Off
No Serial port activity
Flashing (Green)
Serial port activity
Off
No VPN activity
USB
SER
VPN
Chapter 1: Introduction
33
Getting to Know Your UTM-1 Edge NW Appliance
LED
SEC
State
Explanation
Flashing (Green)
VPN activity
On (Green)
VPN tunnels established, no activity
Flashing (Red)
Hacker attack blocked, or error occurred during
rapid deployment process
SYS
Flashing quickly (Green)
System boot-up, or rapid deployment in
progress
PWR
Flashing slowly (Green)
Establishing Internet connection
Off
Power off
On (Green)
Normal operation
On (Red)
Error
Getting to Know Your UTM-1 Edge NW Appliance
Package Contents
The UTM-1 Edge NW package includes the following:

UTM-1 Edge NW Wireless Security Appliance

Power adapter

CAT5 Straight-through Ethernet cable

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9)

Two antennas
34
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW Appliance

USB extension cable
Network Requirements

10BaseT or 100BaseT or 1000BaseT Network Interface Card installed on each
computer

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

An 802.11b, 802.11g, or 802.11n wireless card installed on each wireless station

A broadband Internet connection via cable or DSL modem, with Ethernet (RJ-45)
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 8: UTM-1 Edge NW Appliance Rear Panel
The following table lists the UTM-1 Edge NW appliance's rear panel elements.
Chapter 1: Introduction
35
Getting to Know Your UTM-1 Edge NW Appliance
Table 14: UTM-1 Edge NW Appliance Rear Panel Elements
Label
LAN 1-4
Description
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices
DMZ/
A dedicated Ethernet port (RJ-45) used to connect a DMZ (Demilitarized Zone)
WAN2
computer or network. Alternatively, can serve as a secondary WAN port or as a
VLAN trunk.
WAN
Wide Area Network switch: An Ethernet port (RJ-45) used for connecting your
broadband modem, a wide area network router, or a network leading to the Internet.
Serial
A serial (RS-232) port used for connecting computers in order to access the UTM-1
CLI (Command Line Interface), for using the terminal server, or for connecting an
external dialup modem.
An RJ-45 to DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
USB
Two USB 2.0 ports used for connecting USB-based printers or modems
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (10 seconds or until the SYS LED begins to blink rapidly). Resets the
UTM-1 appliance to its factory defaults, and resets your firmware to the
version that shipped with the UTM-1 appliance. This results in the loss of
all security services and passwords and reverting to the factory default
firmware. You will have to re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
PWR
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
36
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW Appliance
Label
ANT 1/
Description
Antenna connectors, used to connect the supplied wireless antennas.
ANT 2
Front Panel
The UTM-1 Edge NW appliance includes several status LEDs that enable you to monitor the
appliance’s operation.
Figure 9: UTM-1 Edge NW Appliance Front Panel
For an explanation of the UTM-1 Edge NW appliance’s status LEDs, see the table below.
Table 15: UTM-1 Edge NW Appliance Status LEDs
LED
State
Explanation
Power
Off
Power off
On (Green)
Normal operation
Chapter 1: Introduction
37
Getting to Know Your UTM-1 Edge NW Appliance
System
Security
GbE Status
(WAN / DMZ /
LAN 1-4)
On (Red)
Boot failed or TFTP mode
Flashing quickly (Red)
High temperature or system failure
Flashing slowly (Orange)
Writing update to flash memory
Flashing quickly (Green)
System boot in progress
Flashing slowly (Green)
Establishing Internet connection
On (Green)
Normal operation
Off
Normal operation
Flashing for 5 sec (Orange)
Virus blocked
Flashing for 1 sec (Red)
Hacker attack blocked
1000Mbps Off,
LINK/ACT Off
1000Mbps Off,
10 Mbps link established for the corresponding
LINK/ACT On (Green)
port
1000Mbps On (Orange),
100 Mbps link established for the corresponding
LINK/ACT On
port
1000Mbps On (Green),
1000 Mbps link established for the corresponding
LINK/ACT On
port
1000Mbps Off,
LINK/ACT Flashing (Green)
1000Mbps On (Orange),
LINK/ACT Flashing (Green)
38
No Link
10 Mbps link established for the corresponding
port
Data is being transmitted/received
100 Mbps link established for the corresponding
port
Data is being transmitted/received
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW ADSL Appliance
1000Mbps On (Green),
LINK/ACT Flashing (Green)
VPN
RS232/Serial
WLAN
port
Data is being transmitted/received
Off
No VPN tunnel established
On (Green)
VPN idle / No activity
Flashing (Green)
VPN activity
Off
No data terminal connected
On (Green)
Data terminal ready
Flashing (Green)
Serial activity
Off
WLAN not enabled/connected
On (Green)
USB
1000 Mbps link established for the corresponding
WLAN connected in idle /
No activity
Flashing (Green)
WLAN activity
Off
No USB device connected
On (Green)
USB device connected
Flashing (Green)
Activity on the USB device
Getting to Know Your UTM-1 Edge NW ADSL
Appliance
Package Contents
The UTM-1 Edge NW ADSL package includes the following:
Chapter 1: Introduction
39
Getting to Know Your UTM-1 Edge NW ADSL Appliance

UTM-1 Edge NW ADSL Wireless Security Appliance

Power adapter

CAT5 Straight-through Ethernet cable

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9)

Two antennas

USB extension cable

RJ11 telephone cable
Network Requirements

10BaseT or 100BaseT or 1000BaseT Network Interface Card installed on each
computer

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

An 802.11b, 802.11g, or 802.11n wireless card installed on each wireless station

An ADSL line suitable for your appliance model:


40
 For Annex A ADSL models, an ADSL over POTS line (regular telephone line)
 For Annex B ADSL models, an ADSL over ISDN line (digital line)
A splitter with a micro-filter, installed on all the jacks connected to the same
phone line
If desired, you can connect your appliance to an external broadband Internet
connection via a cable or DSL modem with an Ethernet interface (RJ-45).
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW ADSL Appliance
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 10: UTM-1 Edge NW ADSL Appliance Rear Panel
The following table lists the UTM-1 Edge NW ADSL appliance's rear panel elements.
Table 16: UTM-1 Edge NW ADSL Appliance Rear Panel Elements
Label
LAN 1-4
Description
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices
DMZ/
A dedicated Ethernet port (RJ-45) used to connect a DMZ (Demilitarized Zone)
WAN2
computer or network. Alternatively, can serve as a secondary WAN port or as a
VLAN trunk.
DSL
An RJ-11 ADSL port used for connecting the integrated ADSL modem to an ADSL
line.
Chapter 1: Introduction
41
Getting to Know Your UTM-1 Edge NW ADSL Appliance
Label
Description
A splitter with a micro-filter is usually required when connecting this port to the
phone jack. If unsure, check with your ADSL service provider.
Before connecting this port to the line, make sure that you are using the correct
UTM-1 model for your phone line: Annex A for POTS (regular) phone lines, and
Annex B for ISDN (digital) phone lines. Your UTM-1 model's ADSL annex type
appears on the bottom of the appliance.
Serial
A serial (RS-232) port used for connecting computers in order to access the UTM-1
CLI (Command Line Interface), for using the terminal server, or for connecting an
external dialup modem.
An RJ-45 to DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
USB
A USB 2.0 port used for connecting a USB-based printer or modem
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (10 seconds or until the SYS LED begins to blink rapidly). Resets the
UTM-1 appliance to its factory defaults, and resets your firmware to the
version that shipped with the UTM-1 appliance. This results in the loss of
all security services and passwords and reverting to the factory default
firmware. You will have to re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
PWR
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
ANT 1/
Antenna connectors, used to connect the supplied wireless antennas.
ANT 2
42
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW ADSL Appliance
Side Panel
The side panel includes a slot for inserting an ExpressCard cellular modem.
Figure 11: UTM-1 Edge NW ADSL Appliance Side Panel
Front Panel
The UTM-1 Edge NW ADSL appliance includes several status LEDs that enable you to
monitor the appliance’s operation.
Figure 12: UTM-1 Edge NW ADSL Appliance Front Panel
For an explanation of the UTM-1 Edge NW ADSL appliance’s status LEDs, see the table
below.
Chapter 1: Introduction
43
Getting to Know Your UTM-1 Edge NW ADSL Appliance
Table 17: UTM-1 Edge NW ADSL Appliance Status LEDs
LED
State
Explanation
Power
Off
Power off
On (Green)
Normal operation
On (Red)
Boot failed or TFTP mode
Flashing quickly (Red)
High temperature or system failure
Flashing slowly (Orange)
Writing update to flash memory
Flashing quickly (Green)
System boot in progress
Flashing slowly (Green)
Establishing Internet connection
On (Green)
Normal operation
Off
Normal operation
Flashing for 5 sec (Orange)
Virus blocked
Flashing for 1 sec (Red)
Hacker attack blocked
System
Security
GbE Status
(LAN 1-4 /
DMZ/WAN2)
44
1000Mbps Off,
LINK/ACT Off
No Link
1000Mbps Off,
10 Mbps link established for the corresponding
LINK/ACT On (Green)
port
1000Mbps On (Orange),
100 Mbps link established for the corresponding
LINK/ACT On
port
1000Mbps On (Green),
1000 Mbps link established for the corresponding
LINK/ACT On
port
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge NW ADSL Appliance
1000Mbps Off,
LINK/ACT Flashing (Green)
1000Mbps On (Orange),
LINK/ACT Flashing (Green)
1000Mbps On (Green),
LINK/ACT Flashing (Green)
DSL
VPN
RS232/Serial
USB
10 Mbps link established for the corresponding
port
Data is being transmitted/received
100 Mbps link established for the corresponding
port
Data is being transmitted/received
1000 Mbps link established for the corresponding
port
Data is being transmitted/received
Link Off
Link is down
Link Flashing
Establishing ADSL connection
Link On
ADSL connection established
DAT Off
ADSL line is idle
DAT Flashing
Data is being transmitted/received
Off
No VPN tunnel established
On (Green)
VPN idle / No activity
Flashing (Green)
VPN activity
Off
No data terminal connected
On (Green)
Data terminal ready
Flashing (Green)
Serial activity
Off
No USB device connected
On (Green)
USB device connected
Chapter 1: Introduction
45
Getting to Know Your UTM-1 Edge W Appliance
WLAN
Flashing (Green)
Activity on the USB device
Off
WLAN not enabled/connected
On (Green)
EXC
WLAN connected in idle /
No activity
Flashing (Green)
WLAN activity
Off
No ExpressCard connected
On (Green)
ExpressCard connected
Flashing (Green)
Activity on the ExpressCard
Getting to Know Your UTM-1 Edge W Appliance
Package Contents
The UTM-1 Edge W package includes the following:

UTM-1 Edge W Internet Security Appliance

Power adapter

CAT5 Straight-through Ethernet cable

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9); model SBXW-166LHGE-5 only

Two antennas

USB extension cable
Network Requirements

46
10BaseT or 100BaseT Network Interface Card installed on each computer
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge W Appliance

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

An 802.11b, 802.11g or 802.11 Super G wireless card installed on each wireless
station

A broadband Internet connection via cable or DSL modem with Ethernet interface
(RJ-45)
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 13: UTM-1 Edge W SBXW-166LHGE-5 Appliance Rear Panel
Figure 14: UTM-1 Edge W SBXW-166LHGE-6 Appliance Rear Panel
The following table lists the UTM-1 Edge W appliance's rear panel elements.
Table 18: UTM-1 Edge W Appliance Rear Panel Elements
Label
PWR
Description
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
Chapter 1: Introduction
47
Getting to Know Your UTM-1 Edge W Appliance
Label
RESET
Description
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (7 seconds). Resets the UTM-1 appliance to its factory defaults,
and resets your firmware to the version that shipped with the UTM-1
appliance. This results in the loss of all security services and passwords
and reverting to the factory default firmware. You will have to
re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
USB
Two USB 2.0 ports used for connecting USB-based printers or modems
Serial
A serial (RS-232) port used for connecting computers in order to access the UTM-1
CLI (Command Line Interface), for using the terminal server, or for connecting an
external dialup modem.
Depending on the appliance model, this port may have either a DB9 RS232
connector, or an RJ-45 connector. In models with an RJ-45 connector, an RJ-45 to
DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
WAN
Wide Area Network: An Ethernet port (RJ-45) used for connecting your broadband
modem, a wide area network router, or a network leading to the Internet.
DMZ/
A dedicated Ethernet port (RJ-45) used to connect a DMZ (Demilitarized Zone)
WAN2
computer or network. Alternatively, can serve as a secondary WAN port or as a
VLAN trunk.
LAN 1-4
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices.
ANT 1/
Antenna connectors, used to connect the supplied wireless antennas .
ANT 2
48
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge W Appliance
Front Panel
The UTM-1 Edge W appliance includes several status LEDs that enable you to monitor the
appliance’s operation.
Figure 15: UTM-1 Edge W Appliance Front Panel
For an explanation of the UTM-1 Edge W appliance’s status LEDs, see the table below.
Table 19: UTM-1 Edge W Appliance Status LEDs
LED
State
Explanation
PWR/SEC
Off
Power off
Flashing quickly (Green)
System boot-up, or rapid deployment in
progress
Flashing slowly (Green)
Establishing Internet connection
Flashing (Red)
Hacker attack blocked, or error occurred during
rapid deployment process
LAN 1-4/
On (Green)
Normal operation
On (Red)
Error
Flashing (Orange)
Software update in progress
LINK/ACT Off, 100 Off
Link is down
WAN/
DMZ/WAN2
Chapter 1: Introduction
49
Getting to Know Your UTM-1 Edge W ADSL Appliance
LED
State
Explanation
LINK/ACT On, 100 Off
10 Mbps link established for the corresponding
port
LINK/ACT On, 100 On
100 Mbps link established for the corresponding
port
VPN
Serial
USB
WLAN
LNK/ACT Flashing
Data is being transmitted/received
Off
No VPN activity
Flashing (Green)
VPN activity
On (Green)
VPN tunnels established, no activity
Off
No Serial port activity
Flashing (Green)
Serial port activity
Off
No USB port activity
Flashing (Green)
USB port activity
Off
No WLAN activity
Flashing (Green)
WLAN activity
Getting to Know Your UTM-1 Edge W ADSL
Appliance
Package Contents
The UTM-1 Edge W ADSL package includes the following:

50
UTM-1 Edge W ADSL Internet Security Appliance
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge W ADSL Appliance

Power adapter

CAT5 Straight-through Ethernet cable

Getting Started Guide

Wall mounting kit

RS232 serial adaptor (RJ45 to DB9)

Two antennas

USB extension cable

RJ11 telephone cable
Network Requirements

10BaseT or 100BaseT Network Interface Card installed on each computer

CAT 5 STP (Category 5 Shielded Twisted Pair) Straight Through Ethernet cable
for each attached device

An ADSL line suitable for your appliance model:

 For Annex A ADSL models, an ADSL over POTS line (regular telephone line)
 For Annex B ADSL models, an ADSL over ISDN line (digital line)
A splitter with a micro-filter, installed on all the jacks connected to the same
phone line

If desired, you can connect your appliance to an external broadband Internet
connection via a cable or DSL modem with an Ethernet interface (RJ-45).

An 802.11b, 802.11g or 802.11 Super G wireless card installed on each wireless
station
Chapter 1: Introduction
51
Getting to Know Your UTM-1 Edge W ADSL Appliance
Rear Panel
All physical connections (network and power) are made via the rear panel of your UTM-1
appliance.
Figure 16: UTM-1 Edge W ADSL Appliance Rear Panel
The following table lists the UTM-1 Edge W ADSL appliance's rear panel elements.
Table 20: UTM-1 Edge W ADSL Appliance Rear Panel Elements
Label
PWR
Description
A power jack used for supplying power to the unit. Connect the supplied power
adapter to this jack.
RESET
A button used for rebooting the UTM-1 appliance or resetting the UTM-1 appliance
to its factory defaults. You need to use a pointed object to press this button.

Short press. Reboots the UTM-1 appliance

Long press (7 seconds). Resets the UTM-1 appliance to its factory defaults,
and resets your firmware to the version that shipped with the UTM-1
appliance. This results in the loss of all security services and passwords
and reverting to the factory default firmware. You will have to
re-configure your UTM-1 appliance.
Do not reset the unit without consulting your system administrator.
USB
52
Two USB 2.0 ports used for connecting USB-based printers or modems
Check Point UTM-1 Embedded NGX User Guide
Getting to Know Your UTM-1 Edge W ADSL Appliance
Label
Serial
Description
An RJ-45 serial (RS-232) port used for connecting computers in order to access the
UTM-1 CLI (Command Line Interface), for using the terminal server, or for
connecting an external dialup modem.
An RJ-45 to DB9 converter is supplied for your convenience.
Warning: Do not connect an Ethernet cable to the RJ-45 serial port.
DSL
An RJ-11 ADSL port used for connecting the integrated ADSL modem to an ADSL
line.
A splitter with a micro-filter is usually required when connecting this port to the
phone jack. If unsure, check with your ADSL service provider.
Before connecting this port to the line, make sure that you are using the correct
UTM-1 model for your phone line: Annex A for POTS (regular) phone lines, and
Annex B for ISDN (digital) phone lines. Your UTM-1 model's ADSL annex type
appears on the bottom of the appliance.
DMZ/
A dedicated Ethernet port (RJ-45) used to connect a DMZ (Demilitarized Zone)
WAN2
computer or network. Alternatively, can serve as a secondary WAN port or as a
VLAN trunk.
LAN 1-4
Local Area Network switch: Four Ethernet ports (RJ-45) used for connecting
computers or other network devices.
ANT1 /
Antenna connectors, used to connect the supplied wireless antennas .
ANT2
Chapter 1: Introduction
53
Getting to Know Your UTM-1 Edge W ADSL Appliance
Front Panel
The UTM-1 Edge W ADSL appliance includes several status LEDs that enable you to
monitor the appliance’s operation.
Figure 17: UTM-1 Edge W ADSL Appliance Front Panel
For an explanation of the UTM-1 Edge W ADSL appliance’s status LEDs, see the following
table.
Table 21: UTM-1 Edge W ADSL Appliance Status LEDs
LED
State
Explanation
PWR/SEC
Off
Power off
Flashing quickly (Green)
System boot-up, or rapid deployment in
progress
Flashing slowly (Green)
Establishing Internet connection
Flashing (Red)
Hacker attack blocked, or error
occurred during rapid deployment
process
LAN 1-4/
On (Green)
Normal operation
On (Red)
Error
LINK/ACT Off, 100 Off
Link is down
LINK/ACT On, 100 Off
10 Mbps link established for the
DMZ/WAN2
corresponding port
54
Check Point UTM-1 Embedded NGX User Guide
Contacting Technical Support
LED
State
Explanation
LINK/ACT On, 100 On
100 Mbps link established for the
corresponding port
DSL
VPN
Serial
USB
WLAN
LNK/ACT Flashing
Data is being transmitted/received
Link Off
Link is down
Link Flashing
Establishing ADSL connection
Link On
ADSL connection established
DAT Off
ADSL line is idle
DAT Flashing
Data is being transmitted/received
Off
No VPN activity
Flashing (Green)
VPN activity
On (Green)
VPN tunnels established, no activity
Off
No Serial port activity
Flashing (Green)
Serial port activity
Off
No USB port activity
Flashing (Green)
USB port activity
Off
No WLAN activity
Flashing (Green)
WLAN activity
Contacting Technical Support
In case of a problem with your UTM-1 appliance, see
http://www.checkpoint.com/techsupport/.
Chapter 1: Introduction
55
Contacting Technical Support
You can also download the latest version of this guide from the Check Point
SecureKnowledge Web site.
56
Check Point UTM-1 Embedded NGX User Guide
Introduction to Information Security
Chapter 2
UTM-1 Security
This chapter explains the basic security concepts on which UTM-1 security is based.
This chapter includes the following topics:
Introduction to Information Security .......................................................... 57
The UTM-1 Firewall .................................................................................. 61
Introduction to Information Security
Network security is but a small part of information security, which in turn is only a fraction
of general security. In order to understand why the UTM-1 appliance is the best product for
securing the business network, we must first examine information security requirements in
general.
Information is Valuable!
The most valuable asset an organization has is its information. The type of information
maintained by an organization depends on the organization's type and purpose. For example:

Almost every organization stores information about its operations, such as
employees' names and other personal details, salaries, and so on.

Depending on the role of different governmental offices, they may store personal
information about citizens, residential addresses, car licenses registration, and so
on.

The army stores information about its soldiers, weapons inventory, and
intelligence information about other armies. Much of this information is
confidential.

A bank stores information about its customers' accounts, their money transactions,
ATM machine access codes, and so on. Much of this information is confidential.
Chapter 2: UTM-1 Security
57
Introduction to Information Security

Commercial companies store information about their revenues, business and
marketing plans, current and future product lines, information about competitors,
and so on.
Just as the type of information may differ from organization to organization, the form in
which it is stored may vary. For example, some forms of information are:

Information recorded in written media, such as paper documents, books, and files

Knowledge that is stored in a person's mind and can be exchanged verbally

Information stored on electronic media, such as computers' hard drives, CDs, and
tapes
The form in which an organization stores its information may make the information more or
less accessible to people outside the organization.
Why Protect Business Information?
There are various reasons why it is necessary to protect business information:

To prevent the theft, abuse, misuse, or any form of damage to crucial information
For example, no business wants to find its customer list or future secret product line
plans in the hands of the competition.

To comply with local laws
Local laws may enforce the protection, integrity, and availability of specific
information, such as an individual's personal details, in order to respect the individual's
right to privacy. Local laws may also enforce the security requirements made in the
Health Insurance Portability and Accountability Act of 1996 (HIPAA).

To comply with another organization's security requirements
Some organizations require their business partners to comply with international
standards of security.
Information Security Challenges
The challenges of information security can be divided into the following areas:

Confidentiality and Privacy - Ensuring that only the intended recipients can read
certain information

Authentication - Ensuring that information is actually sent by the stated sender
58
Check Point UTM-1 Embedded NGX User Guide
Introduction to Information Security

Integrity - Ensuring that the original information was not altered and that no one
tampered with it

Availability - Ensuring that important information can be accessed at all times and
places
The Security Policy
In order to meet these challenges, an organization must create and enforce a security policy.
A security policy is a set of rules that defines how and by whom sensitive information should
be accessed, handled, and distributed, both within and outside of the organization. For
example, a security policy may include the following rules regarding visitors who arrive at
an enterprise building's lobby:

Visitors must sign in at the entrance desk.

Visitors must wear a visitor badge and be escorted while in the building.

Visitors cannot use their badge to open electronic doors.
Other types of security policy rules and measures might be:

Only the executive manager has access to financial reports.

Visitors must open their bags for a security check.

Surveillance cameras should be positioned in the area of the building.

Passwords must be changed on a daily basis.

Confidential papers must be shredded after use.
An organization's security policy is usually designed by a person who is in charge of
handling all security matters for the organization. This person is called a security manager.
Chapter 2: UTM-1 Security
59
Introduction to Information Security
In order for a security policy be effective, it must be accompanied by the following
measures:

Awareness - A security policy must be accompanied by steps taken to increase the
employees' awareness of security issues. If employees are unaware of a security
policy rule and the reason for it, they are likely to break it.

Enforcement - To enforce a security policy, an organization can take various
measures, both human and electronic. For example:


Installing surveillance cameras in strategic locations throughout the
organization
 Positioning human guards who have the authority to prevent other people from
entering the premises or certain areas on the premises
 Installing alarms that are triggered upon certain conditions
 Using magnetic identification tags to enforce and log access permissions to
different areas on the premises
 Using ―red phones‖ to encrypt highly confidential voice phone calls
Updating - A security policy is a living thing that must be updated from time to
time according to changing situations.
Unfortunately, even when a security policy is accompanied by these measures, its
effectiveness is limited against a person with malicious intent.
Computer and Network Security
A great deal of an organization's existing information is processed and stored electronically
by single (standalone) computers or computer networks. Therefore, an attack on an
organization's computers or computer networks can result in extensive information theft or
abuse. However, computers and computer networks today are not just tools used to store
information; they are the heart of an organization's operations and crucial to its
communication and business transactions. For example:

Nowadays, most of an organization's communication and business transactions
are conducted via email (regardless of the organization's size).

Online stores process orders and supply products over the Internet.

Emerging technology today allows an organization's branch offices to
communicate, share data, and even establish low-cost VoIP (Voice over IP)
communications, rather than using the traditional phone system.
60
Check Point UTM-1 Embedded NGX User Guide
The UTM-1 Firewall

Applications are hosted on a main computer rather than on personal workstations.
This helps organizations share application resources. For example, in service
departments, the customer database is located on a main computer, while all
customer relations transactions are managed by software clients running on the
agents' computers.

In order to withdraw money from any ATM machine, your PIN and the details on
your magnetic card are scanned and verified against the details on the main bank
computer.

A department store in New York can query the inventory of the main warehouse
located in Chicago and enter orders for missing products, all in real time.
In other words, on top of the damage done by computer information theft or abuse,
unauthorized access to a computer or a computer network can seriously damage the entire
organization's essential operations, communications, and productivity. For example:

An online store's Web site can be hacked, so customers cannot enter orders.

An unauthorized user can take advantage of an organization's email server to send
unsolicited bulks of email. As a result, the organization's Internet communication
lines will be overloaded, and employees in the organization will be unable to send
or receive emails.
Since computer and network security has become a central part of information and general
security, security managers must either have an understanding of computers and networking,
or work closely with network administrators and network security specialists.
The UTM-1 Firewall
What Is a Firewall?
The most effective way to secure an Internet link is to put a firewall between the local
network and the Internet. A firewall is a system designed to prevent unauthorized access to
or from a secured network. Firewalls act as locked doors between internal and external
networks: data that meets certain requirements is allowed through, while unauthorized data
is not.
To provide robust security, a firewall must track and control the flow of communication
passing through it. To reach control decisions for TCP/IP-based services, (such as whether
to accept, reject, authenticate, encrypt, and/or log communication attempts), a firewall must
Chapter 2: UTM-1 Security
61
The UTM-1 Firewall
obtain, store, retrieve, and manipulate information derived from all communication layers
and other applications.
Security Requirements
In order to make control decisions for new communication attempts, it is not sufficient for
the firewall to examine packets in isolation. Depending upon the communication attempt,
both the communication state (derived from past communications) and the application state
(derived from other applications) may be critical in the control decision. Thus, to ensure the
highest level of security, a firewall must be capable of accessing, analyzing, and utilizing the
following:

Communication information - Information from all seven layers in the packet

Communication-derived state - The state derived from previous communications.
For example, the outgoing PORT command of an FTP session could be saved so
that an incoming FTP data connection can be verified against it.

Application-derived state - The state information derived from other applications.
For example, a previously authenticated user would be allowed access through the
firewall for authorized services only.

Information manipulation - The ability to perform logical or arithmetic functions
on data in any part of the packet. For example, the ability to encrypt packets.
Old Firewall Technologies
Older firewall technologies, such as packet filtering and application-layer gateways, are still
in use in some environments. It is important to familiarize yourself with these technologies,
so as to better understand the benefits and advantages of the Check Point Stateful Inspection
firewall technology.
Packet Filters
Historically implemented on routers, packet filters filter user-defined content, such as IP
addresses. They examine a packet at the network or transport layer and are
application-independent, which allows them to deliver good performance and scalability.
Packet filters are the least secure type of firewall, as they are not application-aware, meaning
that they cannot understand the context of a given communication. This makes them
relatively easy targets for unauthorized entry to a network. A limitation of this type of
filtering is its inability to provide security for basic protocols.
62
Check Point UTM-1 Embedded NGX User Guide
The UTM-1 Firewall
Packet filters have the following advantages and disadvantages:
Table 22: Packet Filter Advantages and Disadvantages
Advantages
Disadvantages
Application independence
Low security
High performance
No screening above the network layer
Scalability
Application-Layer Gateways
Application-layer gateways improve security by examining all application layers, bringing
context information into the decision-making process. However, the method they use to do
this disrupts the client/server model, reducing scalability. Ordinarily, a client sends requests
for information or action according to a specific protocol, and the server responds, all in one
connection. With application-layer gateways, each client/server communications requires
two connections: one from a client to a proxy, and one from a proxy to a server. In addition,
each proxy requires a different process (or daemon), making support for new applications a
problem.
Application-layer gateways have the following advantages and disadvantages:
Table 23: Application-Layer Gateway Advantages and Disadvantages
Advantages
Disadvantages
Good security
Poor performance
Full application-layer awareness
Limited application support
Poor scalability (breaks the client/server model)
Check Point Stateful Inspection Technology
Invented by Check Point, Stateful Inspection is the industry standard for network security
solutions. A powerful inspection module examines every packet, ensuring that packets do
not enter a network unless they comply with the network's security policy.
Chapter 2: UTM-1 Security
63
The UTM-1 Firewall
Stateful Inspection technology implements all necessary firewall capabilities between the
data and network layers. Packets are intercepted at the network layer for best performance
(as in packet filters), but the data derived from layers 3-7 is accessed and analyzed for
improved security (compared to layers 4-7 in application-layer gateways). Stateful
Inspection incorporates communication and application-derived state and context
information, which is stored and updated dynamically. This provides cumulative data
against which subsequent communication attempts can be evaluated. Stateful Inspection
also delivers the ability to create virtual-session information for tracking connectionless
protocols, such as UDP-based and RPC applications.
UTM-1 appliances use Stateful Inspection technology to analyze all packet communication
layers and extract the relevant communication and application state information. The
UTM-1 appliance is installed at the entry point to your network, and serves as the gateway
for the internal network computers. In this ideal location, the inspection module can inspect
all traffic before it reaches the network.
Packet State and Context Information
To track and act on both state and context information for an application is to treat that traffic
statefully. The following are examples of state and context-related information that a
firewall should track and analyze:

Packet-header information (source and destination address, protocol, source and
destination port, and packet length)

Connection state information (which ports are being opened for which
connection)

TCP and IP fragmentation data (including fragments and sequence numbers)

Packet reassembly, application type, and context verification (to verify that the
packet belongs to the communication session)

Packet arrival and departure interface on the firewall

Layer 2 information (such as VLAN ID and MAC address)

Date and time of packet arrival or departure
The UTM-1 firewall examines IP addresses, port numbers, and any other information
required. It understands the internal structures of the IP protocol family and applications,
and is able to extract data from a packet's application content and store it, to provide context
in cases where the application does not provide it. The UTM-1 firewall also stores and
64
Check Point UTM-1 Embedded NGX User Guide
The UTM-1 Firewall
updates the state and context information in dynamic tables, providing cumulative data
against which it inspects subsequent communications.
The Stateful Inspection Advantage - Passive FTP Example
In order to discuss the strength of Stateful Inspection technology in comparison to the other
firewall technologies mentioned, we will examine the Passive FTP protocol and the ways
that firewalls handle Passive FTP traffic pass-through.
FTP connections are unique, since they are established using two sessions or channels: one
for command (AKA control) and one for data. The following table describes the steps of
establishing a Passive FTP connection, where:

C is the client port used in the command session,

D is the client port used in the data session, and

P is the server port used in the data session.
Table 24: Establishment of Passive FTP Connection
Step
Channel
Description
Source
Type
1
CMD
Client initiates a
FTP
PASV command to
client
TCP
Destination
TCP
Source
Destination
Port
Port
C > 1023
FTP server
21
21
FTP client
C
D > 1023
FTP server
P
the FTP server on
port 21
2
CMD
Server responds
FTP
with data port
server
information P >
1023
3
Data
Client initiates data
FTP
connection to server
client
on port P
Chapter 2: UTM-1 Security
65
The UTM-1 Firewall
Step
Channel
Description
Source
Type
4
Data
Server
FTP
acknowledges data
server
TCP
Destination
TCP
Source
Destination
Port
Port
P
FTP client
D
connection
The following diagram demonstrates the establishment of a Passive FTP connection through
a firewall protecting the FTP server.
Figure 18: Establishment of Passive FTP Connection
From the FTP server's perspective, the following connections are established:

Command connection from the client on a port greater than 1023, to the server on
port 21

Data connection from the client on a port greater than 1023, to the server on a port
greater than 1023
The fact that both of the channels are established by the client presents a challenge for the
firewall protecting the FTP server: while a firewall can easily be configured to identify
incoming command connections over the default port 21, it must also be able to handle
incoming data connections over a dynamic port that is negotiated randomly as part of the
FTP client-server communication. The following table examines how different firewall
technologies handle this challenge:
66
Check Point UTM-1 Embedded NGX User Guide
The UTM-1 Firewall
Table 25: Firewall Technologies and Passive FTP Connections
Firewall Technology
Action
Packet Filter
Packet filters can handle outbound FTP connections in either of the
following ways:

By leaving the entire upper range of ports (greater than
1023) open. While this allows the file transfer session to
take place over the dynamically allocated port, it also
exposes the internal network.

By shutting down the entire upper range of ports. While this
secures the internal network, it also blocks other services.
Thus packet filters' handling of Passive FTP comes at the expense of
either application support or security.
Application-Layer Gateway
Application-layer gateways use an FTP proxy that acts as a
(Proxy)
go-between for all client-server sessions.
This approach overcomes the limitations of packet filtering by bringing
application-layer awareness to the decision process; however, it also
takes a high toll on performance. In addition, each service requires its
own proxy (an FTP proxy for FTP sessions, an HTTP proxy for HTTP
session, and so on), and since the application-layer gateway can only
support a certain number of proxies, its usefulness and scalability is
limited. Finally, this approach exposes the operating system to external
threats.
Chapter 2: UTM-1 Security
67
The UTM-1 Firewall
Firewall Technology
Action
Stateful Inspection Firewall
A Stateful Inspection firewall examines the FTP application-layer data
in an FTP session. When the client initiates a command session, the
firewall extracts the port number from the request. The firewall then
records both the client and server's IP addresses and port numbers in
an FTP-data pending request list. When the client later attempts to
initiate a data connection, the firewall compares the connection
request's parameters (ports and IP addresses) to the information in the
FTP-data pending request list, to determine whether the connection
attempt is legitimate.
Since the FTP-data pending request list is dynamic, the firewall can
ensure that only the required FTP ports open. When the session is
closed, the firewall immediately closes the ports, guaranteeing the FTP
server's continued security.
What Other Stateful Inspection Firewalls Cannot Do
The level of security that a stateful firewall provides is determined by the richness of data
tracked, and how thoroughly the data is analyzed. Treating traffic statefully requires
application awareness. Firewalls without application awareness must open a range of ports
for certain applications, which leads to exploitable holes in the firewall and violates security
―best practices‖.
TCP packet reassembly on all services and applications is a fundamental requirement for
any Stateful Inspection firewall. Without this capability, fragmented packets of legitimate
connections may be dropped, or those carrying network attacks may be allowed to enter a
network. The implications in either case are potentially severe. When a truly stateful firewall
receives fragmented packets, the packets are reassembled into their original form. The entire
stream of data is analyzed for conformity to protocol definition and for packet-payload
validity.
True Stateful Inspection means tracking the state and context of all communications. This
requires a detailed level of application awareness. The UTM-1 appliance provides true
Stateful Inspection.
68
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
Chapter 3
Installing and Setting Up UTM-1
This chapter describes how to properly set up and install your UTM-1 appliance in your
networking environment.
This chapter includes the following topics:
Before You Install the UTM-1 Appliance .................................................. 69
UTM-1 Edge Installation ............................................................................83
Cascading Your Appliance .........................................................................98
Connecting the Appliance to Network Printers ..........................................98
Setting Up the UTM-1 Appliance .............................................................. 99
Before You Install the UTM-1 Appliance
Prior to connecting and setting up your UTM-1 appliance for operation, you must do the
following:

Check if TCP/IP Protocol is installed on your computer.

Check your computer’s TCP/IP settings to make sure it obtains its IP address
automatically.
Refer to the relevant section in this guide in accordance with the operating system that runs
on your computer. The sections below will guide you through the TCP/IP setup and
installation process.
Chapter 3: Installing and Setting Up UTM-1
69
Before You Install the UTM-1 Appliance
Windows 7 and Vista
Checking the TCP/IP Installation
1.
Click Start > Control Panel.
The Control Panel window appears.
2.
70
Under Network and Internet, click View network status and tasks.
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
The Network Sharing Center screen appears.
3.
Configure the Local Area Connection Settings.
Windows 7 - In the View your active networks pane, click Local Area
Connection.
Continue with step 5.
b) Windows Vista - In the Tasks pane, click Manage network connections.
a)
Chapter 3: Installing and Setting Up UTM-1
71
Before You Install the UTM-1 Appliance
The Network Connections screen appears.
4.
Double-click the Local Area Connection icon.
The Local Area Connection Status window opens.
5.
72
Click Properties.
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
The Local Area Connection Properties window opens.
6.
Check if Internet Protocol Version 4 (TCP/IPv4) appears in the list box and if it is
properly configured with the Ethernet card installed on your computer.
TCP/IP Settings
1.
In the Local Area Connection Properties window, double-click the Internet
Protocol Version 4 (TCP/IPv4) component, or select it and click Properties.
The Internet Protocol Version 4 (TCP/IPv4) Properties window appears.
2.
Click the Obtain an IP address automatically radio button.
Chapter 3: Installing and Setting Up UTM-1
73
Before You Install the UTM-1 Appliance
Note: Normally, it is not recommended to assign a static IP address to your PC but
rather to obtain an IP address automatically. If for some reason you need to assign a
static IP address, select Specify an IP address, type in an IP address in the range of
192.168.10.129-254, enter 255.255.255.0 in the Subnet Mask field, and click OK to
save the new settings.
(Note that 192.168.10 is the default value, and it may vary if you changed it in the
Network > My Network page.)
3.
Click the Obtain DNS server address automatically radio button.
4.
Click OK to save the new settings.
Your computer is now ready to access your UTM-1 appliance.
Windows 2000/XP
Checking the TCP/IP Installation
1.
Click Start > Settings > Control Panel.
The Control Panel window appears.
2.
74
Double-click the Network and Dial-up Connections icon.
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
The Network and Dial-up Connections window appears.
3.
Right-click the
opens.
icon and select Properties from the pop-up menu that
The Local Area Connection Properties window appears.
Chapter 3: Installing and Setting Up UTM-1
75
Before You Install the UTM-1 Appliance
4.
76
In the above window, check if TCP/IP appears in the components list and if it is
properly configured with the Ethernet card installed on your computer. If TCP/IP
does not appear in the Components list, you must install it as described in the
next section.
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
Installing TCP/IP Protocol
1.
In the Local Area Connection Properties window click Install.
The Select Network Component Type window appears.
2.
Select Protocol and click Add.
The Select Network Protocol window appears.
3.
Choose Internet Protocol (TCP/IP) and click OK.
TCP/IP protocol is installed on your computer.
Chapter 3: Installing and Setting Up UTM-1
77
Before You Install the UTM-1 Appliance
TCP/IP Settings
1.
In the Local Area Connection Properties window, double-click the Internet
Protocol (TCP/IP) component, or select it and click Properties.
The Internet Protocol (TCP/IP) Properties window opens.
2.
Click the Obtain an IP address automatically radio button.
Note: Normally, it is not recommended to assign a static IP address to your PC but
rather to obtain an IP address automatically. If for some reason you need to assign a
static IP address, select Specify an IP address, type in an IP address in the range of
192.168.10.129-254, enter 255.255.255.0 in the Subnet Mask field, and click OK to
save the new settings.
(Note that 192.168.10 is the default value, and it may vary if you changed it in the
Network > My Network page.)
3.
Click the Obtain DNS server address automatically radio button.
4.
Click OK to save the new settings.
Your computer is now ready to access your UTM-1 appliance.
78
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
Mac OS
Use the following procedure for setting up the TCP/IP Protocol.
1.
Choose Apple Menus -> Control Panels -> TCP/IP.
The TCP/IP window appears.
2.
Click the Connect via drop-down list, and select Ethernet.
3.
Click the Configure drop-down list, and select Using DHCP Server.
4.
Close the window and save the setup.
Chapter 3: Installing and Setting Up UTM-1
79
Before You Install the UTM-1 Appliance
Mac OS-X
Use the following procedure for setting up the TCP/IP Protocol.
1.
Choose Apple -> System Preferences.
The System Preferences window appears.
2.
Click Network.
The Network window appears.
80
Check Point UTM-1 Embedded NGX User Guide
Before You Install the UTM-1 Appliance
3.
Click Configure.
Chapter 3: Installing and Setting Up UTM-1
81
UTM-1 Edge Installation
TCP/IP configuration fields appear.
4.
Click the Configure IPv4 drop-down list, and select Using DHCP.
5.
Click Apply Now.
82
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
UTM-1 Edge Installation
Installing Non-ADSL Models
To install the UTM-1 appliance
1.
Verify that you have the correct cable type.
For information, see Network Requirements on page 46.
2.
Connect the LAN cable:
3.
a. Connect one end of the Ethernet cable to one of the appliance's LAN ports.
b. Connect the other end to PCs, hubs, or other network devices.
Connect the WAN cable:
4.
Connect one end of an Ethernet cable to the appliance's Ethernet WAN port.
Connect the other end of the cable to a cable modem, DSL modem, or
office network.
Connect the power adapter to the appliance's power socket, labeled PWR.
5.
Plug the power adapter into the wall electrical outlet.
a)
a.
Warning: The UTM-1 appliance power adapter is compatible with either 100, 120 or 230
VAC input power. Verify that the wall outlet voltage is compatible with the voltage
specified on your power adapter. Failure to observe this warning may result in injuries
or damage to equipment.
Chapter 3: Installing and Setting Up UTM-1
83
UTM-1 Edge Installation
Figure 19: Typical Connection Diagram
Installing UTM-1 Edge N Industrial
When using the the 12V 2A DC power adapter, only us the AC-DC power adapter that
comes with the UTM-1 Edge N Industrial. Using an incorrect AC-DC power adapter can
result in an unexpected hazard.
To install the UTM-1 appliance
1.
Verify that you have the correct cable type.
For information, see Network Requirements on page 46.
2.
Connect the LAN cable:
3.
a. Connect one end of the Ethernet cable to one of the appliance's LAN ports.
b. Connect the other end to PCs, hubs, or other network devices.
Connect the WAN cable:
Connect one end of the Ethernet cable to the appliance's WAN port.
Connect the other end of the cable to a cable modem, DSL modem, or
office network.
Do one of the following:
a.
b.
4.

84
To use +12V ~ +60V or -48V DC input power, see Connecting a DC Power
Source on page 86.
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation

You will need a power adapter.
To use the provided power adapter for +12V 2A DC input power:
1) Connect the 12V power adapter provided with the UTM-1 appliance
to the 12V power socket at the back of the unit.
2) Plug the power adapter into the wall electrical outlet.
Warning: Verify that the wall outlet voltage is compatible with the voltage specified on
your power adapter. Failure to observe this warning may result in injuries or damage to
equipment.
Figure 20: Front Panel Typical Connection Diagram
Item
Description
1
To PCs, hubs, or other network elements
2a
Ethernet port to a DMZ PC or hub
2b
Fiber optic port to a DMZ PC or hub
3
To a cable or DSL modem, or a network
4
RJ45 port to a serial console
5
USB port to printer or hub
6
Status LEDs
7
To the +12V ~ +60V DC Power Source
Chapter 3: Installing and Setting Up UTM-1
85
UTM-1 Edge Installation
Figure 21: Rear Panel Typical Connection Diagram
Item
Description
1
To the 12V DC power adapter
Connecting a DC Power Source
When connecting to a DC source, always connect to a DC source that separates the primary
and secondary by reinforced or double insulation. Make sure that the output of the DC
source never exceeds 60VDC under normal or single fault condition.
Warning: Always turn off the 12V DC industrial power adapter before
wiring, installing, or removing the UTM-1 N Industrial appliance. Failure
to do so may cause faulty operation.
To connect a DC power source:
1.
Turn off the DC power source.
2.
Prepare a wire harness composed of three wires.
Each wire must meet the following requirements:
 22 gauge (AWG) or more
 105ºC insulation rating or more
The wires should be color coded as follows:



86
Black wire for (-)
Brown wire for (+)
Green and yellow wire for GND
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
3.
Measure the distance between the UTM-1 appliance and the DC power source,
and cut the wires to the required length.
Note: If the distance to the power adapter is greater than five meters, use wires with a
higher gauge. Refer to your wires' derating and electrical parameters for guidelines.
4.
Prepare one end of the harness for connection with the UTM-1 appliance, by
doing the following:
a.
b.
c.
d.
e.
f.
g.
h.
Strip the wires about 6-7 mm.
If desired, apply a splice cap to each of the three stripped wires.
This step is optional.
Using a small flathead screwdriver, loosen the screw in the Industrial DC
connector plug that came with the UTM-1 appliance.
Hold the plug groove-side up, with the terminals facing you.
Insert the Green and Yellow (GND) wire in the center terminal.
Insert the Black (-) wire in the right terminal.
Insert the Brown (+) wire in the left terminal.
Firmly tighten the plug's screw.
Warning: Failure to tighten the Industrial DC connector plug's screw sufficiently may
result in a fire.
5.
Prepare the other end of the harness for connection with the DC power source,
by doing the following:
a.
b.
Strip the wires about 6-7 mm.
If desired, apply a splice cap to each of the three stripped wires.
This step is optional.
Refer to your DC power source's instructions for further information on preparing the
wires.
6.
Use a digital voltmeter to verify that your 12V DC industrial power adapter's
output voltage is indeed 12V DC.
7.
Connect the DC power source's end of the harness to the 12V DC industrial
power adapter's terminal block, by doing the following:
Chapter 3: Installing and Setting Up UTM-1
87
UTM-1 Edge Installation
a.
b.
c.
d.
If unsure, use a digital voltmeter to determine which of the 12V DC
industrial power adapter's posts is the (+).
Connect the Green and Yellow (GND) wire to the (GND) post in the
terminal block.
This wire must be connected first.
Connect the Black (-) wire to the (-) post in the terminal block.
Connect the Brown (+) wire to the (+) post in the terminal block.
Note: Ensure that all wires are connected securely.
8.
Connect the UTM-1 appliance's end of the harness to the UTM-1 appliance, by
doing the following:
a.
9.
Connect the Industrial DC connector plug to the DC power jack at the front
of the appliance.
b. Turn on the DC power source.
Check that the appliance is operating correctly.
Installing UTM-1 Edge W ADSL
To install the UTM-1 appliance
1.
Verify that you have the correct cable type.
For information, see Network Requirements on page 46.
2.
Connect the LAN cable:
3.
a. Connect one end of the Ethernet cable to one of the appliance's LAN ports.
b. Connect the other end to PCs, hubs, or other network devices.
Connect the ADSL cable:
a.
b.
88
Connect one end of the telephone cable to the appliance's DSL port.
Connect the other end of the cable to the ADSL line or micro-filter.
In most cases, a micro-filter is required for each phone jack on your line. The
micro-filter prevents the standard phone lines from interfering with your ADSL
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
4.
service. Check with your service provider whether a micro-filter is required at your
location.
To use the appliance with a non-ADSL connection, or with an existing ADSL
modem, connect an Ethernet cable:
5.
Connect one end of the Ethernet cable to the appliance's DMZ/WAN2 port.
Connect the other end of the cable to an external cable modem, DSL
modem, or office network.
Connect the power adapter to the appliance's power socket, labeled PWR.
6.
Plug the power adapter into the wall electrical outlet.
a.
b.
Warning: The UTM-1 appliance power adapter is compatible with either 100, 120 or 230
VAC input power. Verify that the wall outlet voltage is compatible with the voltage
specified on your power adapter. Failure to observe this warning may result in injuries
or damage to equipment.
Figure 22: Typical Connection Diagram
Chapter 3: Installing and Setting Up UTM-1
89
UTM-1 Edge Installation
Mounting the UTM-1 Edge N Industrial Appliance on a DIN
Rail
For your convenience, the UTM-1 Edge N Industrial appliance includes a DIN rail mounting
bracket, which enables you to mount your appliance in any DIN rail cabinet or enclosure:
Figure 23: DIN Rail Mounting Bracket
Item
Description
1
Screw
2
Upper Groove
3
Lower Groove
90
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
You can mount the appliance facing up, down, or outwards. The appliance includes holes on
both side panels and on its rear panel, for this purpose.
Item
Description
1
Anti-theft slot
2
Side bracket mounting holes
3
Rack-mouting bracket hole
4
Rear bracket mounting holes
To mount the UTM-1 appliance on a DIN rail
1.
Decide on the mounting orientation.
2.
Do one of these procedures,
Chapter 3: Installing and Setting Up UTM-1
91
UTM-1 Edge Installation



To mount the appliance facing outwards, thread the DIN rail bracket's knobs in
the slots on the appliance's rear panel.
To mount the appliance facing up, thread the DIN rail bracket's knobs in the
slots on the appliance's right side panel.
To mount the appliance facing down, thread the DIN rail bracket's knobs in the
slots on the appliance's left side panel.
Figure 24: Bracket on Rear Panel
Figure 25: Bracket on Side Panel
Note: To locate the appliance's right and left side panels, hold the appliance with its front
panel facing away from you. The side panel on your left is the appliance left side panel,
and the side panel on your right is the appliance's right side panel.
1.
Tighten the DIN rail bracket's screws.
2.
Fit the DIN rail bracket's lower groove onto the DIN rail at a slight angle.
3.
Firmly push the appliance onto the DIN rail, until the DIN rail bracket's upper
groove snaps onto the DIN rail.
92
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
Preparing the Edge Appliance for a Wireless Connection
To prepare the UTM-1 wireless appliance for a wireless connection
1.
Connect the antennas that came with your UTM-1 wireless appliance to the
antenna connectors in the appliance's rear panel.
2.
Bend the antennas at the hinges, so that they point upwards.
Chapter 3: Installing and Setting Up UTM-1
93
UTM-1 Edge Installation
Wall Mounting the UTM-1 Edge Appliance
For your convenience, the UTM-1 Edge appliance includes a wall mounting kit, which
consists of two plastic conical anchors and two cross-head screws.
To mount the UTM-1 appliance Edge on the wall
1.
Decide where you want to mount your UTM-1 Edge appliance.
2.
Decide on the mounting orientation.
You can mount the appliance on the wall facing up, down, left, or right.
Note: Mounting the appliance with the ports facing upwards is not recommended, as dust
might accumulate in unused ports.
94
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
3.
Mark two drill holes on the wall, in accordance with the following sketch:
4.
Drill two 3.5 mm diameter holes, approximately 25 mm deep.
5.
Insert two plastic conical anchors into the holes.
Note: The conical anchors you received with your UTM-1 Edge appliance are suitable
for concrete walls. If you want to mount the appliance on a plaster wall, you must use
anchors that are suitable for plaster walls.
6.
Insert the two screws you received with your UTM-1 Edge appliance into the
plastic conical anchors, and turn them until they protrude approximately 5 mm
from the wall.
7.
Align the holes on the UTM-1 Edge appliance's underside with the screws on
the wall, then push the appliance in and down.
Chapter 3: Installing and Setting Up UTM-1
95
UTM-1 Edge Installation
Your UTM-1 Edge appliance is wall mounted. You can now connect it to your
computer.
Securing the UTM-1 Edge Appliance against Theft
The UTM-1 Edge appliance features a security slot to the rear of the right panel, which
enables you to secure your appliance against theft, using an anti-theft security device.
Note: Anti-theft security devices are available at most computer hardware stores.
This procedure explains how to install a looped security cable on your appliance. A looped
security cable typically includes the parts shown in the diagram below.
Figure 26: Looped Security Cable
96
Check Point UTM-1 Embedded NGX User Guide
UTM-1 Edge Installation
While these parts may differ between devices, all looped security cables include a bolt with
knobs, as shown in the diagram below:
Figure 27: Looped Security Cable Bolt
The bolt has two states, Open and Closed, and is used to connect the looped security cable to
the appliance's security slot.
To install an anti-theft device on the UTM-1 Edge appliance
1.
If your anti-theft device has a combination lock, set the desired code, as
described in the documentation that came with your device.
2.
Connect the anti-theft device's loop to any sturdy mounting point, as described
in the documentation that came with your device.
3.
Slide the anti-theft device's bolt to the Open position.
4.
Insert the bolt into the UTM-1 Edge appliance's security slot, then slide the bolt
to the Closed position until the bolts holes are aligned.
Chapter 3: Installing and Setting Up UTM-1
97
Cascading Your Appliance
5.
Thread the anti-theft device's pin through the bolt’s holes, and insert the pin into
the main body of the anti-theft device, as described in the documentation that
came with your device.
Cascading Your Appliance
The UTM-1 appliance protects all computers and network devices that are connected to its
LAN and DMZ ports. If desired, you can increase the appliance's port capacity by cascading
hubs or switches.
To cascade the UTM-1 appliance to a hub or switch
1.
Connect a standard Ethernet cable to one of the appliance's LAN ports or to its
DMZ/WAN2 Ethernet port.
The UTM-1 appliance automatically detects cable types, so you can use either a
straight-through or crossed Ethernet cable.
2.
Connect the other end of the cable to an Ethernet hub or switch.
3.
Connect additional computers and network devices to the hub or switch as
desired.
Connecting the Appliance to Network Printers
In models with a print server, you can connect network printers.
To connect network printers
1.
Connect one end of a USB cable to one of the appliance's USB ports.
If needed, you can use the provided USB extension cord.
2.
98
Connect the other end to a printer or a USB 2.0 hub.
Check Point UTM-1 Embedded NGX User Guide
Setting Up the UTM-1 Appliance
Warning: Verify that the USB devices' power requirement does not exceed the
appliance's USB power adapter capabilities. Failure to observe this warning may
cause damage to the appliance and void the warranty.
For information on setting up network printers, see Setting up Network Printers on page
722.
Setting Up the UTM-1 Appliance
After you have installed the UTM-1 appliance, you must set it up using the steps shown
below.
When setting up your UTM-1 appliance for the first time after installation, these steps follow
each other automatically. After you have logged in and set up your password, the UTM-1
Setup Wizard automatically opens and displays the dialog boxes for performing the initial
configuration of the router. If desired, you can exit the Setup Wizard and perform each of
these steps separately.
Chapter 3: Installing and Setting Up UTM-1
99
Setting Up the UTM-1 Appliance
Logging in to the UTM-1 Portal and setting up your password
Initial Login to the UTM-1 Portal on page 103
Configuring an Internet connection
Using the Internet Wizard on page 116
Setting the time on your UTM-1 appliance
Setting the Time on the Appliance on page 687
Setting up a wireless network (wireless appliances only)
Configuring a Wireless Network on page 285
Installing the Product Key
Upgrading Your Software Product on page 675
Setting up subscription services
Connecting to a Service Center
You can access the Setup Wizard at any time after initial setup, using the procedure below.
To access the Setup Wizard
1.
100
Click Setup in the main menu, and click the Firmware tab.
Check Point UTM-1 Embedded NGX User Guide
Setting Up the UTM-1 Appliance
The Firmware page appears.
2.
Click UTM-1 Setup Wizard.
The UTM-1 Setup Wizard opens with the Welcome page displayed.
Chapter 3: Installing and Setting Up UTM-1
101
Initial Login to the UTM-1 Portal
Chapter 4
Getting Started
This chapter contains all the information you need in order to get started using your UTM-1
appliance.
This chapter includes the following topics:
Initial Login to the UTM-1 Portal ............................................................ 103
Logging in to the UTM-1 Portal ............................................................... 106
Accessing the UTM-1 Portal Remotely Using HTTPS ............................ 107
Using the UTM-1 Portal ...........................................................................108
Logging Out ............................................................................................. 113
Initial Login to the UTM-1 Portal
The first time you log in to the UTM-1 Portal, you must set up your password.
To log in to the UTM-1 Portal for the first time
1.
Browse to http://my.firewall.
Chapter 4: Getting Started
103
Initial Login to the UTM-1 Portal
The initial login page appears.
2.
Type a password both in the Password and the Confirm password fields.
Note: The password must be five to 25 characters (letters or numbers).
Note: You can change your username and password at any time. For further
information, see Changing Your Password on page 635.
3.
104
Click OK.
Check Point UTM-1 Embedded NGX User Guide
Initial Login to the UTM-1 Portal
The UTM-1 Setup Wizard opens, with the Welcome page displayed.
4.
Configure your Internet connection using one of the following ways:


Internet Wizard
The Internet Wizard is the first part of the Setup Wizard, and it takes you through
basic Internet connection setup, step by step. For information on using the Internet
Wizard, see Using the Internet Wizard on page 116.
After you have completed the Internet Wizard, the Setup Wizard continues to guide
you through appliance setup. For more information, see Setting Up the UTM-1
Appliance on page 99.
Internet Setup
Internet Setup offers advanced setup options, such as configuring two Internet
connections. To use Internet Setup, click Cancel and refer to Using Internet Setup
on page 131.
Chapter 4: Getting Started
105
Logging in to the UTM-1 Portal
Logging in to the UTM-1 Portal
Note: By default, HTTP and HTTPS access to the UTM-1 Portal is not allowed from the
WLAN, unless you do one of the following:

Configure a specific firewall rule to allow access from the WLAN. See
Using Rules on page 374.
Or

Enable HTTPS access from the Internet. See Configuring HTTPS on
page 680.
To log in to the UTM-1 Portal
1.
Do one of the following:

Browse to http://my.firewall.
Or
 To log in through HTTPS (locally or remotely), follow the procedure
Accessing the UTM-1 Portal Remotely on page 107.
The login page appears.
2.
Type your username and password.
3.
Click OK.
106
Check Point UTM-1 Embedded NGX User Guide
Accessing the UTM-1 Portal Remotely Using HTTPS
The Welcome page appears.
Accessing the UTM-1 Portal Remotely Using HTTPS
You can access the UTM-1 Portal remotely (from the Internet) through HTTPS. HTTPS is a
protocol for accessing a secure Web server. It is used to transfer confidential user
information. If desired, you can also use HTTPS to access the UTM-1 Portal from your
internal network.
Note: In order to access the UTM-1 Portal remotely using HTTPS, you must first do
both of the following:

Configure your password, using HTTP. See Initial Login to the UTM-1
Portal on page 103.

Configure HTTPS Remote Access. See Configuring HTTPS on page
680.
Note: Your browser must support 128-bit cipher strength. To check your browser's
cipher strength, open Internet Explorer and click Help > About Internet Explorer.
To access the UTM-1 Portal from your internal network

Browse to https://my.firewall.
Chapter 4: Getting Started
107
Using the UTM-1 Portal
(Note that the URL starts with ―https‖, not ―http‖.)
The UTM-1 Portal appears.
To access the UTM-1 Portal from the Internet

Browse to https://<firewall_IP_address>:981.
(Note that the URL starts with ―https‖, not ―http‖.)
The following things happen in the order below:
If this is your first attempt to access the UTM-1 Portal through HTTPS, the certificate in
the UTM-1 appliance is not yet known to the browser, so the Security Alert dialog box
appears.
To avoid seeing this dialog box again, install the certificate of the destination UTM-1
appliance. If you are using Internet Explorer 6, do the following:
a.
b.
c.
d.
e.
f.
g.
h.
Click View Certificate.
The Certificate dialog box appears, with the General tab displayed.
Click Install Certificate.
The Certificate Import Wizard opens.
Click Next.
Click Next.
Click Finish.
Click Yes.
Click OK.
The Security Alert dialog box reappears.
Click Yes.
The UTM-1 Portal appears.
Using the UTM-1 Portal
The UTM-1 Portal is a Web-based management interface, which enables you to manage and
configure the UTM-1 appliance operation and options.
The UTM-1 Portal consists of three major elements.
108
Check Point UTM-1 Embedded NGX User Guide
Using the UTM-1 Portal
Table 26: UTM-1 Portal Elements
Element
Description
Main menu
Used for navigating between the various topics (such as Reports, Security,
and Setup).
Main frame
Displays information and controls related to the selected topic. The main frame
may also contain tabs that allow you to view different pages related to the
selected topic.
Status bar
Shows your Internet connection and managed services status.
Figure 28: UTM-1 Portal
Chapter 4: Getting Started
109
Using the UTM-1 Portal
Main Menu
The main menu includes the following submenus.
Table 27: Main Menu Submenus
This submenu… Does this…
Welcome
Displays general welcome information.
Reports
Provides reporting capabilities in terms of appliance status, traffic
monitoring, active computers, established connections, and more.
Logs
Provides a general event log displaying appliance events, and a security
event log displaying firewall events.
Security
Provides controls and options for setting the security of any computer in the
network.
Antivirus
Allows you to configure VStream Antivirus settings.
Antispam
Allows you to configure VStream Antispam settings.
Services
Allows you to control your subscription to subscription services.
Network
Allows you to manage and configure your network settings and Internet
connections.
Setup
Provides a set of tools for managing your UTM-1 appliance. Allows you to
upgrade your license and firmware and to configure HTTPS access to your
UTM-1 appliance.
Users
Allows you to manage UTM-1 appliance users.
VPN
Allows you to manage, configure, and log in to VPN sites.
Help
Provides context-sensitive online help.
110
Check Point UTM-1 Embedded NGX User Guide
Using the UTM-1 Portal
This submenu… Does this…
Logout
Allows you to log out of the UTM-1 Portal.
Main Frame
The main frame displays the relevant data and controls pertaining to the menu and tab you
select. These elements sometimes differ depending on what model you are using. The
differences are described throughout this guide.
Status Bar
The status bar is located at the bottom of each page. It displays the fields below, as well as
the date and time.
Table 28: Status Bar Fields
This field…
Displays this…
Internet
Your Internet connection status.
The connection status may be one of the following:

Connected. The UTM-1 appliance is connected to the Internet.

Connected – Probing OK. Connection probing is enabled and has detected
that the Internet connectivity is OK.

Connected – Probing Failed. Connection probing is enabled and has
detected problems with the Internet connectivity.

Not Connected. The Internet connection is down.

Establishing Connection. The UTM-1 appliance is connecting to the
Internet.

Contacting Gateway. The UTM-1 appliance is trying to contact the Internet
default gateway.

Disabled. The Internet connection has been manually disabled.
Note: You can configure both a primary and a secondary Internet connection. When
both connections are configured, the Status bar displays both statuses. For example
―Internet [Primary]: Connected‖. For information on configuring a secondary Internet
connection, see Configuring the Internet Connection on page 115.
Chapter 4: Getting Started
111
Using the UTM-1 Portal
This field…
Displays this…
Service Center
Displays your subscription services status.
Your Service Center may offer various subscription services. These include the
firewall service and optional services such as Web Filtering and Email Antivirus.
Your subscription services status may be one of the following:
112

Not Subscribed. You are not subscribed to security services.

Connection Failed. The UTM-1 appliance failed to connect to the Service
Center.

Connecting. The UTM-1 appliance is connecting to the Service Center.

Connected. You are connected to the Service Center, and security
services are active.
Check Point UTM-1 Embedded NGX User Guide
Logging Out
Logging Out
Logging out terminates your administration session. Any subsequent attempt to connect to
the UTM-1 Portal will require re-entering of the administration password.
To log out of the UTM-1 Portal

Click Logout in the main menu.
The Login page appears.
Chapter 4: Getting Started
113
Overview
Chapter 5
Configuring the Internet Connection
This chapter describes how to configure and work with a UTM-1 Internet connection.
This chapter includes the following topics:
Overview ..................................................................................................115
Using the Internet Wizard.........................................................................116
Using Internet Setup ................................................................................. 131
Setting Up Modems .................................................................................. 164
Viewing Internet Connection Information ................................................ 173
Enabling/Disabling the Internet Connection.............................................175
Using Quick Internet Connection/Disconnection .....................................176
Configuring a Backup Internet Connection ..............................................176
Configuring WAN Load Balancing .......................................................... 178
Overview
In order to access the Internet through your UTM-1 appliance, you must configure one of the
following connection types:

Ethernet-based connection
You can configure an Ethernet-based connection in all models. An Ethernet-based
connection can be connected to another network by means of a switch, a router, a
bridge, or an Ethernet-enabled broadband modem.
In ADSL models, the Ethernet-based connection is configured on the DMZ/WAN2
port. In non-ADSL models, you can use the WAN port, the DMZ/WAN2 port, or both
ports for an Ethernet-based Internet connection.

Direct ADSL connection
You can configure a direct ADSL connection in UTM-1 ADSL models only. These
models include an integrated ADSL modem, which enables you to connect the
appliance directly to your ADSL line without using an additional modem or router.
Chapter 5: Configuring the Internet Connection
115
Using the Internet Wizard
You can configure your Internet connection using any of the following setup tools:

Setup Wizard. Guides you through the UTM-1 appliance setup step by step. The
first part of the Setup Wizard is the Internet Wizard. For further information on
the Setup Wizard, see Setting Up the UTM-1 Appliance on page 99.

Internet Wizard. Guides you through the Internet connection configuration process
step by step. For further information, see Using the Internet Wizard on page 116.

Internet Setup. Offers the following advanced setup options:



Configure two Internet connections.
For information, see Configuring a Backup Internet Connection on page 176.
Enable Traffic Shaper for traffic flowing through the connection.
For information on Traffic Shaper, see Using Traffic Shaper.
Configure a dialup Internet connection.
Before configuring the connection, you must first set up the modem. For
information, see Setting Up Modems on page 164.
Using the Internet Wizard
The Internet Wizard allows you to configure your UTM-1 appliance for Internet connection
quickly and easily through its user-friendly interface.
Note: The first time you log in to the UTM-1 Portal, the Internet Wizard starts
automatically as part of the Setup Wizard. In this case, you should skip to step 3 in the
following procedure.
Configuring an Ethernet-Based Connection on Non-ADSL
Models
To configure an Ethernet-Based connection
1.
116
Click Network in the main menu, and click the Internet tab.
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
The Internet page appears.
2.
Click Internet Wizard.
The Internet Wizard opens with the Welcome page displayed.
3.
Click Next.
The Internet Connection Method dialog box appears.
Chapter 5: Configuring the Internet Connection
117
Using the Internet Wizard
4.
Select the Internet connection method you want to use for connecting to the
Internet.
If you are uncertain regarding which connection method to use, contact your ISP.
Note: If you selected PPTP or PPPoE, do not use your dial-up software to connect to the
Internet.
5.
Click Next.
If you chose PPPoE, continue at Using a PPPoE Connection on page 118.
If you chose PPTP, continue at Using a PPTP Connection on page 121.
If you chose Cable Modem, continue at Using a Cable Modem Connection on page
122.
If you chose Static IP, continue at Using a Static IP Connection on page 123.
If you chose DHCP, continue at Using a DHCP Connection on page 124.
Using a PPPoE Connection
If you selected the PPPoE (PPP over Ethernet) connection method, the PPP Configuration
dialog box appears.
1.
118
Complete the fields using the information in the following table.
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
2.
Click Next.
The Confirmation screen appears.
3.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
Chapter 5: Configuring the Internet Connection
119
Using the Internet Wizard
At the end of the connection process the Connected screen appears.
4.
Click Finish.
Table 29: PPPoE Connection Fields
In this field…
Do this…
Username
Type your user name.
Password
Type your password.
Confirm password
Type your password again.
Service
Type your service name.
This field can be left blank.
120
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
Using a PPTP Connection
If you selected the PPTP connection method, the PPP Configuration dialog box appears.
1.
Complete the fields using the information in the following table.
2.
Click Next.
The Confirmation screen appears.
3.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
At the end of the connection process the Connected screen appears.
4.
Click Finish.
Table 30: PPTP Connection Fields
In this field…
Do this…
Username
Type your user name.
Password
Type your password.
Chapter 5: Configuring the Internet Connection
121
Using the Internet Wizard
In this field…
Do this…
Confirm password
Type your password again.
Service
Type your service name.
Server IP
Type the IP address of the PPTP modem.
Internal IP
Type the local IP address required for accessing the PPTP modem.
Subnet Mask
Select the subnet mask of the PPTP modem.
Using a Cable Modem Connection
No further settings are required for a cable modem connection. The Confirmation screen
appears.
1.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
At the end of the connection process the Connected screen appears.
2.
122
Click Finish.
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
Using a Static IP Connection
If you selected the Static IP connection method, the Static IP Configuration dialog box
appears.
1.
Complete the fields using the information in the following table.
2.
Click Next.
The Confirmation screen appears.
3.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
At the end of the connection process the Connected screen appears.
4.
Click Finish.
Table 31: PPPoE Connection Fields
In this field…
Do this…
IP Address
Type the static IP address of your UTM-1 appliance.
Chapter 5: Configuring the Internet Connection
123
Using the Internet Wizard
In this field…
Do this…
Subnet Mask
Select the subnet mask that applies to the static IP address of your
UTM-1 appliance.
Default Gateway
Type the IP address of your ISP’s default gateway.
Primary DNS Server
Type the IP address of your ISP's primary DNS server.
Secondary DNS Server
Type the IP address of your ISP's secondary DNS server.
This field is optional.
WINS Server
Type the IP address of your ISP's WINS server.
This field is optional.
Using a DHCP Connection
No further settings are required for a DHCP (Dynamic IP) connection. The Confirmation
screen appears.
1.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
At the end of the connection process the Connected screen appears.
2.
Click Finish.
Configuring an Ethernet-Based Connection on ADSL
Models
Note: In ADSL models, an Ethernet-based connection is made on the DMZ/WAN2 port.
124
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
To configure an Ethernet-based connection
1.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
2.
Click Internet Wizard.
The Internet Wizard opens with the Welcome page displayed.
3.
Click Next.
The Internet Connection Port dialog box appears.
4.
Click Use the WAN2 port to connect to another network or router.
5.
Click Next.
Chapter 5: Configuring the Internet Connection
125
Using the Internet Wizard
The Internet Connection Method dialog box appears.
6.
Select the Internet connection method you want to use for connecting to the
Internet.
7.
Click Next.
If you chose PPPoE, continue at Using a PPPoE Connection on page 118.
If you chose PPTP, continue at Using a PPTP Connection on page 121.
If you chose Cable Modem, continue at Using a Cable Modem Connection on page
122.
If you chose Static IP, continue at Using a Static IP Connection on page 123.
If you chose DHCP, continue at Using a DHCP Connection on page 124.
Configuring a Direct ADSL Connection
To configure a direct ADSL connection
1.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
126
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
2.
Click Internet Wizard.
The Internet Wizard opens with the Welcome page displayed.
3.
Click Next.
The Internet Connection Port dialog box appears.
4.
Click Use the ADSL port.
The ADSL Connection Settings dialog box appears.
5.
Do one of the following:

To automatically fill in the supported ADSL settings for your ISP, do the
following:
1) Click Search by country and ISP.
The ADSL Configuration Assistant opens.
2) In the Country drop-down list, select your country.
Chapter 5: Configuring the Internet Connection
127
Using the Internet Wizard
6.
3) In the ISP / Telco drop-down list, select your ISP or telephone
company.
The ADSL Configuration Assistant closes, and the fields are filled in with the
correct values for your ISP.
 To manually fill in the supported ADSL settings for your ISP, complete the
fields using the information in the following table.
Click Next.
The Internet Connection Method dialog box appears.
7.
Select the Internet connection method you want to use for connecting to the
Internet.
8.
Click Next.
If you chose PPPoE or PPPoA, continue at Using a PPPoE or PPPoA Connection on
page 130.
If you chose Static IP, continue at Using a Static IP Connection on page 123.
If you chose DHCP, continue at Using a DHCP Connection on page 124.
128
Check Point UTM-1 Embedded NGX User Guide
Using the Internet Wizard
Table 32: ADSL Connection Fields
In this field…
Do this…
DSL Standard
Select the standard to support for the DSL line, as specified by your
ISP. This can be one of the following:
VPI Number

ADSL2

ADSL2+

Multimode

T.1413

G.lite

G.DMT
Type the VPI number to use for the ATM virtual path, as specified by
your ISP.
VCI Number
Type the VCI number to use for the ATM virtual circuit, as specified by
your ISP.
Encapsulation Type
Select the encapsulation type to use for the DSL line, as specified by
your ISP. This can be one of the following:

LLC

VCMUX
Chapter 5: Configuring the Internet Connection
129
Using the Internet Wizard
Using a PPPoE or PPPoA Connection
If you selected the PPPoE (PPP over Ethernet) or PPPoA (PPP over ATM) connection
method, the PPP Configuration dialog box appears.
1.
Complete the fields using the information in the following table.
2.
Click Next.
The Confirmation screen appears.
3.
Click Next.
The system attempts to connect to the Internet via the specified connection.
The Connecting… screen appears.
At the end of the connection process the Connected screen appears.
4.
Click Finish.
Table 33: PPPoE Connection Fields
In this field…
Do this…
Username
Type your user name.
Password
Type your password.
130
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
In this field…
Do this…
Confirm password
Type your password again.
Using Internet Setup
Internet Setup allows you to manually configure your Internet connection.
For information on configuring bridged Internet connections, see Adding Internet
Connections to Bridges on page 256.
To configure the Internet connection using Internet Setup
1.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
2.
Next to the desired Internet connection, click Edit.
Chapter 5: Configuring the Internet Connection
131
Using Internet Setup
The Internet Setup page appears.
3.
Do one of the following:




To configure an ADSL connection using the internal ADSL modem, continue
at Configuring a Direct ADSL Connection on page 132.
This option is available in ADSL models only.
To configure an Ethernet-based connection, continue at Configuring an
Ethernet-Based Connection on page 142.
To configure a Dialup connection, continue at Configuring a Dialup
Connection on page 155.
To configure no connection, continue at Using No Connection on page 157.
Configuring a Direct ADSL Connection
1.
In the Port drop-down list, select ADSL.
2.
Do one of the following:
132
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup

To automatically fill in the supported ADSL settings for your ISP, do the
following:
1) Click Search by country and ISP.
The ADSL Configuration Assistant opens.
2) In the Country drop-down list, select your country.
3) In the ISP / Telco drop-down list, select your ISP or telephone
company.
The ADSL Configuration Assistant closes. The Connection Type drop-down list
and the ADSL Link Settings fields are filled in with the correct values for your
ISP.
 To manually fill in the supported ADSL settings for your ISP, in the Connection
Type drop-down list, select the Internet connection type you intend to use.
The display changes according to the selected connection type.
For PPPoA, continue at Using a PPPoA Connection on page 134.
For EoA, continue at Using an EoA Connection on page 136.
For PPPoE, continue at Using a PPPoE Connection on page 138.
For IPoA, continue at Using an IPoA (IP over ATM) Connection on page 140.
For information on configuring bridged connections, see Adding Internet Connections
to Bridges on page 256.
Chapter 5: Configuring the Internet Connection
133
Using Internet Setup
Using a PPPoA (PPP over ATM) Connection
1.
134
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Chapter 5: Configuring the Internet Connection
135
Using Internet Setup
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Using an EoA (Ethernet over ATM) Connection
1.
136
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Chapter 5: Configuring the Internet Connection
137
Using Internet Setup
Using a PPPoE (PPP over Ethernet) Connection
1.
138
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Chapter 5: Configuring the Internet Connection
139
Using Internet Setup
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Using an IPoA (IP over ATM) Connection
1.
140
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Chapter 5: Configuring the Internet Connection
141
Using Internet Setup
Configuring an Ethernet-Based Connection
1.
In the Port drop-down list, do one of the following:


To configure an Ethernet-based connection through the WAN port, select WAN.
To configure an Ethernet-based connection through the DMZ/WAN2 port,
select WAN2.
This option is available in non-ADSL models only.
 To configure an Ethernet-based connection through a LAN port, select the
desired LAN port.
The selected port is automatically assigned to Internet use. For information on viewing
a port's assignment, see Viewing Port Statuses. on page 230
2.
In the Connection Type drop-down list, select the Internet connection type you
intend to use.
The display changes according to the connection type you selected.
If you chose LAN, continue at Using a LAN Connection on page 143.
If you chose Cable Modem, continue at Using a Cable Modem Connection on page
145.
If you chose PPPoE, continue at Using a PPPoE Connection on page 147.
If you chose PPTP, continue at Using a PPTP Connection on page 149.
If you chose L2TP, continue at Using an L2TP Connection on page 151.
If you chose Telstra, continue at Using a Telstra (BPA) Connection on page 153.
For information on configuring bridged connections, see Adding Internet Connections
to Bridges on page 256.
142
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Using a LAN Connection
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
143
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
144
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Using a Cable Modem Connection
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
145
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
146
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Using a PPPoE Connection
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
147
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
148
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Using a PPTP Connection
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
149
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
150
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Using an L2TP Connection
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
151
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
152
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
Using a Telstra (BPA) Connection
Use this Internet connection type only if you are subscribed to Telstra® BigPond™ Internet.
Telstra BigPond is a trademark of Telstra Corporation Limited.
1.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
153
Using Internet Setup
New fields appear, depending on the check boxes you selected.
2.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
154
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Configuring a Dialup Connection
Note: To use this connection type, you must first set up the dialup or cellular modem.
For information, see Setting Up Modems on page 164.
1.
In the Port drop-down list, do one of the following:

To configure a Dialup connection on the Serial port (using a connected RS232
modem), select Serial.
 To configure a Dialup connection on a USB port (using a connected USB
modem), select Cellular Modem.
The Connection Type field displays Dialup.
2.
Complete the fields using the relevant information in Internet Setup Fields on
page 157.
Chapter 5: Configuring the Internet Connection
155
Using Internet Setup
New fields appear, depending on the check boxes you selected.
3.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Establishing Connection‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
156
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
Configuring No Connection
1.
In the Port drop-down list, select None.
The fields disappear.
2.
Click Apply.
Table 34: Internet Setup Fields
In this field…
Do this…
ADSL Link Settings
DSL Standard
Select the standard to support for the DSL line, as specified by your ISP.
VPI Number
Type the VPI number to use for the ATM virtual path, as specified by your
ISP.
VCI Number
Type the VCI number to use for the ATM virtual circuit, as specified by your
ISP.
Encapsulation Type
Select the encapsulation type to use for the DSL line, as specified by your
ISP.
PPP Settings
Username
Type your user name.
Password
Type your password.
Confirm password
Type your password.
Chapter 5: Configuring the Internet Connection
157
Using Internet Setup
In this field…
Do this…
Service
Type your service name.
If your ISP has not provided you with a service name, leave this field empty.
Authentication
Specify the authentication method to use for PPP connections, by selecting
Method
one of the following:
Server IP

Auto. If possible, use CHAP; otherwise, use PAP. This is the
default.

PAP

CHAP
If you selected PPTP, type the IP address of the PPTP server as given by
your ISP.
If you selected Telstra (BPA), type the IP address of the Telstra
authentication server as given by Telstra.
Phone Number
If you selected Dialup, type the phone number that the modem should dial,
as given by your ISP.
Connect on demand
Select this option if you do not want the appliance to be constantly
connected to the Internet. The appliance will establish a connection only
under certain conditions.
This option is useful when configuring a backup connection. For
information, see Configuring a Backup Internet Connection on page
176.
When no higher
Select this option to specify that the appliance should only establish a
priority connection
connection in the following cases:
is available

When no other connection exists, and the UTM-1 appliance is
not acting as a Backup appliance.
If another connection opens, the appliance will disconnect.
For information on configuring the appliance as a Backup or
Master, see Configuring High Availability on page 263.

When there is interesting traffic (that is, traffic for which no static
158
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
In this field…
Do this…
route is defined).
On outgoing activity
Select this option to specify that the appliance should only establish a
connection if no other connection exists, and there is outgoing activity (that
is, packets need to be transmitted to the Internet).
If another connection opens, or if the connection times out, the appliance
disconnects.
Idle timeout
Type the amount of time (in minutes) that the connection can remain idle.
Once this period of time has elapsed, the appliance will disconnect.
The default value is 1.
Delay before
Type the amount of time (in seconds) that the appliance should wait to
connecting
re-connect to the Internet, if the connection goes down.
If you have an unstable Internet connection that tends to go down and then
return almost immediately, this setting allows you to avoid unnecessary and
costly dialing during outage periods, by deferring re-connection for a few
seconds.
The default value is 0.
Obtain IP address
Clear this option if you do not want the UTM-1 appliance to obtain an IP
automatically (using
address automatically using DHCP.
DHCP)
IP Address
Type the static IP address of your UTM-1 appliance.
Subnet Mask
Select the subnet mask that applies to the static IP address of your UTM-1
appliance.
Default Gateway
Type the IP address of your ISP’s default gateway.
Chapter 5: Configuring the Internet Connection
159
Using Internet Setup
In this field…
Do this…
Name Servers
Obtain Domain
Clear this option if you want the UTM-1 appliance to obtain an IP address
Name Servers
automatically using DHCP, but not to automatically configure DNS servers.
automatically
Obtain WINS Server
Clear this option if you want the UTM-1 appliance to obtain an IP address
automatically
automatically using DHCP, but not to automatically configure the WINS
server.
Primary DNS Server
Type the IP address of your ISP's primary DNS server.
Secondary DNS
Type the IP address of your ISP's secondary DNS server.
Server
WINS Server
Type the IP address of your ISP's WINS server.
Traffic Shaper
Shape Upstream:
Select this option to enable Traffic Shaper for outgoing traffic. Then type a
Link Rate
rate (in kilobits/second) slightly lower than your Internet connection's
maximum measured upstream speed in the field provided.
It is recommended to try different rates in order to determine which one
provides the best results.
For information on using Traffic Shaper, see Using Traffic Shaper.
Shape
Select this option to enable Traffic Shaper for incoming traffic. Then type a
Downstream: Link
rate (in kilobits/second) slightly lower than your Internet connection's
Rate
maximum measured downstream speed in the field provided.
It is recommended to try different rates in order to determine which one
provides the best results.
Note: Traffic Shaper cannot control the number or type of packets it receives
160
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
In this field…
Do this…
from the Internet; it can only affect the rate of incoming traffic by dropping
received packets. This makes the shaping of inbound traffic less accurate
than the shaping of outbound traffic. It is therefore recommended to enable
traffic shaping for incoming traffic only if necessary.
For information on using Traffic Shaper, see Using Traffic Shaper.
Advanced
External IP
If you selected PPTP, type the IP address of the PPTP client as given by
your ISP.
If you selected PPPoE, this field is optional, and you do not have to fill it in
unless your ISP has instructed you to do so.
MTU
This field allows you to control the maximum transmission unit size.
As a general recommendation you should leave this field empty. If however
you wish to modify the default MTU, it is recommended that you consult with
your ISP first and use MTU values between 1300 and 1500.
MAC Cloning
A MAC address is a 12-digit identifier assigned to every network device. If
your ISP restricts connections to specific, recognized MAC addresses, you
must select this option to clone a MAC address.
Note: When configuring MAC cloning for the secondary Internet connection,
the DMZ/WAN2 port must be configured as WAN2; otherwise this field is
disabled. For information on configuring ports, see Managing Ports on
page 228.
Hardware MAC
Address
This field displays the UTM-1 appliance's MAC address.
This field is read-only.
Chapter 5: Configuring the Internet Connection
161
Using Internet Setup
In this field…
Do this…
Cloned MAC
Do one of the following:
Address

Click This Computer to automatically "clone" the MAC address of
your computer to the UTM-1 appliance.

If the ISP requires authentication using the MAC address of a
different computer, type the MAC address in this field.
Note: In the secondary Internet connection, this field is enabled only if the
DMZ/WAN2 port is set to WAN2.
Load Balancing
Load Balancing
If you are using WAN load balancing, type a value indicating the amount of
Weight
traffic that should be routed through this connection relative to the other
connection.
For example, if you assign the primary connection a weight of 100, and you
assign the secondary connection a weight of 50, twice as much traffic will
be routed through the primary connection as through the secondary
connection.
To ensure full utilization of both Internet connections, the ratio between the
connections' load balancing weights should reflect the ratio between the
connections' bandwidths.
The default value is 50.
For information on WAN load balancing, see Configuring WAN Load
Balancing on page 178.
High Availability
Do not connect if
If you are using High Availability (HA), select this option to specify that the
this gateway is in
gateway should connect to the Internet only if it is the Active Gateway in the
passive state
HA cluster. This is called WAN HA.
This field is only enabled if HA is configured.
162
Check Point UTM-1 Embedded NGX User Guide
Using Internet Setup
In this field…
Do this…
For information on HA, see Configuring High Availability on page 263.
Dead Connection
Detection
Probe Next Hop
Select this option to automatically detect loss of connectivity to the default
gateway. If you selected LAN, this is done by sending ARP requests to the
default gateway. If you selected PPTP, PPPoE, or Dialup, this is done by
sending PPP echo reply (LCP) messages to the PPP peer.
By default, if the default gateway does not respond, the Internet connection
is considered to be down.
If it is determined that the Internet connection is down, and two Internet
connections are defined, a failover will be performed to the second Internet
connection, ensuring continuous Internet connectivity.
This option is selected by default.
Connection Probing
While the Probe Next Hop option checks the availability of the next hop router,
Method
which is usually at your ISP, connectivity to the next hop router does not
always indicate that the Internet is accessible. For example, if there is a
problem with a different router at the ISP, the next hop will be reachable, but
the Internet might be inaccessible. Connection probing is a way to detect
Internet failures that are more than one hop away.
Specify what method to use for probing the connection, by selecting one of
the following:

None. Do not perform Internet connection probing. Next hop
probing will still be used, if the Probe Next Hop check box is
selected. This is the default value.

Ping Addresses. Ping anywhere from one to three servers
Chapter 5: Configuring the Internet Connection
163
Setting Up Modems
In this field…
Do this…
specified by IP address or DNS name in the 1, 2, and 3 fields. If
for 45 seconds none of the defined servers respond to pinging,
the Internet connection is considered to be down.
Use this method if you have reliable servers that can be pinged,
that are a good indicator of Internet connectivity, and that are not
likely to fail simultaneously (that is, they are not at the same
location).
1, 2, 3

Probe DNS Servers. Probe the primary and secondary DNS
servers. If for 45 seconds neither gateway responds, the
Internet connection is considered to be down.
Use this method if the availability of your DNS servers is a good
indicator for the availability of Internet connectivity.

Probe VPN Gateway (RDP). Send RDP echo requests to up to three
Check Point VPN gateways specified by IP address or DNS
name in the 1, 2, and 3 fields. If for 45 seconds none of the
defined gateways respond, the Internet connection is
considered to be down.
Use this option if you have Check Point VPN gateways, and you
want loss of connectivity to these gateways to trigger ISP
failover to an Internet connection from which these gateways
are reachable.
If you chose the Ping Addresses connection probing method, type the IP
addresses or DNS names of the desired servers.
If you chose the Probe VPN Gateway (RDP) connection probing method, type
the IP addresses or DNS names of the desired VPN gateways.
You can clear a field by clicking Clear.
Setting Up Modems
You can use a connected modem as a primary or secondary Internet connection method.
This is useful in locations where broadband Internet access is unavailable.
164
Check Point UTM-1 Embedded NGX User Guide
Setting Up Modems
When used as a backup Internet connection, the modem can be automatically disconnected
when not in use. For information on setting up a backup connection, see Configuring a
Backup Internet Connection on page 176.
The UTM-1 appliance supports the connecting following modems:

RS232 dialup modem (regular or ISDN)
You can connect one RS232 to the appliance's Serial port.
See Setting Up an RS232 Modem on page 165.

USB-based modems, including dialup (PSTN/ISDN) and cellular
(GPRS/EVDO/3G) modems
You can connect up to two USB-based modems to the appliance's USB port.
See Setting Up a USB Modem on page 168.
Note: Only one USB modem can be used at a time.

ExpressCard cellular modem (on ADSL models only)
You can insert one ExpressCard cellular modem into the appliance's ExpressCard slot.
See Setting Up an ExpressCard Cellular Modem on page 172.
Setting Up an RS232 Modem
Note: Your RS232 dialup modem and your UTM-1 appliance's Serial port must be
configured for the same speed.
By default, the appliance's Serial port's speed is 57600 bps. For information on
changing the Serial port's speed, refer to the Embedded NGX CLI Reference Guide.
To set up an RS232 dialup modem
1.
Connect an RS232 dialup modem to your UTM-1 appliance's serial port.
For information on locating the serial port, see Introduction on page 1.
Chapter 5: Configuring the Internet Connection
165
Setting Up Modems
2.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
3.
Next to Serial, click Edit.
The Port Setup page appears.
4.
166
In the Assign to Network drop-down list, select Dialup.
Check Point UTM-1 Embedded NGX User Guide
Setting Up Modems
New fields appear.
5.
Complete the fields using the information in Dialup Fields on page 167.
6.
Click Apply.
7.
To check that that the values you entered are correct, click Test.
The page displays a message indicating whether the test succeeded.
8.
Configure a Dialup Internet connection on the Serial port.
See Using Internet Setup on page 131.
Table 35: RS232 Dialup Fields
In this field…
Do this…
Modem Type
Select the modem type.
You can select one of the predefined modem types or Custom.
If you selected Custom, the Installation String field is enabled. Otherwise, it is
filled in with the correct installation string for the modem type.
Initialization String
Type the installation string for the custom modem type.
If you selected a standard modem type, this field is read-only.
Chapter 5: Configuring the Internet Connection
167
Setting Up Modems
In this field…
Do this…
Dial Mode
Select the dial mode the modem uses.
Port Speed
Select the Serial port's speed (in bits per second).
The Serial port's speed must match that of the attached dialup modem.
The default value is 57600.
Flow Control
Select the method of flow control supported by the attached device:

RTS/CTS. Hardware-based flow control, using the Serial port's
RTS/CTS lines.

XON/XOFF. Software-based flow control, using XON/XOFF
characters.
Answer incoming
Select this option to specify that the modem should answer incoming PPP
PPP calls
calls. This allows accessing the appliance out of band for maintenance
purposes, in case the primary Internet connection fails.
The client is assigned an IP address from the OfficeMode network;
therefore, the OfficeMode network must be enabled. For information on
enabling the OfficeMode network, see Configuring the OfficeMode
Network on page 197.
Setting Up a USB Modem
Warning: Before attaching a USB modem, ensure that the total power drawn by all
connected USB devices does not exceed 2.5W per port (0.5A at 5V). If the total current
consumed by a port exceeds 0.5A, a powered USB hub must be used, to avoid damage
to the gateway.
To set up a USB modem
1.
168
Connect a USB-based modem to one of your UTM-1 appliance's USB ports.
Check Point UTM-1 Embedded NGX User Guide
Setting Up Modems
For information on locating the USB ports, see Introduction on page 1.
2.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
3.
Next to USB, click Edit.
The USB Devices page appears. If the UTM-1 appliance detected the modem, the
modem is listed on the page.
Chapter 5: Configuring the Internet Connection
169
Setting Up Modems
If the modem is not listed, check that you connected the modem correctly, then click
Refresh to refresh the page.
4.
Next to the modem, click Edit.
The USB Modem Setup page appears.
5.
Complete the fields using the information in USB Dialup Fields on page 170.
6.
Click Apply.
7.
To check that that the values you entered are correct, click Test.
The page displays a message indicating whether the test succeeded.
8.
Configure a Dialup Internet connection on the Cellular Modem port.
See Using Internet Setup on page 131.
Table 36: USB Dialup Fields
In this field…
Do this…
Modem Type
Select the modem type.
You can select one of the predefined modem types or Custom.
If you selected Custom, the Installation String field is enabled. Otherwise, it is
filled in with the correct installation string for the modem type.
170
Check Point UTM-1 Embedded NGX User Guide
Setting Up Modems
In this field…
Do this…
Initialization String
Type the installation string for the custom modem type.
If you selected a standard modem type, this field is read-only.
Dial Mode
Select the dial mode the modem uses.
Port Speed
Select the modem's port speed (in bits per second).
Answer incoming
Select this option to specify that the modem should answer incoming PPP
PPP calls
calls. This allows accessing the appliance out of band for maintenance
purposes, in case the primary Internet connection fails.
The client is assigned an IP address from the OfficeMode network;
therefore, the OfficeMode network must be enabled. For information on
enabling the OfficeMode network, see Configuring the OfficeMode
Network on page 197.
Cellular
APN
Type your Access Point Name (APN) as given by your cellular provider.
If your cellular provider has not provided you with an APN, leave this field
empty.
PIN
Type the Personal Identification Number (PIN) code that you received with
your cellular SIM card, if required by your modem.
The PIN code is usually 4 digits long.
Warning: Entering an incorrect PIN code may cause your SIM card to be
blocked.
Chapter 5: Configuring the Internet Connection
171
Setting Up Modems
Setting Up an ExpressCard Cellular Modem
To set up an ExpressCard cellular modem
1.
Insert an ExpressCard into the ExpressCard slot on the side of the appliance.
For information on locating the ExpressCard slot, see Introduction on page 1.
2.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
3.
Next to ExC, click Edit.
The USB Devices page appears. If the UTM-1 appliance detected the modem, the
modem is listed on the page.
If the modem is not listed, check that you connected the modem correctly, then click
Refresh to refresh the page.
172
Check Point UTM-1 Embedded NGX User Guide
Viewing Internet Connection Information
4.
Next to the modem, click Edit.
The Cellular Modem Setup page appears.
5.
Complete the fields using the information in USB Dialup Fields on page 170.
6.
Click Apply.
7.
To check that that the values you entered are correct, click Test.
The page displays a message indicating whether the test succeeded.
8.
Configure a Dialup Internet connection on the Cellular Modem port.
See Using Internet Setup on page 131.
Viewing Internet Connection Information
You can view information on your Internet connection(s) in terms of status, duration, and
activity.
To view Internet connection information
1.
Click Network in the main menu, and click the Internet tab.
Chapter 5: Configuring the Internet Connection
173
Viewing Internet Connection Information
The Internet page appears.
For an explanation of the fields on this page, see the following table.
2.
174
To refresh the information on this page, click Refresh.
Check Point UTM-1 Embedded NGX User Guide
Enabling/Disabling the Internet Connection
Table 37: Internet Page Fields
Field
Description
Status
Indicates the connection’s status.
Duration
Indicates the connection duration, if active. The duration is given in the
format hh:mm:ss, where:
hh=hours
mm=minutes
ss=seconds
IP Address
Your IP address.
Enabled
Indicates whether or not the connection is enabled.
For further information, see Enabling/Disabling the Internet Connection
on page 175
Enabling/Disabling the Internet Connection
You can temporarily disable an Internet connection. This is useful if, for example, you are
going on vacation and do not want to leave your computer connected to the Internet. If you
have two Internet connections, you can force the UTM-1 appliance to use a particular
connection, by disabling the other connection.
The Internet connection’s Enabled/Disabled status is persistent through UTM-1 appliance
reboots.
To enable/disable an Internet connection
1.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
Chapter 5: Configuring the Internet Connection
175
Using Quick Internet Connection/Disconnection
2.
Next to the Internet connection, do one of the following:

To enable the connection, click
The button changes to

and the connection is enabled.
To disable the connection, click
The button changes to
.
.
and the connection is disabled.
Using Quick Internet Connection/Disconnection
By clicking the Connect or Disconnect button (depending on the connection status) on the
Internet page, you can establish a quick Internet connection using the currently-selected
connection type. In the same manner, you can terminate the active connection.
The Internet connection retains its Connected/Not Connected status until the UTM-1
appliance is rebooted. The UTM-1 appliance then connects to the Internet if the connection
is enabled. For information on enabling an Internet connection, see Enabling/Disabling the
Internet Connection on page 175.
Configuring a Backup Internet Connection
You can configure both a primary and a secondary Internet connection. The secondary
connection acts as a backup, so that if the primary connection fails, the UTM-1 appliance
remains connected to the Internet.
You have full flexibility in deciding which port to use for each Internet connection. You can
assign the primary connection to use any of the following ports:

WAN port (on Non-ADSL models)

DSL port (on ADSL models)

Serial port (for use with an RS232 modem)

DMZ/WAN2 port
176
Check Point UTM-1 Embedded NGX User Guide
Configuring a Backup Internet Connection

USB ports (for use with a USB modem)

ExpressCard slot
You can assign the secondary connection to use any of the above ports that is not being used
by the primary connection.
Note: You can configure different DNS servers for the primary and secondary
connections. The UTM-1 appliance acts as a DNS relay and routes requests from
computers within the network to the appropriate DNS server for the active Internet
connection.
Note: You can easily swap the roles of the primary and secondary connections, while
simultaneously shifting all relevant port assignments between the primary and
secondary connections, by using the swap wanconn CLI command. For information,
refer to the Embedded NGX CLI Reference Guide.
Chapter 5: Configuring the Internet Connection
177
Configuring WAN Load Balancing
Configuring WAN Load Balancing
If your network is prone to congestion, for example in large offices which include multiple
active clients and/or servers, you can increase the amount of available bandwidth by
configuring WAN load balancing. By default, the UTM-1 appliance routes all traffic to the
primary Internet connection, and the secondary Internet connection is used only when the
primary connection is down, or when a routing rule specifically states that traffic should be
sent through the secondary connection. WAN load balancing automatically distributes
traffic between the primary and secondary connections, allowing you to use both
connections in parallel.
When one IP address sends packets to another IP address, the UTM-1 appliance examines
each Internet connection's recent bandwidth utilization in kilobits per second to determine its
load. The UTM-1 appliance then enters the source-destination pair in a load balancing table
and specifies the least-loaded Internet connection as the connection to use for traffic between
this pair. To prevent disruption of stateful protocols, the UTM-1 appliance will route all
traffic between this pair to the specified Internet connection, so long as the pair remains in
the load balancing table.
Note: By default, load balancing is performed when the amount of bandwidth utilization
exceeds a threshold of 64 kilobits per second. You can change this threshold via the
CLI. For information, refer to the Embedded NGX CLI Guide.
Note: By default, a source-destination pair is removed from the load balancing table
after 1 hour of inactivity. You can change the default value via the CLI. For
information, refer to the Embedded NGX CLI Guide.
Note: In order for WAN load balancing to be effective, there must be more than one
active source-destination pair.
By default, the load distribution between Internet connections is symmetric; however, you
can configure non-symmetric load balancing by assigning a different load balancing weight
to each Internet connection. For example, if you assign the primary connection a weight of
100, and you assign the secondary connection a weight of 50, the UTM-1 appliance will only
route traffic to the secondary connection if the primary connection's current load is more
178
Check Point UTM-1 Embedded NGX User Guide
Configuring WAN Load Balancing
than twice the secondary connection's current load. Therefore, to ensure full utilization of
both Internet connections, the ratio between the connections' load balancing weights should
reflect the ratio between the connections' bandwidths.
Note: To ensure continuous Internet connectivity, if one of the Internet connections
fails, all traffic will be routed to the other connection.
To configure WAN load balancing
1.
Configure the desired load balancing weight for both the primary and secondary
Internet connections.
For further information, see the Load Balancing Weight field in Using Internet Setup on
page 131.
2.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
3.
In the WAN Load Balancing area, drag the load balancing lever to On.
WAN load balancing is enabled. Traffic will be distributed automatically across the
defined Internet connections, according to the configured load balancing weights.
Note: You can view the effect of WAN load balancing in the Traffic Monitor.
Chapter 5: Configuring the Internet Connection
179
Configuring Network Settings
Chapter 6
Managing Your Network
This chapter describes how to manage and configure your network connection and settings.
This chapter includes the following topics:
Configuring Network Settings ..................................................................181
Using the Internal DNS Server .................................................................208
Using Network Objects ............................................................................210
Configuring Network Service Objects...................................................... 220
Using Static Routes .................................................................................. 223
Managing Ports ......................................................................................... 228
Using the Terminal Server ........................................................................239
Configuring Network Settings
Note: If you accidentally change the network settings to incorrect values and are
unable to connect to the my.firewall Web portal, you can connect to the appliance
through the serial console and correct the error (see Using a Console on page 668).
Alternatively, you can reset the UTM-1 appliance to its default settings (see Resetting
the UTM-1 appliance to Defaults on page 715).
Chapter 6: Managing Your Network
181
Configuring Network Settings
Configuring the LAN Network
To configure the LAN network
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
182
Click Edit in the LAN network’s row.
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
The Edit Network Settings page for the LAN network appears.
3.
In the Mode drop-down list, select Enabled.
The fields are enabled.
4.
If desired, change your UTM-1 appliance’s internal IP address.
See Changing IP Addresses on page 184.
5.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
6.
If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
7.
Click Apply.
A warning message appears.
8.
Click OK.
A success message appears.
Chapter 6: Managing Your Network
183
Configuring Network Settings
Changing IP Addresses
If desired, you can change your UTM-1 appliance’s internal IP address, or the entire range of
IP addresses in your internal network.
To change IP addresses
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the desired network's row, click Edit.
The Edit Network Settings page appears.
3.
To change the UTM-1 appliance’s internal IP address, enter the new IP address
in the IP Address field.
4.
To change the internal network range, enter a new value in the Subnet Mask
field.
Note: The internal network range is defined both by the UTM-1 appliance’s internal IP
address and by the subnet mask.
For example, if the UTM-1 appliance’s internal IP address is 192.168.100.7, and you
set the subnet mask to 255.255.255.0, the network’s IP address range will be
192.168.100.1 – 192.168.100.254.
5.
Click Apply.
A warning message appears.
6.
Click OK.

7.
The UTM-1 appliance's internal IP address and/or the internal network range
are changed.
 A success message appears.
Do one of the following:

184
If your computer is configured to obtain its IP address automatically
(using DHCP), and the UTM-1 DHCP server is enabled, restart your computer.
Your computer obtains an IP address in the new range.
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings

Otherwise, manually reconfigure your computer to use the new
address range using the TCP/IP settings. For information on configuring
TCP/IP, see TCP/IP Settings on page 78.
Enabling/Disabling Hide NAT
Hide Network Address Translation (Hide NAT) enables you to share a single public Internet
IP address among several computers, by ―hiding‖ the private IP addresses of the internal
computers behind the UTM-1 appliance’s single Internet IP address.
Note: If Hide NAT is disabled, you must obtain a range of Internet IP addresses from
your ISP. Hide NAT is enabled by default.
Note: Static NAT, Hide NAT, and custom NAT rules can be used together.
To enable/disable Hide NAT
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the desired network's row, click Edit.
The Edit Network Settings page appears.
3.
From the Hide NAT list, select Enabled or Disabled.
4.
Click Apply.
A warning message appears.
5.
Click OK.


If you chose to disable Hide NAT, it is disabled.
If you chose to enable Hide NAT, it is enabled.
Chapter 6: Managing Your Network
185
Configuring Network Settings
Configuring a DHCP Server
By default, the UTM-1 appliance operates as a DHCP (Dynamic Host Configuration
Protocol) server. This allows the UTM-1 appliance to automatically configure all the devices
on your network with their network configuration details.
Note: The DHCP server only serves computers that are configured to obtain an IP
address automatically. If a computer is not configured to obtain an IP address
automatically, it is recommended to assign it an IP address outside of the DHCP
address range. However, if you do assign the computer an IP address within the
DHCP address range, the DHCP server will detect this and will not assign this IP
address to another computer.
If you already have a DHCP server in your internal network, and you want to use it instead of
the UTM-1 DHCP server, you must disable the UTM-1 DHCP server, since you cannot have
two DHCP servers or relays on the same network segment.
If you want to use a DHCP server on the Internet or via a VPN, instead of the UTM-1 DHCP
server, you can configure DHCP relay. When in DHCP relay mode, the UTM-1 appliance
relays information from the desired DHCP server to the devices on your network.
Note: You can perform DHCP reservation using network objects. For information, see
Using Network Objects on page 210.
Note: The following DHCP server configurations are not available for the OfficeMode
network:
186

Enabling and disabling the UTM-1 DHCP Server

Setting the DHCP range manually

Configuring DHCP relay
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
Enabling/Disabling the UTM-1 DHCP Server
You can enable and disable the UTM-1 DHCP Server for internal networks.
To enable/disable the UTM-1 DHCP server
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the desired network's row, click Edit.
The Edit Network Settings page appears.
3.
From the DHCP Server list, select Enabled or Disabled.
4.
Click Apply.
A warning message appears.
5.
Click OK.
A success message appears
6.
If your computer is configured to obtain its IP address automatically (using
DHCP), and either the UTM-1 DHCP server or another DHCP server is
enabled, restart your computer.
If you enabled the DHCP server, your computer obtains an IP address in the DHCP
address range.
Configuring the DHCP Address Range
By default, the UTM-1 DHCP server automatically sets the DHCP address range. The
DHCP address range is the range of IP addresses that the DHCP server can assign to network
devices. IP addresses outside of the DHCP address range are reserved for statically
addressed computers.
If desired, you can set the UTM-1 DHCP range manually.
Chapter 6: Managing Your Network
187
Configuring Network Settings
To configure the DHCP address range
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the desired network's row, click Edit.
The Edit Network Settings page appears.
3.
Do one of the following:


4.
To allow the DHCP server to set the IP address range, select the Automatic
DHCP range check box.
To set the DHCP range manually:
1) Clear the Automatic DHCP range check box.
The DHCP IP range fields appear.
2) In the DHCP IP range fields, type the desired DHCP range.
Click Apply.
A warning message appears.
5.
Click OK.
A success message appears
6.
188
If your computer is configured to obtain its IP address automatically (using
DHCP), and either the UTM-1 DHCP server or another DHCP server is
enabled, restart your computer.
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
Your computer obtains an IP address in the new DHCP address range.
Configuring DHCP Relay
You can configure DHCP relay for internal networks.
Note: DHCP relay will not work if the appliance is located behind a NAT device.
To configure DHCP relay
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the desired network's row, click Edit.
The Edit Network Settings page appears.
3.
In the DHCP Server list, select Relay.
The Automatic DHCP range check box is disabled, and new fields appear.
4.
In the Primary DHCP Server IP field, type the IP address of the primary DHCP
server.
Chapter 6: Managing Your Network
189
Configuring Network Settings
5.
In the Secondary DHCP Server IP field, type the IP address of the DHCP server
to use if the primary DHCP server fails.
6.
Click Apply.
A warning message appears.
7.
Click OK.
A success message appears
8.
If your computer is configured to obtain its IP address automatically (using
DHCP), and either the UTM-1 DHCP server or another DHCP server is
enabled, restart your computer.
Your computer obtains an IP address in the DHCP address range.
Configuring DHCP Server Options
If desired, you can configure the following custom DHCP options for an internal network:

Domain suffix

DNS servers

WINS servers

Default gateway

NTP servers

VoIP call managers

TFTP server and boot filename

Avaya, Nortel, and Thomson IP phone configuration strings
To configure DHCP options
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
190
In the desired network's row, click Edit.
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
The Edit Network Settings page appears.
3.
In the DHCP area, click Options.
The DHCP Server Options page appears.
4.
Complete the fields using the relevant information in the following table.
Chapter 6: Managing Your Network
191
Configuring Network Settings
New fields appear, depending on the check boxes you selected.
5.
Click Apply.
6.
If your computer is configured to obtain its IP address automatically (using
DHCP), restart your computer.
Your computer obtains an IP address in the DHCP address range.
192
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
Table 38: DHCP Server Options Fields
In this field…
Do this…
Domain Name
Type a default domain suffix that should be passed to DHCP clients.
The DHCP client will automatically append the domain suffix for the
resolving of non-fully qualified names. For example, if the domain suffix
is set to "mydomain.com", and the client tries to resolve the name ―mail‖,
the suffix will be automatically appended to the name, resulting in
―mail.mydomain.com‖.
Name Servers
Automatically assign
Clear this option if you do not want the gateway to act as a DNS relay
DNS server
server and pass its own IP address to DHCP clients.
(recommended)
Normally, it is recommended to leave this option selected.
The DNS Server 1 and DNS Server 2 fields appear.
DNS Server 1, 2
Type the IP addresses of the Primary and Secondary DNS servers to
pass to DHCP clients instead of the gateway.
Automatically assign
Clear this option if you do not want DHCP clients to be assigned the
WINS server
same WINS servers as specified by the Internet connection
configuration (in the Internet Setup page).
The WINS Server 1 and WINS Server 2 fields appear.
WINS Server 1, 2
Type the IP addresses of the Primary and Secondary WINS servers to
use instead of the gateway.
Chapter 6: Managing Your Network
193
Configuring Network Settings
In this field…
Do this…
Automatically assign
Clear this option if you do not want the DHCP server to pass the current
default gateway
gateway IP address to DHCP clients as the default gateway's IP
address.
Normally, it is recommended to leave this option selected.
The Default Gateway field is enabled.
Default Gateway
Type the IP address to pass to DHCP clients as the default gateway,
instead of the current gateway IP address.
Other Services
These fields are not available for the OfficeMode network.
Time Server 1, 2
To use Network Time Protocol (NTP) servers to synchronize the time on
the DHCP clients, type the IP address of the Primary and Secondary
NTP servers.
Call Manager 1, 2
To assign Voice over Internet Protocol (VoIP) call managers to the IP
phones, type the IP address of the Primary and Secondary VoIP
servers.
TFTP Server
Trivial File Transfer Protocol (TFTP) enables booting diskless
computers over the network.
To assign a TFTP server to the DHCP clients, type the IP address of the
TFTP server.
TFTP Boot File
Type the boot file to use for booting DHCP clients via TFTP.
X-Windows Display
To assign X-Windows terminals the appropriate X-Windows Display
Manager
Manager when booting via DHCP, type the XDM server's IP address.
Avaya IP Phone
To enable Avaya IP phones to receive their configuration, type the
phone's configuration string.
194
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
In this field…
Do this…
Nortel IP Phone
To enable Nortel IP phones to receive their configuration, type the
phone's configuration string.
Thomson IP Phone
To enable Thomson IP phones to receive their configuration, type the
phone's configuration string.
Configuring a DMZ Network
In addition to the LAN network, you can define a second internal network called a DMZ
(demilitarized zone) network.
For information on default security policy rules controlling traffic to and from the DMZ, see
Default Security Policy on page 367.
To configure a DMZ network
1.
Connect the DMZ computer to the DMZ port.
If you have more than one computer in the DMZ network, connect a hub or switch to the
DMZ port, and connect the DMZ computers to the hub.
2.
Click Network in the main menu, and click the Ports tab.
Chapter 6: Managing Your Network
195
Configuring Network Settings
The Ports page appears.
3.
Next to the DMZ/WAN2 port, click Edit.
The Port Setup page appears.
4.
In the Assign to network drop-down list, select DMZ.
5.
Click Apply.
196
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
A warning message appears.
6.
Click OK.
7.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
8.
In the DMZ network's row, click Edit.
The Edit Network Settings page appears.
9.
In the Mode drop-down list, select Enabled.
The fields are enabled.
10. In the IP Address field, type the IP address of the DMZ network's default
gateway.
Note: The DMZ network must not overlap other networks.
11. In the Subnet Mask drop-down list, select the DMZ’s internal network range.
12. If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
13. If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
14. Click Apply.
A warning message appears.
15. Click OK.
A success message appears.
Configuring the OfficeMode Network
By default, VPN Clients connect to the VPN Server using an Internet IP address locally
assigned by an ISP. This may lead to the following problems:
Chapter 6: Managing Your Network
197
Configuring Network Settings

VPN Clients on the same network will be unable to communicate with each other
via the UTM-1 Internal VPN Server. This is because their IP addresses are on the
same subnet, and they therefore attempt to communicate directly over the local
network, instead of through the secure VPN link.

Some networking protocols or resources may require the client’s IP address to be
an internal one.
OfficeMode solves these problems by enabling the UTM-1 DHCP Server to automatically
assign a unique local IP address to the VPN client, when the client connects and
authenticates. The IP addresses are allocated from a pool called the OfficeMode network.
Note: OfficeMode requires either Check Point SecureClient, an L2TP client, or an
Endpoint Connect client to be installed on the VPN clients. It is not supported by Check
Point SecuRemote.
When OfficeMode is not supported by the VPN client, traditional mode will be used
instead.
To configure the OfficeMode network
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
In the OfficeMode network's row, click Edit.
The Edit Network Settings page appears.
3.
In the Mode drop-down list, select Enabled.
The fields are enabled.
4.
In the IP Address field, type the IP address to use as the OfficeMode network's
default gateway.
Note: The OfficeMode network must not overlap other networks.
5.
In the Subnet Mask text box, type the OfficeMode internal network range.
6.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
198
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
7.
If desired, configure DHCP options.
See Configuring DHCP Server Options on page 190.
8.
Click Apply.
A warning message appears.
9.
Click OK.
A success message appears.
Chapter 6: Managing Your Network
199
Configuring Network Settings
Configuring VLANs
Your UTM-1 appliance allows you to partition your network into several virtual LAN
networks (VLANs). A VLAN is a logical network behind the UTM-1 appliance. Computers
in the same VLAN behave as if they were on the same physical network: traffic flows freely
between them, without passing through a firewall. In contrast, traffic between a VLAN and
other networks passes through the firewall and is subject to the security policy. By default,
traffic from a VLAN to any other internal network (including other VLANs) is blocked. In
this way, defining VLANs can increase security and reduce network congestion.
For example, you can assign each division within your organization to a different VLAN,
regardless of their physical location. The members of a division will be able to communicate
with each other and share resources, and only members who need to communicate with other
divisions will be allowed to do so. Furthermore, you can easily transfer a member of one
division to another division without rewiring your network, by simply reassigning them to
the desired VLAN.
The UTM-1 appliance supports the following VLAN types:

200
Tag-based
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
In tag-based VLAN you use one of the gateway’s ports as a 802.1Q VLAN trunk,
connecting the appliance to a VLAN-aware switch. Each VLAN behind the trunk is
assigned an identifying number called a ―VLAN ID‖, also referred to as a "VLAN tag".
All outgoing traffic from a tag-based VLAN contains the VLAN's tag in the packet
headers. Incoming traffic to the VLAN must contain the VLAN's tag as well, or the
packets are dropped. Tagging ensures that traffic is directed to the correct VLAN.
Figure 29: Tag-Based VLAN

Port-based
Port-based VLAN allows assigning the appliance's LAN ports to VLANs, effectively
transforming the appliance's four-port switch into up to four firewall-isolated security
zones. You can assign multiple ports to the same VLAN, or each port to a separate
VLAN.
Chapter 6: Managing Your Network
201
Configuring Network Settings
Port-based VLAN does not require an external VLAN-capable switch, and is therefore
simpler to use than tag-based VLAN. However, port-based VLAN is limited by the
number of appliance LAN ports.
Figure 30: Port-Based VLAN

Virtual access point (VAP)
In wireless UTM-1 models, you can partition the primary WLAN network into wireless
VLANs called virtual access points (VAPs). You can use VAPs to grant different
permissions to groups of wireless users, by configuring each VAP with the desired
security policy and network settings, and then assigning each group of wireless users to
the relevant VAP. For example, you could assign different permissions to employees
and guests on the company's wireless network, by configuring two VAPs called ―Guest‖
and ―Employee‖ with the desired set of permissions.
To use VAPs, you must enable the primary WLAN network.
For more information on VAPs, see Overview on page 285.

Wireless Distribution System (WDS) links
In wireless UTM-1 models, you can extend the primary WLAN's coverage area, by
creating a Wireless Distribution System (WDS). A WDS is a system of access points
that communicate with each other wirelessly, without any need for a wired backbone.
WDS is usually used together with bridge mode to connect the networks behind the
access points.
To create a WDS, you must add WDS links between the desired access points. For
example, if your business extends across a large area, and a single access point does not
provide sufficient coverage, then you can add a second access point and create a WDS
link between the two access points.
202
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
To use WDS links, you must enable the primary WLAN network.
For more information on WDS links, see Overview on page 285.
The number of VLAN networks you can define depends on your UTM-1 series and model.
Table 39: Supported Number of VLANs
Series
Models
Maximum Number of VLANs
(of all supported types combined)
UTM-1 Edge N
Models with
64 VLAN networks
unlimited nodes
UTM-1 Edge N
Models without
32 VLAN networks
unlimited nodes
UTM-1 Edge NW
Models with
64 VLAN networks
unlimited nodes
UTM-1 Edge NW
UTM-1 Edge W
Models without
32 VLAN networks, including up to 3 VAPs, and up to 7
unlimited nodes
WDS links
All models
10 VLAN networks, including up to 3 VAPs, and up to 7
WDS links
For information on counting VAPs and WDS links, see Configuring a Wireless Network on
page 285.
For information on the default security policy for VLANs, see Default Security Policy on
page 367.
Adding and Editing VLANs
For information on adding and editing port-based VLANs, see Adding and Editing
Port-Based VLANs on page 204.
Chapter 6: Managing Your Network
203
Configuring Network Settings
For information on adding and editing tag-based VLANs, see Adding and Editing
Tag-Based VLANs on page 206.
For information on adding and editing VAPs, see Configuring Virtual Access Points on
page 313.
For information on adding and editing WDS links, see Configuring WDS Links on page
317.
Adding and Editing Port-Based VLANs
To add or edit a port-based VLAN
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
Do one of the following:
 To add a VLAN, click Add Network.
 To edit a VLAN, click Edit in the desired VLAN’s row.
The Edit Network Settings page for VLAN networks appears.
204
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
3.
In the Network Name field, type a name for the VLAN.
4.
In the Type drop-down list, select Port Based VLAN.
The VLAN Tag field disappears.
5.
In the Mode drop-down list, select Enabled.
The fields are enabled.
6.
In the IP Address field, type the IP address of the VLAN network's default
gateway.
Note: The VLAN network must not overlap other networks.
7.
In the Subnet Mask field, type the VLAN's internal network range.
8.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
9.
If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
10. Click Apply.
A warning message appears.
11. Click OK.
A success message appears.
12. Click Network in the main menu, and click the Ports tab.
The Ports page appears.
13. Next to the LAN port you want to assign, click Edit.
The Port Setup page appears.
14. In the Assign to network drop-down list, select the VLAN network's name.
You can assign more than one port to the VLAN.
15. Click Apply.
Chapter 6: Managing Your Network
205
Configuring Network Settings
Adding and Editing Tag-Based VLANs
To add or edit a tag-based VLAN
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
Do one of the following:
 To add a VLAN, click Add Network.
 To edit a VLAN, click Edit in the desired VLAN’s row.
The Edit Network Settings page for VLAN networks appears.
3.
In the Network Name field, type a name for the VLAN.
4.
In the Type drop-down list, select Tag Based VLAN.
The VLAN Tag field appears.
5.
In the VLAN Tag field, type a tag for the VLAN.
This must be an integer between 1 and 4095.
6.
In the Mode drop-down list, select Enabled.
The fields are enabled.
7.
In the IP Address field, type the IP address of the VLAN network's default
gateway.
Note: The VLAN network must not overlap other networks.
8.
In the Subnet Mask field, type the VLAN's internal network range.
9.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
10. If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
11. Click Apply.
206
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Settings
A warning message appears.
12. Click OK.
A success message appears.
13. Click Network in the main menu, and click the Ports tab.
The Ports page appears.
14. In the DMZ/WAN2 drop-down list, select VLAN Trunk.
15. Click Apply.
The DMZ/WAN2 port now operates as a VLAN Trunk port. In this mode, it will not
accept untagged packets.
16. Configure a VLAN trunk (802.1Q) port on the VLAN-aware switch, according
to the vendor instructions. Define the same VLAN IDs on the switch.
17. Connect the UTM-1 appliance's DMZ/WAN2 port to the VLAN-aware switch's
VLAN trunk port.
Deleting VLANs
To delete a VLAN
1.
If the VLAN is port-based, do the following:
2.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
b. Remove all port assignments to the VLAN, by selecting other networks in
the drop-down lists.
c. Click Apply.
Delete any firewall rules or VStream Antivirus rules that use this VLAN.
3.
Click Network in the main menu, and click the My Network tab.
a.
The My Network page appears.
4.
In the desired VLAN’s row, click Erase.
A confirmation message appears.
Chapter 6: Managing Your Network
207
Using the Internal DNS Server
5.
Click OK.
The VLAN is deleted.
Using the Internal DNS Server
The UTM-1 appliance includes an internal DNS server, which can resolve DNS names for
hosts defined as network objects. Each host is assigned a DNS name in the format
<networkobjectname>.<domainsuffix>, where <networkobjectname> is
the name of the network object representing the host, and <domainsuffix> is the
domain name suffix configured for the internal DNS server. The internal DNS server will
reply to all DNS requests for the host's DNS name with the host's IP address.
In addition to resolving network objects, the internal DNS server also resolves requests for
the current gateway. If a gateway hostname is defined, the DNS server will reply to DNS
requests in the format <hostname>.<domainsuffix> with the gateway’s internal IP
address. For information on configuring the gateway's hostname, see Configuring a
Gateway Hostname on page 677.
Note: The internal DNS server responds to DNS requests from internal network hosts
only. It does not respond to requests from the Internet.
Example
If a computer with the IP address 192.188.22.1 is represented by a network object called
"server1", and the internal DNS server is configured with the domain suffix
"mycompany.com", then the computer's DNS name will be "server1.mycompany.com", and
the internal DNS server will reply to all DNS requests for "server1.mycompany.com" with
the IP address 192.188.22.1.
In addition, if the gateway is configured with the hostname "mygateway", the DNS server
will reply to all DNS requests for "mygateway.mycompany.com" with the gateway’s
internal IP address.
208
Check Point UTM-1 Embedded NGX User Guide
Using the Internal DNS Server
Enabling the Internal DNS Server
To enable the internal DNS server
1.
Click Setup in the main menu, and click the DNS Server tab.
The DNS Server page appears.
2.
Select the Enable the Internal DNS Server check box.
The Domain Name Suffix field appears.
3.
In the Domain Name Suffix field, type the desired domain name suffix.
Chapter 6: Managing Your Network
209
Using Network Objects
4.
Click Apply.
Using Network Objects
You can add individual computers or networks as network objects. This enables you to
configure various settings for the computer or network represented by the network object.
You can configure the following settings for a network object:

Static NAT (or One-to-One NAT)
Static NAT allows the mapping of Internet IP addresses or address ranges to hosts
inside the internal network. This is useful if you want a computer in your private
network to have its own Internet IP address. For example, if you have both a mail server
and a Web server in your network, you can map each one to a separate Internet IP
address.
Static NAT rules do not imply any security rules. To allow incoming traffic to a host for
which you defined Static NAT, you must create an Allow rule. When specifying
firewall rules for such hosts, use the host’s internal IP address, and not the Internet IP
address to which the internal IP address is mapped. For further information, see Using
Rules on page 374.
Note: Static NAT, Hide NAT, and custom NAT rules can be used together.
Note: The UTM-1 appliance supports Proxy ARP (Address Resolution Protocol). When
an external source attempts to communicate with such a computer, the UTM-1
appliance automatically replies to ARP queries with its own MAC address, thereby
enabling communication. As a result, the Static NAT Internet IP addresses appear to
external sources to be real computers connected to the WAN interface.

Assign the network object's IP address to a MAC address
Normally, the UTM-1 DHCP server consistently assigns the same IP address to a
specific computer. However, if the UTM-1 DHCP server runs out of IP addresses and
the computer is down, then the DHCP server may reassign the IP address to a different
computer.
210
Check Point UTM-1 Embedded NGX User Guide
Using Network Objects
If you want to guarantee that a particular computer's IP address remains constant, you
can reserve the IP address for use by the computer's MAC address only. This is called
DHCP reservation, and it is useful if you are hosting a public Internet server on your
network.

Web Filtering enforcement
You can specify whether or not to enforce the Web Filtering service and Web rules for
the network object. Network objects that are excluded from such enforcement will be
able to access the Internet without restriction. For information on Web Filtering, see
Web Filtering on page 539. For information on Web rules, see Using Web Rules on
page 532.

Secure HotSpot enforcement
You can specify whether or not to exclude the network object from HotSpot
enforcement. Excluded network objects will be able to access the network without
viewing the My HotSpot page. Furthermore, users on HotSpot networks will be able to
access the excluded network object without viewing the My HotSpot page. For further
information on Secure HotSpot, see Configuring Secure HotSpot on page 391.

802.1x port-based security enforcement
When DHCP reservation is used, you can specify whether or not to exclude a computer
from 802.1x port-based security enforcement. Excluded computers will be able to
connect to the UTM-1 appliance's ports and access the network without authenticating.
For information on 802.1x port-based security, see Using Port-Based Security on page
386.
Adding and Editing Network Objects
You can add or edit network objects via:

The Network Objects page
This page enables you to add both individual computers and networks.

The My Computers page
This page enables you to add only individual computers as network objects. The
computer's details are filled in automatically in the wizard.
Chapter 6: Managing Your Network
211
Using Network Objects
To add or edit a network object via the Network Objects page
1.
Click Network in the main menu, and click the Network Objects tab.
The Network Objects page appears with a list of network objects.
2.
Do one of the following:


212
To add a network object, click New.
To edit an existing network object, click the Edit icon next to the desired
computer in the list.
Check Point UTM-1 Embedded NGX User Guide
Using Network Objects
The UTM-1 Network Object Wizard opens, with the Step 1: Network Object Type dialog
box displayed.
3.
Do one of the following:

4.
To specify that the network object should represent a single computer or
device, click Single Computer.
 To specify that the network object should represent a network, click Network.
Click Next.
Chapter 6: Managing Your Network
213
Using Network Objects
The Step 2: Computer Details dialog box appears. If you chose Single Computer, the
dialog box includes the Reserve a fixed IP address for this computer option.
If you chose Network, the dialog box does not include this option.
5.
Complete the fields using the information in the tables below.
6.
Click Next.
214
Check Point UTM-1 Embedded NGX User Guide
Using Network Objects
The Step 3: Save dialog box appears.
7.
Type a name for the network object in the field.
8.
Click Finish.
To add or edit a network object via the My Computers page
1.
Click Reports in the main menu, and click the My Computers tab.
Chapter 6: Managing Your Network
215
Using Network Objects
The My Computers page appears.
If a computer has not yet been added as a network object, the Add button appears next to
it. If a computer has already been added as a network object, the Edit button appears
next to it.
2.
Do one of the following:
 To add a network object, click Add next to the desired computer.
 To edit a network object, click Edit next to the desired computer.
The UTM-1 Network Object Wizard opens, with the Step 1: Network Object Type dialog
box displayed.
3.
Do one of the following:

4.
To specify that the network object should represent a single computer or
device, click Single Computer.
 To specify that the network object should represent a network, click Network.
Click Next.
The Step 2: Computer Details dialog box appears.
The computer's IP address and MAC address are automatically filled in.
5.
216
Complete the fields using the information in the tables below.
Check Point UTM-1 Embedded NGX User Guide
Using Network Objects
6.
Click Next.
The Step 3: Save dialog box appears with the network object's name. If you are adding a
new network object, this name is the computer's name.
7.
To change the network object name, type the desired name in the field.
8.
Click Finish.
The new object appears in the Network Objects page.
Table 40: Network Object Fields for a Single Computer
In this field…
Do this…
IP Address
Type the IP address of the local computer, or click This Computer to
specify your computer.
Reserve a fixed IP
Select this option to assign the network object's IP address to a MAC
address for this computer
address, and to allow the network object to connect to the WLAN
and Allow this computer to
when MAC Filtering is used.
connect when MAC
filtering is enabled
For information about MAC Filtering, see Configuring a Wireless
Network on page 285.
The MAC Address and Exclude this computer from 802.1x Port Security
fields are enabled.
MAC Address
Type the MAC address you want to assign to the network object's IP
address, or click This Computer to specify your computer's MAC
address.
Exclude this computer
Select this option to exclude this computer from 802.1x port-based
from 802.1x Port Security
security enforcement.
The computer will be able to connect to a UTM-1 appliance port and
access the network without authenticating.
Perform Static NAT
Select this option to map the local computer's IP address to an
(Network Address
Chapter 6: Managing Your Network
217
Using Network Objects
In this field…
Do this…
Translation)
Internet IP address.
You must then fill in the External IP field.
External IP
Type the Internet IP address to which you want to map the local
computer's IP address.
Exclude this computer
Select this option to exclude this computer from Secure HotSpot
from HotSpot
enforcement.
enforcement
This computer will be able to access the network without viewing the
My HotSpot page. Furthermore, users on HotSpot networks will be
able to access this computer without viewing the My HotSpot page.
Exclude this computer
Select this option to exclude this computer from the Web Filtering
from Web Filtering
service and Web rule enforcement.
Table 41: Network Object Fields for a Network
In this field…
Do this…
IP Range
Type the range of local computer IP addresses in the network.
Perform Static NAT
Select this option to map the network's IP address range to a range of
(Network Address
Internet IP addresses of the same size.
Translation)
You must then fill in the External IP Range field.
External IP Range
Type the Internet IP address range to which you want to map the
network's IP address range.
218
Check Point UTM-1 Embedded NGX User Guide
Using Network Objects
In this field…
Do this…
Exclude this network
Select this option to exclude this network from Secure HotSpot
from HotSpot
enforcement.
enforcement
Computers on the excluded network will be able to access your network
without viewing the My HotSpot page. Furthermore, users on HotSpot
networks will be able to access computers on the excluded network
without viewing the My HotSpot page.
Exclude this network
Select this option to exclude this network from the Web Filtering service
from Web Filtering
and Web rules.
Viewing and Deleting Network Objects
To view or delete a network object
1.
Click Network in the main menu, and click the Network Objects tab.
The Network Objects page appears with a list of network objects.
2.
To delete a network object, do the following:
a.
b.
In the desired network object's row, click Erase.
A confirmation message appears.
Click OK.
The network object is deleted.
Chapter 6: Managing Your Network
219
Configuring Network Service Objects
Configuring Network Service Objects
You can add custom services as network service objects. This enables you to configure
firewall rules, VStream Antivirus rules, custom NAT rules, and static routes for the services
represented by the network service objects.
Defining network service objects can make your policies easier to understand and maintain.
When a network service object is modified, the change automatically takes effect in all rules
and settings that reference the network service object.
Adding and Editing Network Service Objects
To add or edit a network service object
1.
Click Network in the main menu, and click the Network Services tab.
The Network Services page appears with a list of network service objects.
2.
Do one of the following:

220
To add a network service object, click New.
Check Point UTM-1 Embedded NGX User Guide
Configuring Network Service Objects

To edit an existing network service object, click Edit next to the desired object
in the list.
The UTM-1 Network Service Wizard opens, with the Step 1: Network Service Details
dialog box displayed.
3.
Complete the fields using the information in the table below.
4.
Click Next.
Chapter 6: Managing Your Network
221
Configuring Network Service Objects
The Step 2: Network Service Name dialog box appears.
5.
Type a name for the network service object in the field.
6.
Click Finish.
Table 42: Network Service Fields
In this field…
Do this…
Protocol
Select the network service's IP protocol.
If you select Other, the Protocol Number field appears. If you select TCP or
UDP, the Port Ranges field appears.
Protocol Number
Type the number of the network service's IP protocol.
Port Ranges
Type the network service's port or port ranges.
Multiple ports or port ranges must be separated by commas. For
example: "1000-1003,2000-2001,2005".
222
Check Point UTM-1 Embedded NGX User Guide
Using Static Routes
Viewing and Deleting Network Service Objects
To view or delete a network service object
1.
Click Network in the main menu, and click the Network Services tab.
The Network Services page appears with a list of network service objects.
2.
To delete a network service object, do the following:
a.
b.
In the desired network service object's row, click Erase.
A confirmation message appears.
Click OK.
The network service object is deleted.
Using Static Routes
A static route is a setting that explicitly specifies the route to use for packets, according to
one of the following criteria:

The packet's source IP address and/or destination IP address

The network service used to send the packet
Packets that match the criteria for a specific static route are sent to the route's defined
destination, or next hop, which can be a specific gateway's IP address or an Internet
connection. Specifying an Internet connection as the static route's next hop is useful in cases
where the ISP's default gateway IP address is dynamically assigned to the gateway, as this
approach allows you to route traffic to the Internet connection by specifying its name,
instead of a static IP address.
Note: If the static route's next hop is an Internet connection that is currently unavailable,
the UTM-1 appliance sends matching traffic through the static route with the
next-lowest metric.
Chapter 6: Managing Your Network
223
Using Static Routes
Packets with a source, destination, or network service that do not match any defined static
route are routed to the default gateway. To modify the default gateway, see Using a LAN
Connection on page 143.
When a static route is based on the packet's source, it is called a source route. Source routing
can be used, for example, for load balancing between two Internet connections. For instance,
if you have an Accounting department and a Marketing department, and you want each to
use a different Internet connection for outgoing traffic, you can add a static route specifying
that traffic originating from the Accounting department should be sent via WAN1, and
another static route specifying that traffic originating from the Marketing department should
be sent via WAN2.
A static route that is based on the network service used to send the packet is called a service
route. Service routing is useful for directing all traffic of a particular type to a specific
Internet connection. For example, you can choose to route all HTTP traffic to the secondary
Internet connection, while routing all other traffic to the primary Internet connection.
Service routes can be defined for network service objects, enabling you to create routes for
custom protocols and port ranges.
The Static Routes page lists all existing routes, including the default, and indicates whether
each route is currently "Up" (reachable) or not.
Adding and Editing Static Routes
To add a static route
1.
224
Click Network in the main menu, and click the Routes tab.
Check Point UTM-1 Embedded NGX User Guide
Using Static Routes
The Static Routes page appears, with a list of existing static routes.
2.
Do one of the following:
 To add a static route, click New Route.
 To edit an existing static route, click Edit next to the desired route in the list.
The Static Route Wizard opens displaying the Step 1: Source and Destination dialog box.
3.
Complete the fields using the relevant information in the following table.
4.
Click Next.
Chapter 6: Managing Your Network
225
Using Static Routes
The Step 2: Next Hop and Metric dialog box appears.
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The new static route is saved.
Table 43: Static Route Fields
In this field…
Do this…
Source
Specify the source network (source routing). This can be either of the
following:
Source - Network
226

ANY. This route applies to packets originating in any network.

Specified Network. This route applies to packet originating in a
specific network. The Network and Netmask fields appear.
Type the source network's IP address.
Check Point UTM-1 Embedded NGX User Guide
Using Static Routes
In this field…
Do this…
Source -
Select the source network's subnet mask.
Netmask
Destination
Destination -
Specify the destination network. This can be either of the following:

ANY. This route applies to packets sent to any network.

Specified Network. This route applies to packets sent to a specific
network. The Network and Netmask fields appear.
Type the destination network's IP address.
Network
Destination -
Select the destination network's subnet mask.
Netmask
Service
Specify the service used to send packets (service routing). This can be either
of the following:

ANY. This route applies to packets sent using any service.

A specific service or network service object.
Note: When defining a static route for a specific service, the Source and
Destination fields must be set to ANY.
Next Hop IP
Specify the next hop to which packets should be sent. This can be any of the
following:

Specified IP. Traffic matching this static route's criteria will be routed
to a specific gateway. Type the IP address of the desired gateway
(next hop router) in the field provided.

WAN (Internet). Traffic matching this static route's criteria will be
routed to the Internet connection on the WAN1 interface.

WAN2 (Internet). Traffic matching this static route's criteria will be
routed to the Internet connection on the WAN2 interface.
Chapter 6: Managing Your Network
227
Managing Ports
In this field…
Do this…
Metric
Type the static route's metric.
When a packet matches multiple static routes' criteria, the gateway sends the
packet to the matching route with the lowest metric.
The default value is 10.
Viewing and Deleting Static Routes
To view or delete a static route
1.
Click Network in the main menu, and click the Routes tab.
The Static Routes page appears, with a list of existing static routes.
2.
To refresh the view, click Refresh.
3.
To delete a route, do the following:
a.
b.
In the desired route's row, click Erase.
A confirmation message appears.
Click OK.
The route is deleted.
Managing Ports
The UTM-1 appliance enables you to quickly and easily assign its ports to different uses, as
shown in the following table. If desired, you can also disable ports.
228
Check Point UTM-1 Embedded NGX User Guide
Managing Ports
Table 44: Ports and Assignments
You can assign this port...
To these uses...
LAN 1-4
LAN network
A WAN Internet connection
A port-based VLAN
A VLAN that is dynamically assigned by a RADIUS server,
as part of an 802.1x port-based security scheme
DMZ/WAN2
DMZ network
A WAN Internet connection
VLAN trunk
A port-based VLAN
A VLAN that is dynamically assigned by a RADIUS server,
as part of an 802.1x port-based security scheme
DSL
An ADSL Internet connection
WAN
A WAN Internet connection
Serial
RS232 modem
Serial console
Terminal server
ExC
An ExpressCard cellular modem
USB
Printers
USB-based modems
The UTM-1 appliance also allows you to restrict each port to a specific link speed and
duplex setting and to configure its security scheme. For information on port-based security,
see Using Port-Based Security on page 386.
Chapter 6: Managing Your Network
229
Managing Ports
Viewing Port Statuses
You can view the status of the UTM-1 appliance's ports on the Ports page, including each
Ethernet connection's duplex state. This is useful if you need to check whether the
appliance's physical connections are working, and you can’t see the LEDs on front of the
appliance.
To view port statuses
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears. In non-ADSL models, this page appears as follows:
230
Check Point UTM-1 Embedded NGX User Guide
Managing Ports
In ADSL models, this page appears as follows:
The page displays the information for each port, as described in the following table.
2.
To refresh the display, click Refresh.
Table 45: Ports Fields

Assign To: The port's current assignment.
For example, if the DMZ/WAN2 port is currently used for the DMZ, the field displays
"DMZ".

Status: The port's current status.
Ethernet ports can have the following statuses:
Status
Description
The detected link speed
The port is in use.
and duplex (Full Duplex
or Half Duplex)
Chapter 6: Managing Your Network
231
Managing Ports
No Link
The appliance does not detect anything
connected to the port.
Disabled
The port is disabled.
For example, the DMZ/WAN2 port's status
will be "Disabled" if the port is assigned to
"None", or if it assigned to "DMZ" and the
DMZ is disabled.
The ADSL port can have the following statuses:
Status
Description
Sync OK
The ADSL modem is successfully
synchronized with the ADSL service
provider.
No Sync
The ADSL modem failed to synchronize with
the ADSL service provider.
Check that a micro-filter is properly
connected, and check that your DSL Standard
setting is compatible with your service
provider. You can view this setting in the
Network > Internet Setup page.
Disabled
The port is disabled.
The port's status will be disabled, if it is
assigned to "None".
The USB port can have the following statuses:
232
Check Point UTM-1 Embedded NGX User Guide
Managing Ports
Status
Description
Connected (number)
USB devices (printers or modem) are
connected to the USB ports. The number of
connected devices appears in parentheses.
Not Connected
No USB devices are connected to the USB
ports.
The Serial port can have the following statuses, when it is assigned to terminal server
use:
Status
Description
Initializing
The terminal server is initializing.
Waiting
No serial device is connected to the terminal
server.
Terminating
The terminal server is being restarted, and all
connections on the Serial port are being
terminated.
Off
The terminal server is currently not in use.
The ExC port can have the following statuses:
Status
Description
Connected (number)
A ExpressCard modems is inserted in the
ExpressCard slot.
Not Connected
No ExpressCard modem is inserted in the
ExpressCard slot.

802.1x: The port's security scheme. This can be any of the following:
Chapter 6: Managing Your Network
233
Managing Ports
Scheme
Description
N/A
No security scheme is defined for the port.
Unauthorized
An 802.1x security scheme is defined for the
port. Users have not yet connected to the
port and attempted to authenticate, or a user
failed to authenticate and no Quarantine
network is configured.
Authorized (network)
An 802.1x security scheme is defined for the
port. A user connected to the port,
authenticated successfully, and was
assigned to a network. The name of the
assigned network appears in parentheses.
Quarantine (network)
An 802.1x security scheme is defined for the
port. A user connected to the port, failed to
authenticate, and was assigned to the
Quarantine network. The name of the
Quarantine network appears in parentheses.
For information on configuring 802.1x port-based security, see Using Port-Based
Security on page 386.
Modifying Port Assignments
You can assign ports to different networks or purposes. Since modifying port assignments
often requires additional configurations, use the following table to determine which
procedure you should use.
234
Check Point UTM-1 Embedded NGX User Guide
Managing Ports
Table 46: Modifying Port Assignments
To assign a port to...
See...
No network
The procedure below. This disables the port.
LAN
The procedure below
VLAN or
Configuring VLANs on page 200
VLAN Trunk
A WAN Internet connection
The procedure below.
Note: When you configure an Ethernet-based Internet
connection on a port, the port is automatically assigned to
Internet use. For information on configuring an Internet
connection, see Using Internet Setup on page 131.
DMZ
Configuring a DMZ Network
Console
Using a Console on page 668
A VLAN network, dynamically
Configuring Port-Based Security on page 387
assigned by a RADIUS server
A printer
Setting Up Network Printers on page 722
An RS232 Modem
Setting Up an RS232 Modem on page 165
A USB-based modem
Setting Up a USB Modem on page 168
An ExpressCard modem
Setting Up an ExpressCard Cellular Modem on page 172
A terminal server
Using the Terminal Server on page 239
To modify a port assignment
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
Chapter 6: Managing Your Network
235
Managing Ports
2.
Next to the desired port, click Edit.
The Port Setup page appears.
3.
In the Assign to Network drop-down list, do one of the following:


4.
To assign a network port to the LAN, select LAN.
To configure a network port for use with a WAN Internet connection, select
Internet.
 To disable a network port, select None.
 To disable the Serial port, select Disabled.
Click Apply.
A warning message appears.
5.
Click OK.
The port is reassigned to the specified network or purpose.
Modifying Link Configurations
By default, the UTM-1 appliance automatically detects the link speed and duplex. If desired,
you can manually restrict the appliance's ports to a specific link speed and duplex setting.
236
Check Point UTM-1 Embedded NGX User Guide
Managing Ports
To modify a port's link configuration
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to the desired port, click Edit.
The Port Setup page appears.
3.
In the Link Configuration drop-down list, do one of the following:


4.
Select the desired link speed and duplex.
Select Automatic Detection to configure the port to automatically detect the link
speed and duplex.
This is the default.
Click Apply.
A warning message appears.
5.
Click OK.
The port uses the specified link speed and duplex.
Resetting Ports to Defaults
You can reset the UTM-1 appliance's ports to their default link configurations ("Automatic
Detection") and default assignments (shown in the following table).
Table 47: Default Port Assignments
Port
Default Assignment
LAN 1-4
LAN
DMZ / WAN2
DMZ
WAN
This port is always assigned to the WAN.
ADSL
This port is always assigned to the WAN.
Chapter 6: Managing Your Network
237
Managing Ports
Port
Default Assignment
Serial
Console
Note: Resetting ports to their defaults may result in the loss of your Internet connection.
Therefore, it is recommended to be particularly careful when performing this
procedure remotely.
Resetting All Ports to Defaults
To reset all ports to defaults
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Click Default.
A confirmation message appears.
3.
Click OK.
All ports are reset to their default assignments and to "Automatic Detection" link
configuration.
Resetting Individual Ports to Defaults
To reset a port to defaults
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to the desired port, click Edit.
The Port Setup page appears.
3.
238
Click Default.
Check Point UTM-1 Embedded NGX User Guide
Using the Terminal Server
A confirmation message appears.
4.
Click OK.
The port is reset to its default assignment and to "Automatic Detection" link
configuration.
Using the Terminal Server
The UTM-1 appliance includes a built-in terminal server (also called a device server), which
allows you to Internet-enable legacy RS-232 serial devices by simply connecting them to the
appliance's Serial port; there is no need for hardware modification or additional equipment.
By adding IP connectivity to your serial devices, the terminal server enables remote
monitoring, diagnostics, and management of the devices.
The terminal server can be used in the following modes:

Passive Mode. The terminal server accepts connections from an external Telnet
client, and relays traffic to and from the appliance’s Serial port. This mode allows
Telnet clients to remotely access devices attached to the appliance's Serial port.

Active Mode. The terminal server connects to an external Telnet server, and relays
traffic to and from the appliance’s Serial port. This mode affords devices attached
to the appliance's Serial port permanent access an external Telnet server.
Note: You can enable tunneling of serial RS-232 data over the Internet or VPN, by
configuring one UTM-1 appliance in passive mode and another in active mode.
The terminal server can be used in conjunction with VPN connectivity, to enable secure
transmission of RS-232 data between the serial devices and the Telnet client or server.
Configuring the Terminal Server
To configure the terminal server
1.
Click Network in the main menu, and click the Ports tab.
Chapter 6: Managing Your Network
239
Using the Terminal Server
The Ports page appears.
2.
Next to the Serial port, click Edit.
The Port Setup page appears.
3.
In the Assign to drop-down list, select Terminal Server.
Additional fields appear.
4.
Complete the fields using the information in the following table.
5.
Click Apply.
240
Check Point UTM-1 Embedded NGX User Guide
Using the Terminal Server
For information on locating the appliance's Serial port, see The UTM-1 Edge N Series
and UTM-1 Edge NW Series.
Table 48: Terminal Server Fields
In this field…
Do this…
Port Speed
Select the Serial port's speed (in bits per second).
The Serial port's speed must match that of the attached dialup modem.
The default value is 57600.
Flow Control
TCP Port
Select the method of flow control supported by the attached device:

RTS/CTS. Hardware-based flow control, using the Serial port's
RTS/CTS signal lines.

XON/XOFF. Software-based flow control, using XON/XOFF
characters.
Type the TCP port that the terminal server should use for incoming and
outgoing connections between the Serial port and the Internet.
Operation Mode
Select the terminal server's operation mode.
If Active is selected, the Primary Server and Secondary Server fields appear.
Primary Server
Type the IP address or DNS name of the primary Telnet server to which
the terminal server should connect, or click This Computer to specify your
computer.
Secondary Server
Type the IP address or DNS name of the secondary Telnet server to which
the terminal server should connect when the primary server is not
available, or click This Computer to specify your computer.
Chapter 6: Managing Your Network
241
Using the Terminal Server
Restarting the Terminal Server
If you are experiencing problems with the connection between the attached serial device and
the Telnet client or server, restarting the terminal server may solve the problem.
To restart the terminal server
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to the Serial port, click Reset.
A confirmation message appears.
3.
Click OK.
The terminal server is restarted, and any existing Telnet connection is terminated.
242
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 7
Using Bridges
This chapter describes how to connect multiple network segments at the data-link layer,
using a bridge.
This chapter includes the following topics:
Overview ..................................................................................................243
Workflow..................................................................................................248
Adding and Editing Bridges .....................................................................249
Adding Internal Networks to Bridges ....................................................... 253
Adding Internet Connections to Bridges .................................................. 256
Deleting Bridges ....................................................................................... 260
Overview
The UTM-1 appliance enables you to connect multiple network segments at the data-link
layer, by configuring a bridge. Bridges offer the following advantages:

Easy network segmentation
Bridges can be used to compartmentalize an existing network into several security
zones, without changing the IP addressing scheme or the routers' configuration.
Ordinarily, if you need to deploy a firewall within an internal network, you can divide
the existing subnet into two networks and configure a new routing scheme. However, in
some deployments, the amount of network reconfiguration required prohibits such a
solution. Adding a bridge not only allows you to segment your network quickly and
easily, but it allows you to choose whether to enable the firewall between network
segments.
Chapter 7: Using Bridges
243
Overview
If you enable the firewall between bridged network segments, the gateway operates as a
regular firewall between network segments, inspecting traffic and dropping or blocking
unauthorized or unsafe traffic. In contrast, if you disable the firewall between bridged
network segments, all network interfaces assigned to the bridge are connected directly,
with no firewall filtering the traffic between them. The network interfaces operate as if
they were connected by a hub or switch.
Figure 31: Bridge with Four VLANs
244
Check Point UTM-1 Embedded NGX User Guide
Overview
For example, if you assign the LAN and primary WLAN networks to a bridge and
disable the bridge's internal firewall, the two networks will act as a single, seamless
network, and only traffic from the LAN and primary WLAN networks to other
networks (for example, the Internet) will be inspected by the firewall. If you enable the
internal firewall, it will enforce security rules and inspect traffic between the LAN and
primary WLAN networks.
Figure 32: Bridge Firewalling

Transparent roaming
In a routed network, if a host is physically moved from one network area to another,
then the host must be configured with a new IP address. However, in a bridged network,
there is no need to reconfigure the host, and work can continue with minimal
interruption.
The UTM-1 appliance allows you to configure anti-spoofing for bridged network segments.
When anti-spoofing is configured for a segment, only IP addresses within a specific IP
address range can be sent from that network segment. For example, if you configure
anti-spoofing for the ―Marketing‖ network segment, the following things happens:
Chapter 7: Using Bridges
245
Overview

If a host with an IP address outside of the allowed IP address range tries to
connect from a port or VLAN that belongs to the ―Marketing‖ network segment,
the connection will be blocked and logged as ―Spoofed IP‖.

If a host with an IP address within the bridge IP address range tries to connect
from a port or VLAN that belongs to a network segment other than the
“Marketing” segment, the connection will be blocked and logged as ―Spoofed
IP‖.
Note: The following UTM-1 models do not support using bridge mode with port-based
VLAN:

SBX166-LHGE-2

SBX166-LHGE-3
How Does Bridge Mode Work?
Bridges operate at layer 2 of the OSI model, therefore adding a bridge to an existing network
is completely transparent and does not require any changes to the network's structure.
Each bridge maintains a forwarding table, which consists of <MAC Address, Port>
associations. When a packet is received on one of the bridge ports, the forwarding table is
automatically updated to map the source MAC address to the network port from which the
packet originated, and the gateway processes the received packet according to the packet's
type.
When a bridge receives an IP packet, the gateway processes the packet as follows:
1.
The destination MAC address is looked up in the bridge's forwarding table.
2.
If the destination MAC address is found in the forwarding table, the packet is
forwarded to the corresponding port.
3.
If the destination MAC address is not found in the forwarding table, the
destination IP address is searched for in all the defined bridge IP address ranges.
4.
If the destination IP address is found in the bridge IP address range of exactly
one port, the IP address is transmitted to that port.
5.
If the IP address is found in the bridge IP address range of more than one port,
the packet is dropped. The gateway then sends an ARP query to each of the
relevant ports.
246
Check Point UTM-1 Embedded NGX User Guide
Overview
6.
If a host responds to the ARP request packet with an ARP reply, the forwarding
table is updated with the correct <MAC Address, Port> association.
Subsequent packets will be forwarded using the forwarding table.
If a bridge receives a non-IP packet, and the bridge is configured to forward non-IP protocol
Layer-2 traffic, the gateway processes the packet as follows:
1.
The destination MAC address is looked up in the bridge's forwarding table.
2.
If the destination MAC address is found in the forwarding table, the packet is
forwarded to the corresponding port.
3.
If the destination MAC address is not found in the forwarding table, the packet
is flooded to all the ports on the bridge.
Multiple Bridges and Spanning Tree Protocol
When using multiple bridges, you can enable fault tolerance and optimal packet routing, by
configuring Spanning Tree Protocol (STP - IEEE 802.1d). When STP is enabled, each
bridge communicates with its neighboring bridges or switches to discover how they are
interconnected. This information is then used to eliminate loops, while providing optimal
routing of packets. STP also uses this information to provide fault tolerance, by
re-computing the topology in the event that a bridge or a network link fails.
Figure 33: Dual Redundant Bridges with STP
Chapter 7: Using Bridges
247
Workflow
Figure 34: Link Redundancy with STP
Workflow
To use a bridge
1.
Add a bridge.
See Adding and Editing Bridges on page 249.
2.
Add the desired internal networks to the bridge.
See Adding Internal Networks to Bridges on page 253.
3.
Add the desired Internet connections to the bridge.
See Adding Internet Connections to Bridges on page 256.
4.
248
If you enabled the firewall between networks on this bridge, add security rules
and VStream Antivirus rules as needed.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Bridges
For information on adding security rules, see Adding and Editing Rules on page 377.
For information on adding VStream Antivirus rules, see Adding and Editing Vstream
Antivirus Rules on page 484.
Adding and Editing Bridges
To add or edit a bridge
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
Do one of the following:


To add a bridge, click Add Bridge.
To edit a bridge, click Edit in the desired bridge's row.
Chapter 7: Using Bridges
249
Adding and Editing Bridges
The Bridge Configuration page appears.
3.
Complete the fields using the following table.
4.
Click Apply.
A success message appears.
250
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Bridges
Table 49: Bridge Configuration Fields
In this field…
Do this…
Network Name
Type a name for the bridge.
Firewall Between Members
Specify whether the firewall should be enabled between
networks on this bridge, by selecting one of the following:
Non IP Traffic

Enabled. The firewall is enabled, and it will inspect
traffic between networks on the bridge, enforcing
firewall rules and SmartDefense protections. This is
the default value.

Disabled. The firewall is disabled between networks
on the bridge.
Specify how the firewall should handle non-IP protocol traffic
between networks on this bridge, by selecting one of the
following:
Spanning Tree Protocol

Block. The firewall will block all non-IP protocol traffic
on the bridge. This is the default value.

Pass. The firewall will allow all non-IP protocol traffic
on the bridge and process it as described in Using
Bridges on page 243.
Specify whether to enable STP for this bridge, by selecting one
of the following:

Enabled. STP is enabled.

Disabled. STP is disabled. This is the default value.
If you selected Enabled, the Bridge Priority field appears.
Chapter 7: Using Bridges
251
Adding and Editing Bridges
In this field…
Do this…
Bridge Priority
Select this bridge's priority.
The bridge's priority is combined with a bridged network's MAC
address to create the bridge's ID. The bridge with the lowest ID
is elected as the root bridge. The other bridges in the tree
calculate the shortest distance to the root bridge, in order to
eliminate loops in the topology and provide fault tolerance.
To increase the chance of this bridge being elected as the root
bridge, select a lower priority.
Note: If you select the same priority for all bridges, the root bridge
will be elected based on MAC address.
The default value is 32768.
This field only appears if STP is enabled.
IP Address
Type the IP address to use for this gateway on this bridge.
Note: The bridge must not overlap other networks.
Subnet Mask
252
Select this bridge's subnet mask.
Check Point UTM-1 Embedded NGX User Guide
Adding Internal Networks to Bridges
Adding Internal Networks to Bridges
Note: In order to add a VLAN of any type (port-based, tag-based, VAP, or WDS link) to
the bridge, you must first create the desired VLAN.
For information on adding port-based VLANs, see Adding and Editing Port-Based
VLANs on page 204. For information on adding tag-based VLANs, see Adding and
Editing Tag-Based VLANs on page 206.For information on adding VAPs, see
Configuring Virtual Access Points on page 313. For information on adding WDS
links, see Configuring WDS Links on page 317.
To add an internal network to a bridge
1.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
2.
Click Edit in the desired network's row.
3.
In the Mode drop-down list, select Bridged.
New fields appear.
4.
Complete these fields as described below.
Chapter 7: Using Bridges
253
Adding Internal Networks to Bridges
If the assigned bridge uses STP, additional fields appear.
5.
Click Apply.
A warning message appears.
6.
Click OK.
A success message appears.
In the My Network page, the internal network appears indented under the bridge.
Table 50: Bridged Network Fields
In this field…
Do this…
Assign to Bridge
Select the bridge to which the network should be assigned.
Bridge Anti-Spoofing
Select this option to enable anti-spoofing.
If anti-spoofing is enabled, only IP addresses within the Allowed
IP Range can be source IP addresses for packets on this
network.
254
Check Point UTM-1 Embedded NGX User Guide
Adding Internal Networks to Bridges
In this field…
Do this…
Allowed IP Range
Type the range of IP addresses that should be allowed on this
network.
Note: When assigning IP addresses to machines in a bridged
network segment, the UTM-1 DHCP server allocates only
addresses within the allowed IP address range.
To enable clients to move between bridged networks without
changing IP addresses, configure identical IP address ranges
for the desired networks, thus allowing the IP addresses to be
used on either of the bridged networks.
Note: Configuring overlapping or identical allowed IP address
ranges will decrease the effectiveness of anti-spoofing between
the bridged networks.
Spanning Tree Protocol - Port
Cost
Type the port's cost.
STP uses the available port with the lowest cost to forward
frames to the root port. All other ports are blocked.
It is recommended to set a lower value for faster links.
This field only appears if the bridge uses STP.
Chapter 7: Using Bridges
255
Adding Internet Connections to Bridges
In this field…
Do this…
Spanning Tree Protocol - Port
Select the port's priority.
Priority
The port's priority is combined with the port's logical number to
create the port's ID. The port with the lowest ID is elected as the
root port, which forwards frames out of the bridge. The other
ports in the bridge calculate the least-cost path to the root port,
in order to eliminate loops in the topology and provide fault
tolerance.
To increase the chance of this port being elected as the root
port, select a lower priority.
Note: If you select the same priority for all ports, the root port will
be elected based on the port's logical number.
The default value is 128.
This field only appears if the bridge uses STP.
Adding Internet Connections to Bridges
To add an Internet connection to a bridge
1.
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
2.
Next to the desired Internet connection, click Edit.
The Internet Setup page appears.
3.
In the Port drop-down list, specify the port that the Internet connection should
use, by doing one of the following:

256
To use the ADSL port, select ADSL.
Check Point UTM-1 Embedded NGX User Guide
Adding Internet Connections to Bridges
4.
This option is available in ADSL models only.
 To use the WAN port, select WAN.
This option is available in non-ADSL models only.
 To use the DMZ/WAN2 port, select WAN2.
Do one of the following:

To configure a Bridged PPPoA connection, in the Connection Type field, select
PPPoA.
This option is available in ADSL models only.
 Otherwise, in the Connection Type field, select Bridged.
New fields appear.
5.
Complete the fields specified in the table below.
6.
Complete the rest of the fields using the relevant information in Internet Setup
Fields on page 157.
Chapter 7: Using Bridges
257
Adding Internet Connections to Bridges
New fields appear, depending on the selected options, and whether the selected bridge
uses STP.
7.
Click Apply.
The UTM-1 appliance attempts to connect to the Internet, and the Status Bar displays
the Internet status ―Connecting‖. This may take several seconds.
Once the connection is made, the Status Bar displays the Internet status ―Connected‖.
258
Check Point UTM-1 Embedded NGX User Guide
Adding Internet Connections to Bridges
Table 51: Bridged Connection Fields
In this field…
Do this…
Bridge Mode
Select this option to configure a Bridged PPPoA connection.
The Bridge To field appears.
This field is relevant for Bridged PPPoA connections only.
Bridge To
Select the bridge to which you want to add the PPPoA
connection.
This field is relevant for Bridged PPPoA connections only.
Assign to Bridge
Select the bridge to which the connection should be assigned.
This field is relevant for regular bridged connections only.
Spanning Tree Protocol - Port
Cost
Type the port's cost.
STP uses the available port with the lowest cost to forward
frames to the root port. All other ports are blocked.
It is recommended to set a lower value for faster links.
This field only appears if the selected bridge uses STP. It is
relevant for regular bridged connections only.
Chapter 7: Using Bridges
259
Deleting Bridges
In this field…
Do this…
Spanning Tree Protocol - Port
Select the port's priority.
Priority
The port's priority is combined with the port's logical number to
create the port's ID. The port with the lowest ID is elected as the
root port, which forwards frames out of the bridge. The other
ports in the bridge calculate the least-cost path to the root port,
in order to eliminate loops in the topology and provide fault
tolerance.
To increase the chance of this port being elected as the root
port, select a lower priority.
Note: If you select the same priority for all ports, the root port will
be elected based on the port's logical number.
The default value is 128.
This field only appears if the selected bridge uses STP. It is
relevant for regular bridged connections only.
Deleting Bridges
To delete a bridge
1.
Remove all internal networks from the bridge, by doing the following for each
network:
a.
b.
c.
d.
260
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
Click Edit in the desired network's row.
In the Mode drop-down list, select Enabled.
Click Apply.
Check Point UTM-1 Embedded NGX User Guide
Deleting Bridges
2.
Remove all Internet connections from the bridge, by doing the following for
each connection:
Click Network in the main menu, and click the Internet tab.
The Internet page appears.
b. Next to the desired Internet connection, click Edit.
c. The Internet Setup page appears.
d. In the Connection Type field, select the desired connection type (not
Bridged).
e. Click Apply.
Click Network in the main menu, and click the My Network tab.
a.
3.
The My Network page appears.
4.
In the desired bridge’s row, click Erase.
A confirmation message appears.
5.
Click OK.
The bridge is deleted.
Chapter 7: Using Bridges
261
Overview
Chapter 8
Configuring High Availability
This chapter describes how to configure High Availability (HA) for two or more UTM-1
appliances.
This chapter includes the following topics:
Overview ..................................................................................................263
Configuring High Availability on a Gateway ...........................................265
Sample Implementation on Two Gateways ..............................................270
Overview
You can create a High Availability (HA) cluster consisting of two or more UTM-1
appliances. For example, you can install two UTM-1 appliances on your network, one acting
as the ―Master‖, the default gateway through which all network traffic is routed, and one
acting as the ―Backup‖. If the Master fails, the Backup automatically and transparently takes
over all the roles of the Master. This ensures that your network is consistently protected by a
UTM-1 appliance and connected to the Internet.
The gateways in a HA cluster each have a separate IP address within the local network. In
addition, the gateways share a single virtual IP address, which is the default gateway address
for the local network. Control of the virtual IP address is passed as follows:
1.
Each gateway is assigned a priority, which determines the gateway's role: the
gateway with the highest priority is the "Active Gateway" and uses the virtual IP
address, and the rest of the gateways are "Passive Gateways".
2.
The Active Gateway sends periodic signals, or ―heartbeats‖, to the network via a
synchronization interface.
The synchronization interface can be any internal network or bridge existing on both
gateways, except the WAN interface.
3.
If the heartbeat from the Active Gateway stops (indicating that the Active
Gateway has failed), the gateway with the highest priority becomes the new
Active Gateway and takes over the virtual IP address.
Chapter 8: Configuring High Availability
263
Overview
4.
When a gateway that was offline comes back online, or a gateway's priority
changes, the gateway sends a heartbeat notifying the other gateways in the
cluster.
If the gateway's priority is now the highest, it becomes the Active Gateway.
The UTM-1 appliance supports Internet connection tracking, which means that each
appliance tracks its Internet connection's status and reduces its own priority by a
user-specified amount, if its Internet connection goes down. If the Active Gateway's priority
drops below another gateway's priority, then the other gateway becomes the Active
Gateway.
Note: You can force a fail-over to a passive UTM-1 appliance. You may want to do this
in order to verify that HA is working properly, or if the active UTM-1 appliance needs
repairs. To force a fail-over, switch off the primary box or disconnect it from the LAN
network.
The UTM-1 appliance supports configuring multiple HA clusters on the same network
segment. To this end, each cluster must be assigned a unique ID number.
When HA is configured, you can specify that only the Active Gateway in the cluster should
connect to the Internet. This is called WAN HA, and it is useful in the following situations:

Your Internet subscription cost is based is on connection time, and therefore
having the Passive appliances needlessly connected to the Internet costs you
money.

You want multiple appliances to share the same static IP address without creating
an IP address conflict.
WAN HA avoids an IP address change, and thereby ensures virtually uninterrupted access
from the Internet to internal servers at your network.
On the other hand, you might prefer to keep Passive Gateways connected to the Internet at
all times, so that they can download updates from the Service Center and be accessible for
remote management, even when not acting as the Active Gateway. In this case, you must
assign a virtual IP address to the WAN interface. Each Passive Gateway will remain
constantly connected to the Internet using its WAN interface's primary IP address, while
remaining on standby to take over the WAN virtual IP address, in the event that the Active
Gateway fails. If desired, you can configure a WAN virtual IP address for the WAN2
interface, as well.
264
Check Point UTM-1 Embedded NGX User Guide
Configuring High Availability on a Gateway
Note: To use a WAN virtual IP address, the Internet connection method must be "Static
IP". PPP-based connections and dynamic IP connections are not supported.
Before configuring HA, the following requirements must be met:

You must have at least two identical UTM-1 appliances.

The appliances must have identical firmware versions and firewall rules.

The appliances' internal networks and bridges must be the same.

The appliances must have different real internal IP addresses, but share the same
virtual IP address.

The appliances' synchronization interface ports must be connected either directly,
or via a hub or a switch. For example, if the DMZ is the synchronization interface,
then the DMZ/WAN2 ports on the appliances must be connected to each other.
The synchronization interface need not be dedicated for synchronization only. It may be
shared with an active internal network or bridge.
You can configure HA for the WAN interface, for any bridge, and for any internal network
except wireless networks and the OfficeMode network.
Note: You can enable the DHCP server in all UTM-1 appliances. A Passive Gateway’s
DHCP server will start answering DHCP requests only if the Active Gateway fails.
Note: If you configure HA for the primary WLAN network:

A passive appliance's wireless transmitter will be disabled until the
gateway becomes active.

The two primary WLAN networks can share the same SSID and wireless
frequency.

Wireless interfaces cannot serve as the synchronization interface.
Configuring High Availability on a Gateway
The following procedure explains how to configure HA on a single gateway. You must
perform this procedure on each UTM-1 appliance that you want to include in the HA cluster.
Chapter 8: Configuring High Availability
265
Configuring High Availability on a Gateway
To configure HA on a UTM-1 appliance
1.
Set the appliance’s internal IP addresses and network range.
Each appliance must have a different internal IP address.
See Changing IP Addresses on page 184.
2.
Click Setup in the main menu, and click the High Availability tab.
The High Availability page appears.
3.
Select the Gateway High Availability check box.
The fields are enabled.
266
Check Point UTM-1 Embedded NGX User Guide
Configuring High Availability on a Gateway
4.
Next to each network for which you want to enable HA, select the HA check
box.
The Internet-Primary field represents the WAN interface, and the Internet-Secondary
field represents the WAN2 interface.
5.
In the Virtual IP field, type the default gateway IP address.
This can be any unused IP address in the network, and must be the same for all
gateways.
You can assign a virtual IP address to any internal interface, as well as to "LAN Static
IP" Internet connections (that is, LAN connections for which the Obtain IP address
automatically (using DHCP) check box is cleared).
6.
Click the Synchronization radio button next to the network you want to use as
the synchronization interface.
Note: The synchronization interface must be the same for all gateways, and must
always be connected and enabled on all gateways. Otherwise, multiple appliances
may become active, causing unpredictable problems.
The synchronization interface cannot be an Internet connection or a wireless interface.
7.
Complete the fields using the information the following table.
8.
Click Apply.
A success message appears.
9.
If desired, configure WAN HA for both the primary and secondary Internet
connection.
This setting should be the same for all gateways. For further information, see the Do not
connect if this gateway is in passive state field in Using Internet Setup on page 131.
10. If you configured a virtual IP address for the WAN or WAN2 interface,
configure the Internet connection to use the "Static IP" connection method.
See Using Internet Setup on page 131.
Chapter 8: Configuring High Availability
267
Configuring High Availability on a Gateway
Table 52: High Availability Page Fields
In this field…
Do this…
Priority
My Priority
Type the gateway's priority.
This must be an integer between 1 and 255.
Internet Connection
Tracking
Internet - Primary
Type the amount to reduce the gateway's priority if the primary Internet
connection goes down.
This must be an integer between 0 and 255.
Internet - Secondary
Type the amount to reduce the gateway's priority if the secondary
Internet connection goes down.
This must be an integer between 0 and 255.
Note: This value is only relevant if you configured a backup connection.
For information on configuring a backup connection, see Configuring a
Backup Internet Connection on page 176.
Port Tracking
LAN1-4
Type the amount to reduce the gateway's priority if the LAN port's
Ethernet link is lost.
This must be an integer between 0 and 255.
DMZ
Type the amount to reduce the gateway's priority if the DMZ / WAN2
port's Ethernet link is lost.
This must be an integer between 0 and 255.
268
Check Point UTM-1 Embedded NGX User Guide
Configuring High Availability on a Gateway
In this field…
Do this…
When in passive state
Disable VPN
Select this option to specify that VPN connectivity should be disabled
when the gateway is a Passive Gateway.
Disable OSPF
Select this option to specify that Open Shortest Path First (OSPF)
dynamic routing should be disabled when the gateway is a Passive
Gateway.
Disable BGP
Select this option to specify that Border Gateway Protocol (BGP)
dynamic routing should be disabled when the gateway is a Passive
Gateway.
Disable RIP
Select this option to specify that Routing Information Protocol (RIP)
dynamic routing should be disabled when the gateway is a Passive
Gateway.
This field is only relevant for N series appliances.
Disable Multicast
Select this option to specify that Distance Vector Multicast Routing
routers
Protocol (DVMRP) and Protocol Independent Multicast - Sparse-Mode
(PIM-SM) multicast routing should be disabled when the gateway is a
Passive Gateway.
This field is only relevant for N series appliances.
Disable Wireless
Indicates that the appliance's wireless transmitter should be disabled
Transmitter
when the gateway is a Passive Gateway.
This option only appears for wireless appliances, and it cannot be
cleared.
Advanced
Chapter 8: Configuring High Availability
269
Sample Implementation on Two Gateways
In this field…
Do this…
Group ID
If multiple HA clusters exist on the same network segment, type the ID
number of the cluster to which the gateway should belong.
This must be an integer between 1 and 255.
The default value is 55. If only one HA cluster exists, there is no need to
change this value.
Sample Implementation on Two Gateways
The following procedure illustrates how to configure HA for the following two UTM-1
gateways, Gateway A and Gateway B:
Table 53: Gateway Details
Gateway A
Gateway B
Internal Networks
LAN, DMZ
LAN, DMZ
Internet Connections
Primary and secondary
Primary only
LAN Network IP Address
192.169.100.1
192.169.100.2
LAN Network
255.255.255.0
255.255.255.0
DMZ Network IP Address
192.169.101.1
192.169.101.2
DMZ Network
255.255.255.0
255.255.255.0
Subnet Mask
Subnet Mask
The gateways have two internal networks in common, LAN and DMZ. This means that you
can configure HA for the LAN network, the DMZ network, or both. You can use either of
the networks as the synchronization interface.
270
Check Point UTM-1 Embedded NGX User Guide
Sample Implementation on Two Gateways
The procedure below shows how to configure HA for both the LAN and DMZ networks.
The synchronization interface is the DMZ network, the LAN virtual IP address is
192.168.100.3, and the DMZ virtual IP address is 192.168.101.3. Gateway A is the Active
Gateway.
To configure HA for Gateway A and Gateway B
1.
Connect the LAN port of Gateways A and B to hub 1.
2.
Connect the DMZ port of Gateways A and B to hub 2.
3.
Connect the LAN network computers of Gateways A and B to hub 1.
4.
Connect the DMZ network computers of Gateways A and B to hub 2.
5.
Do the following on Gateway A:
a.
b.
c.
d.
e.
f.
g.
h.
i.
j.
k.
Set the gateway's internal IP addresses and network range to the values
specified in the table above.
See Changing IP Addresses on page 184.
Click Setup in the main menu, and click the High Availability tab.
The High Availability page appears.
Select the Gateway High Availability check box.
The Gateway High Availability area is enabled. The LAN and DMZ networks are
listed.
Next to LAN, select the HA check box.
In the LAN network's Virtual IP field, type the default gateway IP address
192.168.100.3.
Next to DMZ, select the HA check box.
In the DMZ network's Virtual IP field, type the default gateway IP address
192.168.101.3.
Click the Synchronization radio button next to DMZ.
In the My Priority field, type "100".
The high priority means that Gateway A will be the Active Gateway.
In the Internet - Primary field, type "20".
Gateway A will reduce its priority by 20, if its primary Internet connection goes
down.
In the Internet - Secondary field, type "30".
Chapter 8: Configuring High Availability
271
Sample Implementation on Two Gateways
6.
Gateway A will reduce its priority by 30, if its secondary Internet connection goes
down.
l. Click Apply.
A success message appears.
Do the following on Gateway B:
a.
Set the gateway's internal IP addresses and network range to the values
specified in the table above.
See Changing IP Addresses on page 184.
b. Click Setup in the main menu, and click the High Availability tab.
The High Availability page appears.
c. Select the Gateway High Availability check box.
The Gateway High Availability area is enabled. The LAN and DMZ networks are
listed.
d. Next to LAN, select the HA check box.
e. In the LAN network's Virtual IP field, type the default gateway IP address
192.168.100.3.
f. Next to DMZ, select the HA check box.
g. In the DMZ network's Virtual IP field, type the default gateway IP address
192.168.101.3.
h. Click the Synchronization radio button next to DMZ.
i. In the My Priority field, type "60".
The low priority means that Gateway B will be the Passive Gateway.
j. In the Internet - Primary field, type "20".
Gateway B will reduce its priority by 20, if its Internet connection goes down.
k. Click Apply.
A success message appears.
Gateway A's priority is 100, and Gateway B's priority is 60. As long as one of Gateway A's
Internet connections is up, Gateway A is the Active Gateway, because its priority is higher
than that of Gateway B.
If both of Gateway A's Internet connections are down, it deducts from its priority 20 (for the
primary connection) and 30 (for the secondary connection), reducing its priority to 50. In
this case, Gateway B's priority is the higher priority, and it becomes the Active Gateway.
272
Check Point UTM-1 Embedded NGX User Guide
Sample Implementation on Two Gateways
Chapter 8: Configuring High Availability
273
Overview
Chapter 9
Using Traffic Shaper
This chapter describes how to use Traffic Shaper to control the flow of communication to
and from your network.
This chapter includes the following topics:
Overview ..................................................................................................275
Setting Up Traffic Shaper .........................................................................276
Predefined QoS Classes ............................................................................277
Adding and Editing Classes ......................................................................278
Viewing and Deleting Classes ..................................................................283
Restoring Traffic Shaper Defaults ............................................................ 283
Overview
Traffic Shaper is a bandwidth management solution that allows you to set bandwidth
policies to control the flow of communication. Traffic Shaper ensures that important traffic
takes precedence over less important traffic, so that your business can continue to function
with minimum disruption, despite network congestion.
Traffic Shaper uses Stateful Inspection technology to access and analyze data derived from
all communication layers. This data is used to classify traffic in up to eight user-defined
Quality of Service (QoS) classes. Traffic Shaper divides available bandwidth among the
classes according to weight. For example, suppose Web traffic is deemed three times as
important as FTP traffic, and these services are assigned weights of 30 and 10 respectively.
If the lines are congested, Traffic Shaper will maintain the ratio of bandwidth allocated to
Web traffic and FTP traffic at 3:1.
If a specific class is not using all of its bandwidth, the leftover bandwidth is divided among
the remaining classes, in accordance with their relative weights. In the example above, if
only one Web and one FTP connection are active and they are competing, the Web
connection will receive 75% (30/40) of the leftover bandwidth, and the FTP connection will
receive 25% (10/40) of the leftover bandwidth. If the Web connection closes, the FTP
connection will receive 100% of the bandwidth.
Chapter 9: Using Traffic Shaper
275
Setting Up Traffic Shaper
Traffic Shaper allows you to give a class a bandwidth limit. A class's bandwidth limit is the
maximum amount of bandwidth that connections belonging to that class may use together.
Once a class has reached its bandwidth limit, connections belonging to that class will not be
allocated further bandwidth, even if there is unused bandwidth available. For example, you
can limit all traffic used by Peer-To-Peer file-sharing applications to a specific rate, such as
512 kilobit per second. Traffic Shaper also allows you to assign a ―Delay Sensitivity‖ value
to a class, indicating whether connections belonging to the class should be given precedence
over connections belonging to other classes.
Traffic Shaper supports DiffServ (Differentiated Services) Packet Marking. DiffServ marks
packets as belonging to a certain Quality of Service class. These packets are then granted
priority on the public network according to their class.
Setting Up Traffic Shaper
To set up Traffic Shaper
1.
Enable Traffic Shaper for the Internet connection.
You can enable Traffic Shaper for incoming or outgoing connections.
See Using Internet Setup on page 131.
Note: Traffic Shaper cannot control the number or type of packets it receives from the
Internet; it can only affect the rate of incoming traffic by dropping received packets.
This makes the shaping of inbound traffic less accurate than the shaping of outbound
traffic. It is therefore recommended to enable traffic shaping for incoming traffic only if
necessary.
2.
Define QoS classes that reflect your communication needs. Alternatively, use
the four built-in QoS classes.
See Adding and Editing a Class on page 278.
3.
Use Allow or Allow and Forward rules to assign different types of connections
to QoS classes.
For example, if Traffic Shaper is enabled for outgoing traffic, and you create an Allow
rule associating all outgoing VPN traffic with the Urgent QoS class, then Traffic Shaper
276
Check Point UTM-1 Embedded NGX User Guide
Predefined QoS Classes
will handle outgoing VPN traffic as specified in the bandwidth policy for the Urgent
class.
See Adding and Editing Rules on page 377.
Note: Traffic Shaper must be enabled for the direction of traffic specified in the rule.
Note: If you do not assign a connection type to a class, Traffic Shaper automatically
assigns the connection type to the built-in "Default" class.
Predefined QoS Classes
Traffic Shaper provides the following predefined QoS classes.
To assign traffic to these classes, define firewall rules as described in Using Rules on page
374.
Table 54: Predefined QoS Classes
Class
Weight
Delay Sensitivity
Useful for
Default
10
Medium
Normal traffic.
(Normal Traffic)
Chapter 9: Using Traffic Shaper
All traffic is assigned to this class by default.
277
Adding and Editing Classes
Class
Weight
Delay Sensitivity
Useful for
Urgent
15
High
Traffic that is highly sensitive to delay. For
(Interactive Traffic)
example, IP telephony, videoconferencing, and
interactive protocols that require quick user
response, such as telnet.
Note that the weight (amount of bandwidth)
allocated to this class is less than the weight
allocated to the ―Important‖ class. The "Urgent"
class is ideal for delay-sensitive traffic that does
not demand a high amount of bandwidth.
Important
20
Medium
Important traffic that requires a high allocation
(Normal Traffic)
of bandwidth, but which is not exceptionally
sensitive to delays. For example, you can
prioritize the HTTP traffic of a company's
executive officers over other types of traffic, by
assigning it to the ―Important‖ class.
Low Priority
5
Low
Traffic that is not sensitive to long delays, and
(Bulk Traffic)
which does not require a high guaranteed
bandwidth. For example, SMTP traffic (outgoing
email).
Adding and Editing Classes
To add or edit a QoS class
1.
278
Click Network in the main menu, and click the Traffic Shaper tab.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Classes
The Quality of Service Classes page appears.
2.
Click Add.
The UTM-1 QoS Class Editor wizard opens, with the Step 1 of 3: Quality of Service
Parameters dialog box displayed.
3.
Complete the fields using the relevant information in the following table.
4.
Click Next.
Chapter 9: Using Traffic Shaper
279
Adding and Editing Classes
The Step 2 of 3: Advanced Options dialog box appears.
5.
Complete the fields using the relevant information in the following table.
Note: Traffic Shaper may not enforce guaranteed rates and relative weights for
incoming traffic as accurately as for outgoing traffic. This is because Traffic Shaper
cannot control the number or type of packets it receives from the Internet; it can only
affect the rate of incoming traffic by dropping received packets. It is therefore
recommended to enable traffic shaping for incoming traffic only if necessary. For
information on enabling Traffic Shaper for incoming and outgoing traffic, see Using
Internet Setup on page 131.
6.
280
Click Next.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Classes
The Step 3 of 3: Save dialog box appears with a summary of the class.
7.
Type a name for the class.
For example, if you are creating a class for high priority Web connections, you can
name the class "High Priority Web".
8.
Click Finish.
The new class appears in the Quality of Service Classes page.
Table 55: QoS Class Fields
In this field…
Do this…
Relative Weight
Type a value indicating the class's importance relative to the other defined
classes.
For example, if you assign one class a weight of 100, and you assign
another class a weight of 50, the first class will be allocated twice the
amount of bandwidth as the second when the lines are congested.
Delay Sensitivity
Select the degree of precedence to give this class in the transmission
queue:
Chapter 9: Using Traffic Shaper
281
Adding and Editing Classes
In this field…
Do this…

Low (Bulk Traffic) - Traffic that is not sensitive to long delays. For
example, SMTP traffic (outgoing email).

Medium (Normal Traffic) - Normal traffic

High (Interactive Traffic) - Traffic that is highly sensitive to delay.
For example, IP telephony, videoconferencing, and interactive
protocols that require quick user response, such as telnet.
Traffic Shaper serves delay-sensitive traffic with a lower latency. That is,
Traffic Shaper attempts to send packets with a "High (Interactive Traffic)"
level before packets with a "Medium (Normal Traffic)" or "Low (Bulk Traffic)"
level.
Outgoing Traffic:
Select this option to guarantee a minimum bandwidth for outgoing traffic
Guarantee At Least
belonging to this class. Then type the minimum bandwidth (in
kilobits/second) in the field provided.
Outgoing Traffic:
Select this option to limit the rate of outgoing traffic belonging to this class.
Limit rate to
Then type the maximum rate (in kilobits/second) in the field provided.
Incoming Traffic:
Select this option to guarantee a minimum bandwidth for incoming traffic
Guarantee At Least
belonging to this class. Then type the minimum bandwidth (in
kilobits/second) in the field provided.
Incoming Traffic:
Select this option to limit the rate of incoming traffic belonging to this class.
Limit rate to
Then type the maximum rate (in kilobits/second) in the field provided.
DiffServ Code Point
Select this option to mark packets belonging to this class with a DiffServ
Code Point (DSCP), which is an integer between 0 and 63. Then type the
DSCP in the field provided.
The marked packets will be given priority on the public network according to
their DSCP.
To use this option, your ISP or private WAN must support DiffServ. You can
obtain the correct DSCP value from your ISP or private WAN administrator.
282
Check Point UTM-1 Embedded NGX User Guide
Viewing and Deleting Classes
Viewing and Deleting Classes
You cannot delete a class that is currently used by a rule. You can determine whether a class
is in use or not, by viewing the Rules page.
To view or delete an existing QoS class
1.
Click Network in the main menu, and click the Traffic Shaper tab.
The Quality of Service Classes page appears with a list of all defined QoS classes.
2.
To delete a QoS class, do the following:
a.
b.
In the desired class's row, click Erase.
A confirmation message appears.
Click OK.
The class is deleted.
Restoring Traffic Shaper Defaults
If desired, you can reset the Traffic Shaper bandwidth policy to use the four predefined
classes, and restore these classes to their default settings. For information on these classes
and their defaults, see Predefined QoS Classes on page 277.
Note: This will delete any additional classes you defined in Traffic Shaper
and reset all rules to use the Default class.
If one of the additional classes is currently used by a rule, you cannot reset
Traffic Shaper to defaults. You can determine whether a class is in use or
not, by viewing the Rules page.
To restore Traffic Shaper defaults
1.
Click Network in the main menu, and click the Traffic Shaper tab.
The Quality of Service Classes page appears.
Chapter 9: Using Traffic Shaper
283
Restoring Traffic Shaper Defaults
2.
Click Restore Defaults.
A confirmation message appears.
3.
284
Click OK.
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 10
Working with Wireless Networks
This chapter describes how to configure wireless internal networks.
This chapter includes the following topics:
Overview ..................................................................................................285
Configuring Wireless Networks ............................................................... 294
Troubleshooting Wireless Connectivity ................................................... 321
Overview
Your UTM-1 wireless appliance features a built-in 802.11b/g/n access point that is tightly
integrated with the firewall and VPN.
UTM-1 wireless appliances support the latest 802.11n standard (up to 300 Mbps) which
integrates multiple-input and multiple-output (MIMO) features. MIMO is a technology that
uses multiple antennas to coherently resolve more information than possible using a single
antenna, and reduces problems with reflected signals. In addition, MIMO includes Spatial
Division Multiplexing (SDM), which spatially multiplexes independent data streams that are
transferred simultaneously within one spectral channel of bandwidth. MIMO SDM can
significantly increase data throughput, as the number of resolved special data streams is
increased.
In addition to MIMO, 802.11n also supports 40MHz channels, a channel width that is double
the 20MHz available in previous 802.11 PHYs, allowing for doubling of the PHY data rate
over a single 20 MHz channel.
UTM-1 appliances are backwards compatible with the older 802.11b standard (up to 11
Mbps) and 802.11g standard (up to 54 Mbps), so that both new and old adapters of these
standards are interoperable.
UTM-1 wireless appliances transmit in 2.4GHz range, using dual diversity antennas to
increase the range.
Chapter 10: Working with Wireless Networks
285
Overview
The Primary WLAN
In addition to the LAN and DMZ networks, you can define a wireless internal network called
the primary WLAN (wireless LAN) network. The primary WLAN is the main wireless
network, and it controls all other wireless network's statuses: wireless networks can be
enabled only if the primary WLAN is enabled, and disabling the primary WLAN
automatically disables all other wireless network. In addition, all wireless networks inherit
certain settings from the primary WLAN.
You can configure the primary WLAN in either of the following ways:

Wireless Configuration Wizard. Guides you through the primary WLAN setup, step
by step.
See Using the Wireless Configuration Wizard on page 294.

Manual configuration. Offers advanced setup options for the primary WLAN.
See Manually Configuring a WLAN on page 301.
Virtual Access Points
The UTM-1 appliance enables you to partition the primary WLAN into virtual access points
(VAPs). A VAP is a logical wireless network behind the UTM-1 appliance and is a type of
VLAN (see Configuring VLANs on page 200). Like other types of VLANs, VAPs are
isolated from each other and can have separate security policies, IP network segments, and
Traffic Shaper settings. This enables you to configure separate policies for different groups
of wireless users.
For example, you could assign different permissions to employees and guests using your
company's wireless network, by defining two VAPs called ―Guest‖ and ―Employee‖. The
Guest VAP would use simple WPA-Personal encryption, and the security policy would
mandate that stations connected to this network can access the Internet, but not sensitive
company resources. You could configure Traffic Shaper bandwidth management to give
stations in the Guest network a low priority, and by enabling Secure HotSpot on this
network, you could define terms of use that the guest users must accept before accessing the
286
Check Point UTM-1 Embedded NGX User Guide
Overview
Internet. In contrast, the Employee VAP would use the more secure WPA2-Enterprise
(802.11i) encryption standard and allow employees to access company resources such as the
intranet.
You can configure up to three VAPs, in addition to the primary WLAN. For information on
configuring VAPs, see Configuring VAPs on page 313.
Wireless Distribution System Links
The UTM-1 appliance enables you to extend the primary WLAN's coverage area, by
creating a Wireless Distribution System (WDS). A WDS is a system of access points that
communicate with each other wirelessly via WDS links, without any need for a wired
backbone. For example, if your business has expanded across two buildings, and a single
access point no longer provides sufficient coverage, you can add another access point that
acts as a repeater. If it is impractical or costly to run wires between the access points, you can
connect them by configuring a WDS that includes both access points.
WDS is usually used together with bridge mode to connect the networks behind the access
points. For example, if you have two network segments, each of which is served by a
different access point, you can bridge the two network segments over WDS links. The
network segments will communicate with each other wirelessly via their access points and
act as a single network. For information on bridge mode, see Using Bridges on page 243.
WDS links are considered a type of VLAN (see Configuring VLANs on page 200).
Therefore, they can have separate security policies, IP network segments, and Traffic Shaper
settings.
Chapter 10: Working with Wireless Networks
287
Overview
You can use WDS links to create loop-free topologies, such as a star or tree of access points.
Figure 35: WDS Star of Wireless Access Points
288
Check Point UTM-1 Embedded NGX User Guide
Overview
When used together with bridge mode and Spanning Tree Protocol (STP), you can use WDS
links to create redundant topologies, such as a loop or mesh of linked access points.
Figure 36: Two Access Points Linked by a WDS Bridge
Chapter 10: Working with Wireless Networks
289
Overview
Figure 37: Redundant Loop of Access Points Linked by WDS and STP
You can configure up to seven WDS links, in addition to the primary WLAN. For
information on configuring WDS links, see Configuring WDS Links on page 317.
Note: All access points in a WDS must use the same radio channel for the WDS link
and for communicating with wireless stations. Therefore, using WDS may have a
negative impact on wireless throughput. In this case, it is recommended to use a
traditional wired backbone to connect the access points, instead of WDS links.
290
Check Point UTM-1 Embedded NGX User Guide
Overview
Network Count Limitations
You can configure a total of eight wireless objects, including any combination of the
following:

The primary WLAN

Up to three virtual access points (VAPs)

Up to seven WDS links
For example, if you configure the primary WLAN and two VAPs, then you can configure
five WDS links, or one more VAP and four WDS links.
When Extended Range (XR) mode is enabled for a wireless object, then it is counted as two
objects. For example, if you configure XR mode for the primary WLAN and one VAP, they
are counted as four wireless objects.
For information on default security policy rules controlling traffic to and from the primary
WLAN and VAPs, see Default Security Policy on page 367.
Wireless Security Protocols
The UTM-1 wireless security appliance supports the following security protocols:
Table 56: Wireless Security Protocols
Security
Description
Protocol
None
No security method is used. This option is not recommended, because it allows
unauthorized users to access your wireless network, although you can still limit
access from the wireless network by creating firewall rules. This method is
suitable for creating public access points.
Chapter 10: Working with Wireless Networks
291
Overview
Security
Description
Protocol
WEP encryption
In the WEP (Wired Equivalent Privacy) encryption security method, wireless
stations must use a pre-shared key to connect to your network. This method is
not recommended, due to known security flaws in the WEP protocol. It is
provided for compatibility with existing wireless deployments.
Note: The appliance and the wireless stations must be configured with the
same WEP key.
802.1x: RADIUS
In the 802.1x security method, wireless stations (supplicants) attempting to
authentication, no
connect to the access point (authenticator) must first be authenticated, either
encryption
by a RADIUS server (authentication server) which supports 802.1x, or by the
UTM-1 appliance's built-in EAP authenticator. All messages are passed in EAP
(Extensible Authentication Protocol).
This method is recommended for situations in which you want to authenticate
wireless users, but do not need to encrypt the data.
This security method is not supported for WDS links.
Note: To use this security method, you must first configure either a RADIUS
server that supports 802.1x, or set up the network for use with the UTM-1 EAP
authenticator. For information on configuring a RADIUS server, see Using
RADIUS Authentication on page 645. For information on using the UTM-1
EAP authenticator, see Using the UTM-1 EAP Authenticator on page 404.
WPA-Enterprise:
The WPA-Enterprise (Wi-Fi Protected Access) security method uses MIC
RADIUS
(message integrity check) to ensure the integrity of messages, and TKIP
authentication,
(Temporal Key Integrity Protocol) to enhance data encryption.
encryption
Furthermore, WPA-Enterprise includes 802.1x and EAP authentication, based
either on a central RADIUS authentication server, or on the UTM-1 appliance's
built-in EAP authenticator. This method is recommended for situations where
you want to authenticate wireless stations, and to encrypt the transmitted data.
292
Check Point UTM-1 Embedded NGX User Guide
Overview
Security
Description
Protocol
Note: To use this security method, you must first configure either a RADIUS
server that supports 802.1x, or set up the network for use with the UTM-1 EAP
authenticator. For information on configuring a RADIUS server, see Using
RADIUS Authentication on page 645. For information on using the UTM-1
EAP authenticator, see Using the UTM-1 EAP Authenticator on page 404.
WPA-Personal:
The WPA-Personal security method (also called WPA-PSK) is a variation of
password
WPA-Enterprise that does not require an authentication server. WPA-Personal
authentication,
periodically changes and authenticates encryption keys. This is called
encryption
rekeying.
This option is recommended for small networks, which want to authenticate
and encrypt wireless data, but do not want to install a RADIUS server or use
the UTM-1 EAP authenticator.
Note: The appliance and the wireless stations must be configured with the same
passphrase.
WPA2 (802.11i)
The WPA2 security method uses the more secure Advanced Encryption
Standard (AES) cipher, instead of the RC4 cipher used by WPA and WEP.
When using WPA-Enterprise or WPA-Personal security methods, the UTM-1
appliance enables you to restrict access to the wireless network to wireless
stations that support the WPA2 security method. If this setting is not selected,
the UTM-1 appliance allows clients to connect using both WPA and WPA2.
Note: For increased security, it is recommended to enable the UTM-1 internal VPN
Server for users connecting from your internal networks, and to install
SecuRemote/SecureClient/L2TP/Endpoint Connect on each computer in the wireless
network. This ensures that all connections from the wireless network to the LAN are
encrypted and authenticated. For information, see Internal VPN Server on page 569
and Setting Up Your UTM-1 Appliance as a VPN Server on page 570.
Chapter 10: Working with Wireless Networks
293
Configuring Wireless Networks
Configuring Wireless Networks
Note: It is recommended to configure wireless networks via Ethernet and not via a
wireless connection, because the wireless connection could be broken after making a
change to the configuration.
Using the Wireless Configuration Wizard
The Wireless Configuration Wizard provides a quick and simple way of setting up your
basic primary WLAN parameters for the first time.
Note: You cannot configure WPA-Enterprise and 802.1x using this wizard. For
information on configuring these modes, see Manually Configuring a Wireless
Network on page 301.
To configure a WLAN using the Wireless Configuration Wizard
1.
Prepare the appliance for a wireless connection as described in Preparing the
Edge Appliance for a Wireless Connection on page 93.
2.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
3.
In the WLAN network's row, click Edit.
The Edit Network Settings page appears.
4.
294
Click Wireless Wizard.
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
The Wireless Configuration Wizard opens, with the Wireless Configuration dialog box
displayed.
5.
Select the Enable wireless networking check box to enable the primary WLAN.
The fields are enabled.
6.
Complete the fields using the information in Basic WLAN Settings Fields on
page 304.
7.
Click Next.
Chapter 10: Working with Wireless Networks
295
Configuring Wireless Networks
8.
The Wireless Security dialog box appears.
9.
Do one of the following:

Click WPA-Personal to use the WPA-Personal security mode.
WPA-Personal (also called WPA-PSK) uses a passphrase for authentication. This
method is recommended for small, private wireless networks, which want to
authenticate and encrypt wireless data, but do not want to install a RADIUS server
or use the UTM-1 EAP authenticator. Both WPA and the newer, more secure
WPA2 (802.11i) will be accepted. To allow only the more secure WPA2 and not
WPA, see Manually Configuring a WLAN on page 301. For larger wireless
networks with many users, configure the primary WLAN to use WPA-Enterprise,
using the procedure Manually Configuring a WLAN on page 301.
 Click WEP to use the WEP security mode.
Using WEP, wireless stations must use a pre-shared key to connect to your
network. WEP is widely known to be insecure, and is supported mainly for
compatibility with existing networks and stations that do not support other
methods.
 Click No Security to use no security to create a public, unsecured access point.
10. Do one of the following:

296
To bridge the LAN and WLAN networks so that they appear as a single unified
network, click Bridge Mode.
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
Traffic from the WLAN to the LAN will be allowed to pass freely, and the LAN
and WLAN will share a single IP address range.
Note: This option creates a bridge called "default-bridge", which includes the WLAN
and the LAN. If desired, you can later remove this bridge by running the Wireless
Configuration Wizard again, and choosing Firewall Mode. For information on bridges,
see Using Bridges on page 243.

To isolate the LAN from the WLAN, click Firewall Mode.
The WLAN and LAN will be assigned separate, isolated IP networks, and traffic
from the WLAN to the LAN will be subjected to the defined firewall policy.
By default, traffic from the WLAN to the LAN will be blocked, and traffic from the
LAN to the WLAN will be allowed. To allow traffic from the WLAN to the LAN,
you must create firewall rules. For information, see Using Firewall Rules.
11. Click Next.
WPA-Personal
If you chose WPA-Personal, the Wireless Configuration-WPA-Personal dialog box appears.
Do the following:
1.
In the text box, type the passphrase for accessing the network, or click Random
to randomly generate a passphrase.
Chapter 10: Working with Wireless Networks
297
Configuring Wireless Networks
This must be between 8 and 63 characters. It can contain spaces and special characters,
and is case-sensitive.
2.
Click Next.
The Wireless Security Confirmation dialog box appears.
3.
298
Click Next.
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
4.
The Wireless Security Complete dialog box appears.
5.
Click Finish.
The wizard closes.
6.
Prepare the wireless stations.
Chapter 10: Working with Wireless Networks
299
Configuring Wireless Networks
WEP
If you chose WEP, the Wireless Configuration-WEP dialog box appears.
Do the following:
1.
Choose a WEP key length.
The possible key lengths are:
 64 Bits - The key length is 10 hexadecimal characters.
 128 Bits - The key length is 26 hexadecimal characters.
 152 Bits - The key length is 32 hexadecimal characters.
Some wireless card vendors call these lengths 40/104/128, respectively.
Note that WEP is generally considered to be insecure, regardless of the selected key
length.
2.
In the text box, type the WEP key, or click Random to randomly generate a key
matching the selected length.
The key is composed of characters 0-9 and A-F, and is not case-sensitive. The wireless
stations must be configured with this same key.
3.
Click Next.
The Wireless Security Confirmation dialog box appears.
300
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
4.
Click Next.
The Wireless Security Complete dialog box appears.
5.
Click Finish.
The wizard closes.
6.
Prepare the wireless stations.
No Security
The Wireless Security Complete dialog box appears.

Click Finish.
The wizard closes.
Manually Configuring a Wireless Network
To manually configure a wireless network
1.
If you intend to use the 802.1x or WPA-Enterprise security mode for the
wireless network, do one of the following:

2.
3.
To use the UTM-1 EAP authenticator for authenticating wireless clients, follow
the workflow Using the UTM-1 EAP Authenticator for Authentication of
Wireless Clients.
You will be referred back to this procedure at the appropriate stage in the
workflow, at which point you can continue from the next step.
 To use a RADIUS server for authenticating wireless clients, configure a
RADIUS server.
See Using RADIUS Authentication on page 645.
Prepare the appliance for a wireless connection as described in Preparing the
Edge Appliance for a Wireless Connection on page 93.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
4.
In the desired wireless network's row, click Edit.
Chapter 10: Working with Wireless Networks
301
Configuring Wireless Networks
The Edit Network Settings page appears.
The fields that appear depend on the hardware type.
5.
In the Mode drop-down list, select Enabled.
The fields are enabled.
6.
In the IP Address field, type the IP address of the wireless network network's
default gateway.
The wireless network must not overlap other networks.
7.
In the Subnet Mask field, type the wireless network’s internal network range.
8.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
9.
If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
10. Complete the fields using the information in Basic Wireless Settings Fields on
page 304.
302
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
11. To configure advanced settings, click Show Advanced Settings and complete the
fields using the information in Advanced Wireless Settings Fields on page 309.
New fields appear.
The fields that appear depend on the hardware type.
Chapter 10: Working with Wireless Networks
303
Configuring Wireless Networks
12. Click Apply.
A warning message appears, telling you that you are about to change your network
settings.
13. Click OK.
A success message appears.
Note: Some wireless cards have "Infrastructure" and "Ad-hoc" modes. These modes
are also called "Access Point" and "Peer to Peer". On the wireless client, choose the
"Infrastructure" or "Access Point" mode.
You can set the wireless cards to either "Long Preamble" or "Short Preamble".
Table 57: Basic Wireless Settings Fields
In this field…
Do this…
Wireless Settings
Network Name
Type the network name (SSID) that identifies your wireless network. This
(SSID)
name will be visible to wireless stations passing near your access point,
unless you enable the Hide the Network Name (SSID) option.
It can be up to 32 alphanumeric characters long and is case-sensitive.
Country
Select the country where you are located.
Warning: Choosing an incorrect country may result in the violation of
government regulations.
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
Operation Mode
304
Select an operation mode:

802.11b (11 Mbps). Operates in the 2.4 GHz range and offers a
maximum theoretical rate of 11 Mbps. When using this mode,
only 802.11b stations will be able to connect.

802.11g (54 Mbps). Operates in the 2.4 GHz range, and offers a
maximum theoretical rate of 54 Mbps. When using this mode,
only 802.11g stations will be able to connect.
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
In this field…
Do this…

802.11b/g (11/54 Mbps). Operates in the 2.4 GHz range, and offers a
maximum theoretical rate of 54 Mbps. When using this mode,
both 802.11b stations and 802.11g stations will be able to
connect.

802.11g Super (54/108 Mbps). Operates in the 2.4 GHz range, and
offers a maximum theoretical rate of 108 Mbps. When using this
mode, 802.1g stations and 802.11g Super stations will be able to
connect.
This mode is not available in UTM-1 Edge NW.

802.11g Super (11/54/108). Operates in the 2.4 GHz range, and offers
a maximum theoretical rate of 108 Mbps. When using this mode,
802.11b stations, 802.11g stations, and 802.11g Super stations
will be able to connect.
This mode is not available in UTM-1 Edge NW.

802.11n. Operates in the 2.4 GHz range, and offers a maximum
theoretical rate of 300 Mbps. When using this mode, only 802.11n
stations will be able to connect.
This mode is only available in UTM-1 Edge NW.

802.11ng. Operates in the 2.4 GHz range, and offers a maximum
theoretical rate of 300 Mbps. When using this mode, 802.11g
stations and 802.11n stations will be able to connect.
This mode is only available in UTM-1 Edge NW.
The list of modes is dependent on the selected country.
You can prevent older wireless stations from slowing down your network, by
choosing an operation mode that restricts access to newer wireless stations.
Note: The actual data transfer speed is usually significantly lower than the
maximum theoretical bandwidth and degrades with distance.
Important: The station wireless cards must support the selected operation
mode. For a list of cards supporting 802.11g Super, refer to
http://www.super-ag.com.
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
Channel
Select the radio frequency to use for the wireless connection:
Chapter 10: Working with Wireless Networks
305
Configuring Wireless Networks
In this field…
Do this…

Automatic. The UTM-1 appliance automatically selects a channel.
This is the default.

A specific channel. The list of channels is dependent on the
selected country and operation mode.
Note: If there is another wireless network in the vicinity, the two networks may
interfere with one another. To avoid this problem, the networks should be
assigned channels that are at least 25 MHz (5 channels) apart. Alternatively,
you can reduce the transmission power.
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
Channel Width
Select the desired channel width:

Auto (20/40 Mhz). The UTM-1 automatically selects the channel
width: 20Mhz or 40Mhz.

20Mhz
Selecting Auto can increase wireless performance, if a 40Mhz channel is
available. However, in some cases it may interfere with other access points
or wireless equipment in the area.
This field is only available in UTM-1 Edge NW.
Security
Select the security protocol to use. For information on the supported security
protocols, see Wireless Security Protocols on page 291.
If you select WEP encryption, the WEP Keys area opens.
If you select 802.1x, the Authentication Server field appears.
If you select WPA-Enterprise, the Authentication Server, Require WPA2 (802.11i),
and WPA Encryption fields appear.
If you select WPA-Personal, the Passphrase, Require WPA2 (802.11i), and WPA
Encryption fields appear.
Note: When configuring a WDS link, 802.1x is not supported.
306
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
In this field…
Do this…
Authentication
Specify which authentication server to use, by selecting one of the following:
Server

RADIUS. A RADIUS server.

Internal User Database. The UTM-1 EAP authenticator.
Passphrase
Type the passphrase for accessing the network, or click Random to randomly
generate a passphrase.
This must be between 8 and 63 characters. It can contain spaces and special
characters, and is case-sensitive.
For the highest security, choose a long passphrase that is hard to guess, or
use the Random button.
Note: The wireless stations must be configured with this passphrase as well.
Require WPA2
Specify whether you want to require wireless stations to connect using
(802.11i)
WPA2, by selecting one of the following:
WPA Encryption

Enabled. Only wireless stations using WPA2 can access the
wireless network.

Disabled. Wireless stations using either WPA or WPA2 can access
the wireless network. This is the default.
Select the encryption method to use for authenticating and encrypting
wireless data:

Auto. The UTM-1 appliance automatically selects the cipher used
by the wireless client. This is the default.

AES. Advanced Encryption Standard

TKIP. Temporal Key Integrity Protocol
Note: AES is more secure than TKIP; however, some devices do not support
AES.
Chapter 10: Working with Wireless Networks
307
Configuring Wireless Networks
In this field…
Do this…
WEP Keys
If you selected WEP encryption, you must configure at least one WEP key. The
wireless stations must be configured with the same key, as well.
Key 1, 2, 3, 4 radio
Click the radio button next to the WEP key that this gateway should use for
button
transmission.
The selected key must be entered in the same key slot (1-4) on the station
devices, but the key need not be selected as the transmit key on the stations.
Note: You can use all four keys to receive data.
Key 1, 2, 3, 4
length
Select the WEP key length from the drop-down list.
The possible key lengths are:

64 Bits. The key length is 10 characters.

128 Bits. The key length is 26 characters.

152 Bits. The key length is 32 characters.
Note: Some wireless card vendors call these lengths 40/104/128,
respectively.
Note: WEP is generally considered to be insecure, regardless of the selected
key length.
Key 1, 2, 3, 4 text
Type the WEP key, or click Random to randomly generate a key matching the
box
selected length. The key is composed of hexadecimal characters 0-9 and
A-F, and is not case-sensitive.
308
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
Table 58: Advanced Wireless Settings Fields
In this field…
Do this…
Advanced Security
Hide the Network
Specify whether you want to hide your network's SSID, by selecting one of
Name (SSID)
the following:

Yes. Hide the SSID.
Only devices to which your SSID is known can connect to your
network.

No. Do not hide the SSID.
Any device within range can detect your network name and
attempt to connect to your network. This is the default.
Note: Hiding the SSID does not provide strong security, because a
determined attacker can still discover your SSID. Therefore, it is not
recommended to rely on this setting alone for security.
MAC Address
Specify whether you want to enable MAC address filtering, by selecting one
Filtering
of the following:

Yes. Enable MAC address filtering.
Only MAC addresses that you added as network objects can
connect to your network.
For information on network objects, see Using Network Objects
on page 210.

No. Disable MAC address filtering. This is the default.
Note: MAC address filtering does not provide strong security, since MAC
addresses can be spoofed by a determined attacker. Therefore, it is not
recommended to rely on this setting alone for security.
Station-to-Station
Specify whether you want to allow wireless stations on this network to
Traffic
communicate with each other, by selecting one of the following:

Allow. Allow stations to communicate with each other. This is the
default.

Block. Block traffic between wireless stations.
Chapter 10: Working with Wireless Networks
309
Configuring Wireless Networks
In this field…
Do this…
Wireless Transmitter
Transmission Rate
Select the transmission rate:

Automatic. The UTM-1 appliance automatically selects a rate. This
is the default.

A specific rate
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
Transmitter Power
Select the transmitter power.
Setting a higher transmitter power increases the access point's range. A
lower power reduces interference with other access points in the vicinity.
The default value is Full. It is not necessary to change this value, unless there
are other access points in the vicinity.
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
Guard Interval
Select the guard interval, which is the amount of time between symbol
transmissions (in nanoseconds). The guard interval allows reflections from
the previous data transmission to settle before transmitting a new symbol.
This can have the following values:

Normal. 800ns

Short. 400ns
Selecting Short can increase throughput. However, in some cases it can also
increase error rate, due to increased sensitivity to RF reflections.
This field appears only for UTM-1 Edge NW.
Antenna Selection
Multipath distortion is caused by the reflection of Radio Frequency (RF)
signals traveling from the transmitter to the receiver along more than one
path. Signals that were reflected by some surface reach the receiver after
310
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
In this field…
Do this…
non-reflected signals and distort them.
UTM-1 appliances avoid the problems of multipath distortion by using an
antenna diversity system. To provide antenna diversity, each wireless
security appliance has two antennas.
Specify which antenna to use for communicating with wireless stations:

Automatic. The UTM-1 appliance receives signals through both
antennas and automatically selects the antenna with the lowest
distortion signal to use for communicating. The selection is made
on a per-station basis. This is the default.

ANT 1. The ANT 1antenna is always used for communicating.

ANT 2. The ANT 2 antenna is always used for communicating.
Use manual diversity control (ANT 1 or ANT 2), if there is only one antenna
connected to the appliance.
This field only appears when configuring the primary WLAN, and it is
inherited by all VAPs and WDS links.
This field does not appear for UTM-1 Edge NW.
Fragmentation
Type the smallest IP packet size (in bytes) that requires that the IP packet be
Threshold
split into smaller fragments.
If you are experiencing significant radio interference, set the threshold to a
low value (around 1000), to reduce error penalty and increase overall
throughput.
Otherwise, set the threshold to a high value (around 2000), to reduce
overhead.
The default value is 2346.
RTS Threshold
Type the smallest IP packet size for which a station must send an RTS
(Request To Send) before sending the IP packet.
If multiple wireless stations are in range of the access point, but not in range
Chapter 10: Working with Wireless Networks
311
Configuring Wireless Networks
In this field…
Do this…
of each other, they might send data to the access point simultaneously,
thereby causing data collisions and failures. RTS ensures that the channel is
clear before the each packet is sent.
If your network is congested, and the users are distant from one another, set
the RTS threshold to a low value (around 500).
Setting a value equal to the fragmentation threshold effectively disables RTS.
The default value is 2346.
Extended Range
Specify whether to use Extended Range (XR) mode:
Mode (XR)

Disabled. XR mode is disabled.

Enabled. XR mode is enabled. XR will be automatically negotiated
with XR-enabled wireless stations and used as needed. This is
the default.
This field does not appear for UTM-1 Edge NW.
Multimedia QoS
Specify whether to use the Wireless Multimedia (WMM) standard to prioritize
(WMM)
traffic from WMM-compliant multimedia applications. This can have the
following values:
WDS

Disabled. WMM is disabled. This is the default.

Enabled. WMM is enabled. The UTM-1 appliance will prioritize
multimedia traffic according to four access categories (Voice,
Video, Best Effort, and Background). This allows for smoother
streaming of voice and video when using WMM aware
applications.
Specify whether to enable WDS links:

Disabled. WDS links are disabled.

Enabled. WDS links are enabled. For information on configuring
WDS links, see Configuring Wireless Distribution System
Links on page 317.
This field appears only for UTM-1 Edge NW.
312
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
Configuring Virtual Access Points
You can partition the wireless network into wireless VLANs called virtual access points
(VAPs). You can use VAPs to grant different permissions to groups of wireless users, by
configuring each VAP with the desired security policy and network settings, and then
assigning each group of wireless users to the relevant VAP. For more information on VAPs,
see Overview on page 285.
Note: While virtual access points (VAPs) can have different security settings and
network names, all VAPs inherit the following wireless settings from the primary
WLAN:

Country

Operation Mode

Channel

Transmission Rate

Transmitter Power

Antenna Selection
For information on configuring these settings in the primary WLAN, see Manually
Configuring a Wireless Network on page 301.
Note: To enable VAPs, you must first enable the primary WLAN network. If you disable
the primary WLAN network, all VAPs are automatically disabled.
The procedure below explains how to add or edit a VAP. For information on deleting a VAP,
see Deleting VLANs on page 207.
To add or edit a VAP
1.
Configure and enable the primary WLAN.
For information on configuring the primary WLAN manually, see Manually
Configuring a Wireless Network on page 301.
For information on using a wizard to configure the primary WLAN, see Using the
Wireless Wizard on page 294.
Chapter 10: Working with Wireless Networks
313
Configuring Wireless Networks
2.
If you intend to use the 802.1x or WPA-Enterprise security mode for the VAP,
do one of the following:

3.
To use the UTM-1 EAP authenticator for authenticating wireless clients, follow
the workflow Using the UTM-1 EAP Authenticator for Authentication of
Wireless Clients.
You will be referred back to this procedure at the appropriate stage in the
workflow, at which point you can continue from the next step.
 To use a RADIUS server for authenticating wireless clients, configure a
RADIUS server.
See Using RADIUS Authentication on page 645.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
4.
Click Add Network.
The Edit Network Settings page appears.
5.
In the Network Name field, type a name for the VAP.
6.
In the Type drop-down list, select Virtual Access Point.
314
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
New fields appear.
The fields that appear depend on the hardware type.
7.
In the Mode drop-down list, select Enabled.
The fields are enabled.
8.
In the IP Address field, type the IP address of the VAP network's default
gateway.
The VAP network must not overlap other networks.
9.
In the Subnet Mask field, type the VAP's internal network range.
10. If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
11. If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
Chapter 10: Working with Wireless Networks
315
Configuring Wireless Networks
12. Complete the fields using the information in Basic Wireless Settings Fields on
page 304.
13. To configure advanced settings, click Show Advanced Settings and complete the
fields using the information in Advanced Wireless Settings Fields on page 309.
New fields appear.
The fields that appear depend on the hardware type.
14. Click Apply.
Note: Some wireless cards have "Infrastructure" and "Ad-hoc" modes. These modes
are also called "Access Point" and "Peer to Peer". On the wireless client, choose the
"Infrastructure" or "Access Point" mode.
316
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
You can set the wireless cards to either "Long Preamble" or "Short Preamble".
Configuring Wireless Distribution System Links
You can extend the wireless network across multiple access points, or connect the networks
behind different access points, by creating a Wireless Distribution System (WDS). To create
a WDS, you must add WDS links between the desired access points.
For more information on WDS links, see Overview on page 285.
Note: While WDS links can have different security settings, all WDS links inherit the
following wireless settings from the primary WLAN:

Country

Operation Mode

Channel

Transmission Rate

Transmitter Power

Antenna Selection

Security
For information on configuring these settings in the primary WLAN, see Manually
Configuring a Wireless Network on page 301.
Note: To enable WDS links, you must first enable the primary WLAN network. If you
disable the primary WLAN network, all WDS links are automatically disabled.
The procedure below explains how to add or edit a WDS link. For information on deleting a
WDS link, see Deleting VLANs on page 207.
To add or edit a WDS link
1.
Configure the primary WLAN as follows:
a) Enable the primary WLAN.
b) If using UTM-1Edge NW, enable WDS links.
For information on configuring these settings, see Manually Configuring a Wireless
Network on page 301.
Chapter 10: Working with Wireless Networks
317
Configuring Wireless Networks
2.
Click Network in the main menu, and click the My Network tab.
The My Network page appears.
3.
Click Add Network.
The Edit Network Settings page appears.
4.
In the Network Name field, type a name for the WDS link.
5.
In the Type drop-down list, select Wireless Distribution System.
New fields appear.
The fields that appear depend on the hardware type.
6.
In the Peer WLAN MAC Address field, type the WLAN MAC address of the
access point to which you want to create a WDS link.
Note: This is the MAC address of the WLAN interface, not the WAN MAC address. To
see your access point's WLAN MAC address, click Reports in the main menu, and then
click Wireless.
7.
Do one of the following:

318
To create a bridged WDS link:
Check Point UTM-1 Embedded NGX User Guide
Configuring Wireless Networks
8.
1) In the Mode drop-down list, select Bridged.
The fields are enabled and additional fields appear.
2) Complete these fields as described in Bridged Network Fields on
page 254.
 To create a routed WDS link, do the following:
1) In the Mode drop-down list, select Enabled.
The fields are enabled.
2) In the IP Address field, type the IP address of the WDS link's default
gateway.
The WDS link must not overlap other networks.
3) In the Subnet Mask field, type the WDS link's internal network range.
If desired, enable or disable Hide NAT.
See Enabling/Disabling Hide NAT on page 185.
9.
If desired, configure a DHCP server.
See Configuring a DHCP Server on page 186.
10. Complete the fields using the relevant information in Basic Wireless Settings
Fields on page 304.
11. To configure advanced settings, click Show Advanced Settings and complete the
fields using the relevant information in Advanced Wireless Settings Fields on
page 309.
Chapter 10: Working with Wireless Networks
319
Configuring Wireless Networks
New fields appear.
The fields that appear depend on the hardware type.
12. Click Apply.
Note: Both sides of the WDS link must use the same radio channel and security
settings.
Note: The access point can use any supported security protocol to communicate with
wireless stations.
320
Check Point UTM-1 Embedded NGX User Guide
Troubleshooting Wireless Connectivity
Troubleshooting Wireless Connectivity
I cannot connect to a wireless network from a wireless station. What should I do?
 Check that the SSID configured on the station matches the UTM-1 appliance's
SSID. The SSID is case-sensitive.

Check that the encryption settings configured on the station (encryption mode and
keys) match the UTM-1 appliance's encryption settings.

If MAC filtering is enabled, verify that the MAC address of all stations is listed in
the Network Objects page (see Viewing and Deleting Network Objects on page
219).

Check that the wireless card region matches the access point region.

Check the wireless card supports the wireless standard that you configured.
I cannot connect to an access point over a WDS link. What should I do?
 Check that both sides of the WDS link are configured with their peer's WLAN
MAC address (and not the WAN MAC address).

Check that both sides of the WDS link are configured to use the same radio
channel and security settings.

Make sure that the peer access points are not too far apart for proper reception.
How do I test wireless reception?
 Look at the Wireless page, and check for excessive errors or dropped packets.

Look at the My Computers page, to see information for specific wireless stations,
such as the number of transmission errors, and the current reception power of each
station.

On the wireless station, open a command window and type ping my.firewall. If you
see a large number of dropped packets, you are experiencing poor reception.
Wireless reception is poor. What should I do?
 Adjust the angle of the antennas, until the reception improves. The antennas
radiate horizontally in all directions.

If both antennas are connected to the UTM-1 appliance, check that the Antenna
Selection parameter in the primary WLAN's advanced settings is set to Automatic
(see Manually Configuring a Wireless Network on page 301).
Chapter 10: Working with Wireless Networks
321
Troubleshooting Wireless Connectivity

Relocate the UTM-1 appliance to a place with better reception, and avoid
obstructions, such as walls and electrical equipment. For example, try mounting
the appliance in a high place with a direct line of sight to the wireless stations.

Check for interference with nearby electrical equipment, such as microwave
ovens and cordless or cellular phones.

Check the Transmission Power parameter in the primary WLAN's advanced
settings.

Make sure that you are not using two access points in close proximity and on the
same frequency. For minimum interference, channel separation between nearby
access points must be at least 25 MHz (5 channels).

The UTM-1 appliance supports XR (Extended Range) technology. For best range,
enable XR mode in the wireless network's advanced settings, and use XR-enabled
stations.

Range outdoors is normally much higher than indoors, depending on
environmental conditions.
Note: You can observe any changes in the wireless reception in the My Computers page.
Make sure to refresh the page after making a change.
Note: Professional companies are available for help in setting up reliable wireless
networks, with access to specialized testing equipment and procedures.
There are excessive collisions between wireless stations. What should I do?
If you have many concurrently active wireless stations, there may be collisions between
them. Such collisions may be the result of a "hidden node" problem: not all of the stations are
within range of each other, and therefore are "hidden" from one another. For example, if
station A and station C do not detect each other, but both stations detect and are detected by
station B, then both station A and C may attempt to send packets to station B simultaneously.
In this case, the packets will collide, and Station B will receive corrupted data.
The solution to this problem lies in the use of the RTS protocol. Before sending a certain size
IP packet, a station sends an RTS (Request To Send) packet. If the recipient is not currently
receiving packets from another source, it sends back a CTS (Clear To Send) packet,
indicating that the station can send the IP packet. Try setting the RTS Threshold parameter in
the wireless network's advanced settings to a lower value. This will cause stations to use
RTS for smaller IP packets, thus decreasing the likeliness of collisions.
322
Check Point UTM-1 Embedded NGX User Guide
Troubleshooting Wireless Connectivity
In addition, try setting the Fragmentation Threshold parameter in the wireless network's
advanced settings to a lower value. This will cause stations to fragment IP packets of a
certain size into smaller packets, thereby reducing the likeliness of collisions and increasing
network speed.
Note: Reducing the RTS Threshold and the Fragmentation Threshold too much can
have a negative impact on performance.
Note: Setting an RTS Threshold value equal to the Fragmentation Threshold value
effectively disables RTS.
I am not getting the full speed. What should I do?
 The actual speed is always less than the theoretical speed, and degrades with
distance.

Read the section about reception problems. Better reception means better speed.

Check that all your wireless stations support the wireless standard you are using
(802.11g or 802.11g Super), and that this standard is enabled in the station
software. Transmission speed is determined by the slowest station associated with
the access point. For a list of wireless stations that support 802.11g Super, see
www.super-ag.com.
Chapter 10: Working with Wireless Networks
323
Viewing the UTM-1 Appliance Status
Chapter 11
Viewing Reports
This chapter describes the UTM-1 Portal reports.
This chapter includes the following topics:
Viewing the UTM-1 Appliance Status ..................................................... 325
Using the Traffic Monitor.........................................................................330
Viewing Computers .................................................................................. 333
Viewing Connections ............................................................................... 336
Viewing Network Statistics ......................................................................337
Viewing the Routing Table.......................................................................348
Viewing Wireless Station Statistics .......................................................... 350
Viewing the UTM-1 Appliance Status
The UTM-1 Status Monitor provides a snapshot of the UTM-1 appliance's current status,
enabling you to view the following information in a single glance:

General appliance information

Appliance module statuses

Appliance port statuses

Resource utilization information

Recent logged events
To view the UTM-1 appliance's current status
1.
Click Reports in the main menu, and click the Status tab.
Chapter 11: Viewing Reports
325
Viewing the UTM-1 Appliance Status
The Status Monitor page appears.
The page displays the information in the following table.
2.
To refresh the display, click Refresh.
Table 59: Status Monitor Fields

Device Information: Information about the UTM-1 appliance.
Product: The licensed software and the number of allowed nodes.
MAC Address: The UTM-1 appliance's WAN MAC address.
Firmware: The currently installed firmware:
 Main. The version of the primary firmware
 Backup. The version of the backup firmware
Uptime: The time that elapsed from the moment the unit was turned on

System: A diagram of the UTM-1 appliance's ports, indicating the ports' statuses.
Ports that are currently in use appear in green.

Cellular Modems: Information about connected cellular modems, including the
following:
326
Check Point UTM-1 Embedded NGX User Guide
Viewing the UTM-1 Appliance Status


An icon indicating whether the modem is connected to the Internet (
) or not
( )
 The modem model name
 The modem's access technology
 A bar graph indicating the current signal strength
 The cellular operator’s name
You can mouse over the field to view the modem manufacturer, model number, and
access technology value, and current signal strength in dBm.
Status: Information about the UTM-1 appliance's status.
Internet: The UTM-1 appliance's overall Internet connection status. This can be any of
the following:
Icon
Description
OK. One or both Internet connections are connected.
Idle. Both Internet connections are in ―idle‖ state.
Disabled. Both Internet connections are disabled.
Connected with problems. One Internet connection is connected,
and the other Internet connection is in ―Establishing
Connection‖ state.
No connectivity. All enabled Internet connections are in
―Establishing Connection‖ state.
For information on individual Internet connections' statuses, see Status Bar on page
111.
VPN: The UTM-1 appliance's VPN tunnel status. This can be any of the following:
Chapter 11: Viewing Reports
327
Viewing the UTM-1 Appliance Status
Icon
Description
No tunnels connected. There are no open VPN tunnels.
Tunnels are established. There are open VPN tunnels.
Some permanent tunnels are down. Some permanent VPN tunnels
are currently down. To view VPN tunnels, click on the link.
Antivirus: The UTM-1 appliance's VStream Antivirus status. This can be any of the
following:
Icon
Description
Antivirus enabled. VStream Antivirus is enabled.
Antivirus disabled. VStream Antivirus is disabled.
Antivirus
Services: The UTM-1 appliance's Service Center connection status. This can be any of
the following:
Icon
Description
Connected. The UTM-1 appliance is connected to the Service
Center, and security services are active.
Firmware download: x% completed. The UTM-1 appliance is
currently downloading a firmware file from the Service Center.
The download is x% complete.
Disabled. You are not subscribed to a Service Center.
Expired. Your subscription to security services has expired.
328
Check Point UTM-1 Embedded NGX User Guide
Viewing the UTM-1 Appliance Status
Failed to connect. The UTM-1 appliance failed to connect to the
Service Center.
HA: The UTM-1 appliance's High Availability status. This can be any of the following:
Icon
Description
Passive. High Availability is enabled, and this appliance is a
Passive Gateway.
Master. High Availability is enabled, and this appliance is the
Active Gateway.
Disabled. High Availability is disabled.

Resource Utilization: UTM-1 appliance resource utilization information.
A bar graph next to each resource indicates the amount currently consumed.
Kernel Mem: The percentage of used memory in the kernel module, followed by the
amount in kilobytes.
User Mem: The percentage of used memory in the user module, followed by the amount
in kilobytes.
FW Mem: The percentage of used memory in the firewall module, followed by the
amount in kilobytes.
System Mem: The percentage of system memory in use, followed by the amount in
kilobytes.
Configuration: The percentage of configuration storage space in use out of the total
amount of space allocated for configuration storage, followed by the amount in
kilobytes.
CPU: The percentage of CPU in use.
Connections: The percentage of established connections out of the licensed number of
connections, followed by the number of established connections.
Chapter 11: Viewing Reports
329
Using the Traffic Monitor
VPN Tunnels: The percentage of established VPN tunnels out of the licensed number of
VPN tunnels, followed by the number of established VPN tunnels.
Nodes: The percentage of nodes in use out of the licensed number of nodes, followed by
the number of nodes in used.

Last Events: The last five messages logged to the Event Log.
Using the Traffic Monitor
You can view incoming and outgoing traffic for selected network interfaces and QoS classes
using the Traffic Monitor. This enables you to identify network traffic trends and anomalies,
and to fine tune Traffic Shaper QoS class assignments.
The Traffic Monitor displays separate bar charts for incoming traffic and outgoing traffic,
and displays traffic rates in kilobits/second. If desired, you can change the number of
seconds represented by the bars in the charts, using the procedure Configuring Traffic
Monitor Settings on page 332.
In network traffic reports, the traffic is color-coded as described in the following table. In the
All QoS Classes report, the traffic is color-coded by QoS class.
Table 60: Traffic Monitor Color Coding for Networks
Traffic marked in this color…
Indicates…
Blue
VPN-encrypted traffic
Red
Traffic blocked by the firewall
Green
Traffic accepted by the firewall
You can export a detailed traffic report for all enabled networks and all defined QoS classes,
using the procedure Exporting General Traffic Reports on page 332.
330
Check Point UTM-1 Embedded NGX User Guide
Using the Traffic Monitor
Viewing Traffic Reports
To view a traffic report
1.
Click Reports in the main menu, and click the Traffic tab.
The Traffic Monitor page appears.
2.
In the Traffic Monitor Report drop-down list, select the network interface for
which you want to view a report.
The list includes all currently enabled networks. For example, if the DMZ network is
enabled, it will appear in the list.
If Traffic Shaper is enabled, the list also includes the defined QoS classes. Choose All
QoS Classes to display a report including all QoS classes. For information on enabling
Traffic Shaper see Using Internet Setup on page 131.
The selected report appears in the Traffic Monitor page.
3.
To refresh all traffic reports, click Refresh.
4.
To clear all traffic reports, click Clear.
Chapter 11: Viewing Reports
331
Using the Traffic Monitor
Note: The firewall blocks broadcast packets used during the normal operation of your
network. This may lead to a certain amount of traffic of the type "Traffic blocked by
firewall" that appears under normal circumstances and usually does not indicate an
attack.
Exporting General Traffic Reports
You can export a general traffic report that includes information for all enabled networks
and all defined QoS classes to a *.csv (Comma Separated Values) file. You can open and
view the file in Microsoft Excel.
To export a general traffic report
1.
Click Reports in the main menu, and click the Traffic tab.
The Traffic Monitor page appears.
2.
Click Export.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the configuration file and click Save.
A *.csv file is created and saved to the specified directory.
Configuring Traffic Monitor Settings
You can configure the interval at which the UTM-1 appliance should collect traffic data for
network traffic reports.
To configure Traffic Monitor settings
1.
332
Click Reports in the main menu, and click the Traffic tab.
Check Point UTM-1 Embedded NGX User Guide
Viewing Computers
The Traffic Monitor page appears.
2.
Click Settings.
The Traffic Monitor Settings page appears.
3.
In the Sample monitoring data every field, type the interval (in seconds) at which
the UTM-1 appliance should collect traffic data.
The default value is one sample every 1800 seconds (30 minutes).
4.
Click Apply.
Viewing Computers
This option allows you to view the currently active computers on your network. The
computers are graphically displayed, each with its name, IP address, and settings (DHCP,
Static, etc.). You can also view node limit information.
To view the computers
1.
Click Reports in the main menu, and click the My Computers tab.
Chapter 11: Viewing Reports
333
Viewing Computers
The Active Computers page appears.
If you configured High Availability, both the master and backup appliances are shown.
If you configured OfficeMode, the OfficeMode network is shown.
If there are wireless networks, the wireless stations are shown under the network to
which they are connected. For information on viewing statistics for these computers, see
Viewing Wireless Station Statistics on page 350. If a wireless station has been blocked
from accessing the Internet through the UTM-1 appliance, the reason why it was
blocked is shown in red.
If a network is bridged, the bridge's name appears in parentheses next to the network's
name.
If you are exceeding the maximum number of computers allowed by your license, a
warning message appears, and the computers over the node limit are marked in red.
These computers are still protected, but they are blocked from accessing the Internet
through the UTM-1 appliance.
Note: Computers that did not communicate through the firewall are not counted for
node limit purposes, even though they are protected by the firewall and appear in the
Active Computers table.
334
Check Point UTM-1 Embedded NGX User Guide
Viewing Computers
Note: To increase the number of computers allowed by your license, you can upgrade
your product. For further information, see Upgrading Your Software Product on
page 675.
If Secure HotSpot is enabled for some networks, each computer's HotSpot status is
displayed next to it. The possible statuses include:



Authenticated. The computer is logged in to My HotSpot.
Not Authenticated. The computer is not logged in to My HotSpot.
Excluded from HotSpot. The computer is in an IP address range excluded from
HotSpot enforcement. To enforce HotSpot, you must edit the network object.
See Adding and Editing Network Objects on page 211.
If Remote Desktop is enabled, a link appears next to each computer, enabling you to
access its desktop remotely. For information on using Remote Desktop, see Using
Remote Desktop on page 655.
Next to each computer, an Add button enables you to add a network object for the
computer, or an Edit button enables you to edit an existing network object for the
computer. For information on adding and editing network objects, see Adding and
Editing Network Objects on page 211.
2.
To refresh the display, click Refresh.
3.
To view node limit information, do the following:
a.
Click Node Limit.
The Node Limit window appears with installed software product and the number of
nodes used.
b.
Click Close to close the window.
Chapter 11: Viewing Reports
335
Viewing Connections
Viewing Connections
This option allows you to view currently active connections between your networks, as well
as those from your networks to the Internet.
Note: The report does not display connections between bridged networks, where
Firewall Between Members is disabled.
To view the active connections
1.
Click Reports in the main menu, and click the Connections tab.
The Connections page appears.
The page displays the information in the following table.
2.
To view information about a destination machine, click its IP address.
The UTM-1 appliance queries the Internet WHOIS server, and a window displays the
name of the entity to which the IP address is registered and their contact information.
3.
To view information about a destination port, click the port.
A window opens displaying information about the port.
336
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
4.
To resize a column, drag the relevant column divider right or left.
5.
To refresh the display, click Refresh.
Table 61: Connections Fields
This field…
Displays…
Protocol
The protocol used (TCP, UDP, and so on)
Source IP
The source IP address.
Port
The source port
Destination IP
The destination IP address.
Port
The destination port.
QoS Class
The QoS class to which the connection belongs (if Traffic Shaper is
enabled)
Options
An icon indicating further details:

- The connection is encrypted.

- The connection is being scanned by VStream Antivirus.

- The connection is being scanned by VStream Antispam.
Viewing Network Statistics
You can view statistics for each of the UTM-1 appliance's Internet connections, internal
networks and bridges, using the Network Interface Monitor.
Chapter 11: Viewing Reports
337
Viewing Network Statistics
Viewing General Network Statistics
You can view general statistics for the UTM-1 appliance's network interfaces.
To view general network statistics
1.
Click Reports in the main menu, and click the Networks tab.
The Networks page appears displaying general network statistics. For information on
the fields, see the following table.
2.
To refresh the display, click Refresh.
Table 62: General Network Statistics
This field…
Displays…
Total Networks
The total number of internal networks.
Total Sent
The total number of sent packets on all network interfaces.
338
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
This field…
Displays…
Total Received
The total number of received packets on all network interfaces.
Viewing Internet Connection Statistics
You can view statistics for the primary and secondary Internet connections.
To view statistics for an Internet connection
1.
Click Reports in the main menu, and click the Networks tab.
The Networks page appears.
2.
In the tree, click on the Internet connection.
The page displays statistics for the Internet connection. The following example shows
statistics for the primary Internet connection.
For information on the fields, see the following table.
3.
To refresh the display, click Refresh.
Chapter 11: Viewing Reports
339
Viewing Network Statistics
Table 63: Internet Connection Statistics
This field…
Displays…
Type
The Internet connection's type
Status
The Internet connection's status
IP Address
The appliance's current IP address on the network interface
MAC Address
The appliance's MAC address on the network interface
Internet
Mode
The Internet connection method used
Connected
The connection duration, in the format hh:mm:ss, where:
hh=hours
mm=minutes
ss=seconds
Remote IP
Address
The IP address of the PPP peer.
This field is only relevant for PPP-based Internet connections.
Connection Probing
Probing Method
The connection probing method configured for the Internet connection
ADSL
These fields only appear for ADSL connections.
Standard
The DSL line's standard
Annex
The UTM-1 ADSL model (Annex A, Annex B)
Self Test
Indicates whether DSL modem has passed a self-test
Trellis Coding
The DSL line's trellis coding
340
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
This field…
Displays…
Framing Structure
The DSL line's framing structure
Line Rate
The line rate for transmission (TX) and reception (RX) in kbps
ADSL Firmware
The installed ADSL firmware
ADSL Firmware
The installed backup ADSL firmware
[Backup]
RF status
These fields only appear for ADSL connections.
Tx Power
The local and remote transmission power in dB
SNR Margin
The local and remote Signal to Noise Ration (SNR) margin in dB.
The SNR margin is the difference between the amount of noise received by
the local/remote line end, and the amount of noise it can tolerate.
Line Attenuation
The local and remote line attenuation in dB.
The line attenuation is the difference between the signal power transmitted to
the local/remote line end, and that which it received.
Modem
These fields only appear if a cellular modem is connected.
Manufacturer
The modem manufacturer
Model
The modem model
Revision
The modem revision
Serial
The modem serial number
Operator
The cellular operator
Signal Strength
The current signal strength in dB
Chapter 11: Viewing Reports
341
Viewing Network Statistics
This field…
Displays…
BER
The bit error rate
Access
The access technology used
Technology
Statistics
Statistics only appear if the Internet connection is connected
Packets
The total number of transmitted and received packets
Errors
The total number of transmitted and received packets for which an error
occurred
Dropped
The total number of transmitted and received packets that the firewall
dropped
Overruns
The total number of transmitted and received packets that were lost,
because they were sent or arrived more quickly that the appliance could
handle
Frame/Carrier
The total number of frame alignment and carrier errors.
Frame alignment errors occur when a frame that has extra bits is received.
The number of such errors appears in the Received column.
Carrier errors occur when the carrier is not present at the start of data
transmission, or when the carrier is lost during transmission. Such errors
usually indicate a problem with the cable. The number of such errors
appears in the Transmitted column.
Viewing Wired Network Statistics
You can view statistics for wired network interfaces, including the LAN, DMZ,
OfficeMode, tag-based VLANs, and port-based VLANs.
342
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
To view statistics for a wired network
1.
Click Reports in the main menu, and click the Networks tab.
The Networks page appears.
2.
In the tree, click on the wired network.
The page displays statistics for the network. The following example shows statistics for
the LAN. For information on the fields, see the following table.
3.
To refresh the display, click Refresh.
Table 64: Wired Network Statistics
This field…
Displays…
Type
The network's type.
Status
The network's current status (Enabled/Disabled).
IP Address
The appliance's current IP address on the network interface.
MAC Address
The appliance's MAC address on the network interface.
Chapter 11: Viewing Reports
343
Viewing Network Statistics
This field…
Displays…
Statistics
Statistics only appear if the network is enabled
Packets
The total number of transmitted and received packets
Errors
The total number of transmitted and received packets for which an error
occurred
Dropped
The total number of transmitted and received packets that the firewall
dropped
Overruns
The total number of transmitted and received packets that were lost,
because they were sent or arrived more quickly that the appliance could
handle
Frame/Carrier
The total number of frame alignment and carrier errors.
Frame alignment errors occur when a frame that has extra bits is received.
The number of such errors appears in the Received column.
Carrier errors occur when the carrier is not present at the start of data
transmission, or when the carrier is lost during transmission. Such errors
usually indicate a problem with the cable. The number of such errors
appears in the Transmitted column.
Viewing Wireless Network Statistics
If the primary WLAN is enabled, you can view wireless statistics for the primary WLAN
and VAPs.
To view statistics for the primary WLAN and VAPs
1.
Click Reports in the main menu, and click the Networks tab.
The Networks page appears.
344
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
2.
In the tree, click on the wireless network's name.
The page displays statistics for the network. For information on the fields, see the
following table.
3.
To refresh the display, click Refresh.
Table 65: Wireless Statistics
This field…
Displays…
Type
The network's type, in this case "Wireless"
Status
The network's current status (Enabled/Disabled)
IP Address
The IP address of the wireless network's default gateway
MAC Address
The MAC address of the wireless network interface
Wireless
Wireless Mode
The operation mode used by the WLAN, followed by the transmission rate in
Mbps
Chapter 11: Viewing Reports
345
Viewing Network Statistics
This field…
Displays…
Domain
The UTM-1 access point's region
Country
The country configured for the WLAN
Channel
The radio frequency used by the WLAN
Security
The security mode used by the wireless network
Statistics
Statistics only appear if the network is enabled
Frames OK
The total number of frames that were successfully transmitted and received
Errors
The total number of transmitted and received frames for which an error
occurred
Wrong
The total number of received packets that were dropped, because they were
NWID/ESSID
destined for another access point
Invalid Encryption
The total number of transmitted and received packets with the wrong
Key
encryption key
Missing Fragments
The total number of packets missed during transmission and reception that
were dropped, because fragments of the packet were lost
Discarded Retries
The total number of discarded retry packets that were transmitted and
received
Discarded Misc
The total number of transmitted and received packets that were discarded for
other reasons
Viewing Bridge Statistics
You can view statistics for bridges.
346
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Statistics
To view statistics for a bridge
1.
Click Reports in the main menu, and click the Networks tab.
The Networks page appears.
2.
In the tree, click on the bridge.
The page displays statistics for the bridge. For information on the fields, see the
following table.
3.
To view statistics for bridged networks, in the tree, expand the bridge's node.
The page displays statistics for the bridged network.
4.
To refresh the display, click Refresh.
Table 66: Bridge Statistics
This field…
Displays…
Type
The network's type, in this case "Bridge"
IP Address
The appliance's current IP address on the bridge interface
Chapter 11: Viewing Reports
347
Viewing the Routing Table
This field…
Displays…
Statistics
Statistics only appear if the bridge is enabled
Packets
The total number of transmitted and received packets
Errors
The total number of transmitted and received packets for which an error
occurred
Dropped
The total number of transmitted and received packets that the firewall
dropped
Overruns
The total number of transmitted and received packets that were lost,
because they were sent or arrived more quickly that the appliance could
handle
Frame/Carrier
The total number of frame alignment and carrier errors.
Frame alignment errors occur when a frame that has extra bits is received.
The number of such errors appears in the Received column.
Carrier errors occur when the carrier is not present at the start of data
transmission, or when the carrier is lost during transmission. Such errors
usually indicate a problem with the cable. The number of such errors
appears in the Transmitted column.
Viewing the Routing Table
This option allows you to view the routing table currently in effect on the UTM-1 appliance.
To view the current routing table
1.
348
Click Reports in the main menu, and click the Routing tab.
Check Point UTM-1 Embedded NGX User Guide
Viewing the Routing Table
The Routing Table page appears.
The page displays the information in the following table.
2.
To resize a column, drag the relevant column divider right or left.
3.
To refresh the display, click Refresh.
Table 67: Routing Table Fields
This field…
Displays…
Source
The route's source
Destination
The route's destination
Service
The network service for which the route is configured
Gateway
The gateway's IP address
Metric
The route's metric
Interface
The interface for which the route is configured
Origin
The route's type:

Connected Route. A route to a network that is directly connected
to the UTM-1 appliance
Chapter 11: Viewing Reports
349
Viewing Wireless Station Statistics
This field…
Displays…

Static Route. A destination-based or service-based static route.
See Using Static Routes on page 223.

Dynamic Route. A route obtained through a dynamic routing
protocol, such as OSPF

Source Route. A source-based static route. See Using Static
Routes on page 223.
Viewing Wireless Station Statistics
If the primary WLAN is enabled, you can view wireless statistics for individual wireless
stations.
To view statistics for a wireless station
1.
Click Reports in the main menu, and click the My Computers tab.
The Active Computers page appears.
The following information appears next to each wireless station:
2.
 The signal strength in dB
 A series of bars representing the signal strength
Mouse-over the information icon next to the wireless station.
A tooltip displays statistics for the wireless station, as described in the following table.
3.
To refresh the display, click Refresh.
Table 68: Wireless Station Statistics
This field…
Displays…
Current Rate
The current reception and transmission rate in Mbps
Frames OK
The total number of frames that were successfully transmitted and received
350
Check Point UTM-1 Embedded NGX User Guide
Viewing Wireless Station Statistics
This field…
Displays…
Management
The total number of transmitted and received management packets
Control
The total number of received control packets
Errors
The total number of transmitted and received frames for which an error occurred
Dup ratio
The percentage of frames received more than once.
Cipher
The security protocol used for the wireless connection
QoS
Indicates whether the client is using Multimedia QoS (WMM). Possible values
are:
XR

yes. The client is using WMM.

no. The client is not using WMM.
Indicates whether the wireless client supports Extended Range (XR) mode.
Possible values are:

yes. The wireless client supports XR mode.

no. The wireless client does not support XR mode.
Chapter 11: Viewing Reports
351
Viewing the Event Log
Chapter 12
Viewing Logs
This chapter describes the UTM-1 appliance logs.
This chapter includes the following topics:
Viewing the Event Log .............................................................................353
Viewing the Security Log .........................................................................357
Viewing the Event Log
The Event Log displays general appliance events, including the following:

Authentication attempts

Changes in setup

Internet connection status changes

Errors

Warnings
This information is useful for troubleshooting. You can export the logs to an *.xls (Microsoft
Excel) file, and then store it for analysis purposes or send it to technical support.
Note: You can configure the UTM-1 appliance to send event and security logs to a
Syslog server. For information, see Configuring Syslog Logging on page 678.
To view the event log
1.
Click Logs in the main menu, and click the Event Log tab.
Chapter 12: Viewing Logs
353
Viewing the Event Log
The Event Log page appears.
The log table contains the columns described in Event Log Columns on page 356. The
log messages are color-coded as described in Event Log Color Coding on page 356.
2.
To navigate the log table, do any of the following:

3.
To scroll through the displayed log page:
 Use the scroll bars, or
 Click on a log message and then press the UP and DOWN arrows on your
keyboard.
 To view the next log page, click Next.
 To view the previous log page, click Back.
To specify the number of logs to display per page, in the drop-down list at the
bottom of the log table, select the desired number.
4.
To resize a column, drag the relevant column divider right or left.
5.
To refresh the display, click Refresh.
6.
To save the displayed events to an *.xls file:
a.
354
Click Save.
A standard File Download dialog box appears.
Check Point UTM-1 Embedded NGX User Guide
Viewing the Event Log
Click Save.
The Save As dialog box appears.
c. Browse to a destination directory of your choice.
d. Type a name for the configuration file and click Save.
The *.xls file is created and saved to the specified directory.
To copy log messages, do the following:
b.
7.
a.
Select the desired logs, by clicking in the log table and dragging the cursor.
The selected logs are highlighted in yellow.
b.
8.
Press CTRL+C.
If you are using Internet Explorer, and this is the first time that you copy logs, a
dialog box asks you whether you want to allow the UTM-1 Portal to access your
clipboard. In this case, click Allow access.
The selected logs are copied to your clipboard.
To clear all displayed events:
a.
b.
Click Clear.
A confirmation message appears.
Click OK.
All events are cleared.
Chapter 12: Viewing Logs
355
Viewing the Event Log
Table 69: Event Log Columns
This column...
Displays...
No
The log message number
Date
The date on which the event occurred, in the format DD:MM:YYYY,
where:
DD=date
MM=month, in abbreviated form
YYYY=year
Time
The time at which the event occurred, in the format hh:mm:ss, where:
hh=hour
mm=minutes
ss=seconds
Information
A description of the logged event
Table 70: Event Log Color Coding
An event marked in
Indicates…
this color…
Red
An error message
Orange
A warning message
Blue
An informational message
356
Check Point UTM-1 Embedded NGX User Guide
Viewing the Security Log
Viewing the Security Log
The Security Log displays security-related events, including the following:

Connections logged by firewall rules

Connections logged by VStream Antivirus

Connection logged by VStream Antispam

Security events logged by SmartDefense

Web sites blocked by Web rules or the centralized Web Filtering service
This information is useful for troubleshooting. You can export the logs to an *.xls (Microsoft
Excel) file, and then store it for analysis purposes or send it to technical support.
Note: You can configure the UTM-1 appliance to send event and security logs to a
Syslog server. For information, see Configuring Syslog Logging on page 678.
To view the security log
1.
Click Logs in the main menu, and click the Security Log tab.
Chapter 12: Viewing Logs
357
Viewing the Security Log
The Security Log page appears.
The log table contains the columns described in Security Log Columns on page 360.
The log messages are color-coded as described in Security Log Color Coding on page
362.
2.
To display information about a connection source or destination, click the
relevant IP address.
The UTM-1 appliance queries the Internet WHOIS server, and a window displays the
name of the entity to whom the IP address is registered and their contact information.
This information is useful in tracking down hackers.
3.
To view information about a destination port, click the port.
A window opens displaying information about the port.
4.
To navigate the log table, do any of the following:


358
To scroll through the displayed log page:
 Use the scroll bars, or
 Click on a log message and then press the UP and DOWN arrows on your
keyboard.
To view the next log page, click Next.
Check Point UTM-1 Embedded NGX User Guide
Viewing the Security Log
5.
 To view the previous log page, click Back.
To specify the number of logs to display per page, in the drop-down list at the
bottom of the log table, select the desired number.
6.
To resize a column, drag the relevant column divider right or left.
7.
To refresh the display, click Refresh.
8.
To save the displayed events to an *.xls file:
Click Save.
A standard File Download dialog box appears.
b. Click Save.
The Save As dialog box appears.
c. Browse to a destination directory of your choice.
d. Type a name for the configuration file and click Save.
The *.xls file is created and saved to the specified directory.
To copy log messages, do the following:
a.
9.
a.
Select the desired logs, by clicking in the log table and dragging the cursor.
The selected logs are highlighted in yellow.
b.
Press CTRL+C.
Chapter 12: Viewing Logs
359
Viewing the Security Log
If you are using Internet Explorer, and this is the first time that you copy logs, a
dialog box asks you whether you want to allow the UTM-1 Portal to access your
clipboard. In this case, click Allow access.
The selected logs are copied to your clipboard.
10. To clear all displayed events:
a.
b.
Click Clear.
A confirmation message appears.
Click OK.
All events are cleared.
Table 71: Security Log Columns
This column...
Displays...
No
The log message number
Date
The date on which the action occurred, in the format DD:MM:YYYY,
where:
DD=date
MM=month, in abbreviated form
YYYY=year
Time
The time at which the action occurred, in the format hh:mm:ss, where:
hh=hour
mm=minutes
ss=seconds
Dir
An icon indicating the direction of the connection on which the firewall
acted. This can be one of the following:
360

Incoming connection

Outgoing connection
Check Point UTM-1 Embedded NGX User Guide
Viewing the Security Log
This column...
Displays...

Act
Internal connection
An icon indicating the action that the firewall performed on a
connection. For a list of Actions icons, see Security Log Actions on
page 361.
Source
The IP address of the connection's source.
Port
The source port used for the connection.
Destination
The IP address of the connection's destination.
Service
The protocol and destination port used for the connection.
Reason
The reason the action was logged.
Rule
The number of the firewall rule that was executed.
Net
The internal network where the action occurred.
Information
Additional information about the logged action.
Table 72: Security Log Actions
Action
Icon
Description
Connection Accepted
The firewall accepted a connection.
Connection Decrypted
The firewall decrypted a connection.
Connection Dropped
The firewall dropped a connection.
Connection Encrypted
The firewall encrypted a connection.
Connection Rejected
The firewall rejected a connection.
Chapter 12: Viewing Logs
361
Viewing the Security Log
Action
Connection Monitored
Icon
Description
A security event was monitored; however, it was not blocked,
due to the current configuration.
URL Allowed
The firewall allowed a URL.
URL Filtered
The firewall blocked a URL.
Virus Detected
A virus was detected in an email.
Potential Spam Stamped
An email was marked as potential spam.
Potential Spam Detected
An email was rejected as potential spam.
Mail Allowed
A non-spam email was logged.
Blocked by VStream
VStream Antivirus blocked a connection.
Antivirus
Table 73: Security Log Color Coding
An event marked in
Indicates…
this color…
Red
Connection attempts that were blocked by your firewall, by a security
policy downloaded from your Service Center, or by user-defined rules.
Orange
Traffic detected as suspicious, but accepted by the firewall.
For example, if a SmartDefense protection's Action field is set to "Track"
instead of "Block", and a connection triggers this protection, the
connection is accepted and logged in orange.
362
Check Point UTM-1 Embedded NGX User Guide
Viewing the Security Log
An event marked in
Indicates…
this color…
Green
Traffic accepted by the firewall.
By default, accepted traffic is not logged. However, such traffic may be
logged if specified by a security policy downloaded from your Service
Center, or if specified in user-defined rules.
Chapter 12: Viewing Logs
363
Viewing the Security Log
Chapter 13
Setting Your Security Policy
This chapter describes how to set up your UTM-1 appliance security policy.
You can enhance your security policy by subscribing to services such as Web Filtering and
Email Filtering. You can also integrate all UTM-1 appliances into an overall enterprise
security policy by connecting to SMART management.
Note: When the firewall is managed by SmartCenter, the SmartCenter security policy
replaces the default security policy and the firewall security levels. The firewall security
level is set to High and cannot be changed.
Note: Local security rules take precedence over rules configured by the central
management.
For information on subscribing to services and SMART Management, see SMART
Management and Subscription Services on page 553.
Chapter 13: Setting Your Security Policy
365
The UTM-1 Firewall Security Policy
This chapter includes the following topics:
The UTM-1 Firewall Security Policy ...................................................... 366
Default Security Policy ............................................................................ 367
Setting the Firewall Security Level ......................................................... 368
Configuring Servers ................................................................................. 371
Using Rules ............................................................................................. 374
Using Port-Based Security ....................................................................... 386
Using Secure HotSpot.............................................................................. 391
Using NAT Rules .................................................................................... 396
Using the EAP Authenticator .................................................................. 404
The UTM-1 Firewall Security Policy
What Is a Security Policy?
A security policy is a set of rules that defines your security requirements, including (but not
limited to) network security. By themselves, the network security-related rules comprise the
network security policy.
When configured with the necessary network security rules, the UTM-1 appliance serves as
the enforcement agent for your network security policy. Therefore, the UTM-1 appliance's
effectiveness as a security solution is directly related to the network security policy's
content.
Security Policy Implementation
The key to implementing a network security policy is to understand that a firewall is simply
a technical tool that reflects and enforces a network security policy for accessing network
resources.
A rule base is an ordered set of individual network security rules, against which each
attempted connection is checked. Each rule specifies the source, destination, service, and
action to be taken for each connection. A rule also specifies how a communication is
tracked, logged, and displayed. In other words, the rule base is the implementation of the
security policy.
366
Check Point UTM-1 Embedded NGX User Guide
Default Security Policy
Security Policy Enforcement
The UTM-1 appliance uses the unique, patented INSPECT engine to enforce the configured
security policy and to control traffic between networks. The INSPECT engine examines all
communication layers and extracts only the relevant data, enabling highly efficient
operation, support for a large number of protocols and applications, and easy extensibility to
new applications and services.
Planning the UTM-1 Firewall Security Policy
Before creating a security policy for your system, answer the following questions:

Which services, including customized services and sessions, are allowed across
the network?

Which user permissions and authentication schemes are needed?

Which objects are in the network? Examples include gateways, hosts, networks,
routers, and domains.

Which network objects can connect to others, and should the connections be
encrypted?

What should be the event logging policy?

Which Quality of Service (QoS) classes will you need?
Default Security Policy
The UTM-1 default security policy includes the following rules:

Access is blocked from the WAN (Internet) to all internal networks (LAN, DMZ,
primary WLAN, VLANs, VAPs, and OfficeMode).

Access is allowed from the internal networks to the WAN, according to the
firewall security level (Low/Medium/High).

Access is allowed from the LAN network to the other internal networks (DMZ,
primary WLAN, VLANs, VAPs, and OfficeMode).

Access is blocked from the DMZ, primary WLAN, VLAN, VAP, and
OfficeMode networks to the other internal networks, (including between different
VLANs and VAPs).
Chapter 13: Setting Your Security Policy
367
Setting the Firewall Security Level

HTTPS access to the UTM-1 Portal (my.firewall, my.hotspot, and my.vpn) is
allowed from all internal networks.

HTTP access to the UTM-1 Portal (my.firewall, my.hotspot, and my.vpn) is
allowed from all internal networks except the WLAN and VAPs. You can allow
HTTP access from the primary WLAN and VAPs by creating a specific
user-defined firewall rule.

When using the print server function (see Using Network Printers on page 721),
access from internal networks to connected network printers is allowed.

Access from the WAN to network printers is blocked.
These rules are independent of the firewall security level.
You can easily override the default security policy, by creating user-defined firewall rules.
For further information, see Using Rules on page 374.
Setting the Firewall Security Level
The firewall security level can be controlled using a simple lever available on the Firewall
page. You can set the lever to the following states.
Table 74: Firewall Security Levels
This
Does this…
Further Details
Enforces basic control on
All inbound traffic is blocked to the external UTM-1
incoming connections, while
appliance IP address, except for ICMP echoes
permitting all outgoing
("pings").
level…
Low
connections.
368
All outbound connections are allowed.
Check Point UTM-1 Embedded NGX User Guide
Setting the Firewall Security Level
This
Does this…
Further Details
Enforces strict control on all
All inbound traffic is blocked.
level…
Medium
incoming connections, while
permitting safe outgoing
connections.
All outbound traffic is allowed to the Internet except
for Windows file sharing (NBT ports 137, 138, 139
and 445).
This is the default level and
is recommended for most
cases. Leave it unchanged
unless you have a specific
need for a higher or lower
security level.
High
Enforces strict control on all
incoming and outgoing
connections.
All inbound traffic is blocked.
Restricts all outbound traffic except for the following:
Web traffic (HTTP, HTTPS), email (IMAP, POP3,
SMTP), ftp, newsgroups, Telnet, DNS, IPSEC IKE
and VPN traffic.
Block All
Blocks all access between
All inbound and outbound traffic is blocked between
networks.
the internal networks.
This does not affect traffic to and from the gateway
itself.
The definitions of firewall security levels provided in this table represent the UTM-1
appliance’s default security policy.
You can easily override the default security policy, by creating user-defined firewall rules.
For further information, see Using Rules on page 374.
Note: If the security policy is remotely managed, this lever might be disabled.
Chapter 13: Setting Your Security Policy
369
Setting the Firewall Security Level
Note: Security updates downloaded from a Service Center may alter the security policy
and change these definitions.
To change the firewall security level
1.
Click Security in the main menu, and click the Firewall tab.
The Firewall page appears.
2.
Drag the security lever to the desired level.
The UTM-1 appliance security level changes accordingly.
370
Check Point UTM-1 Embedded NGX User Guide
Configuring Servers
Configuring Servers
Note: If you do not intend to host any public Internet servers in your network (such as a
Web Server, Mail Server, or an exposed host), you can skip this section.
The UTM-1 appliance enables you to configure the following types of public Internet
servers:

Servers for specific services
You can allow all incoming connections of a specific service and forward them to a
particular host in your network. For example, you can set up your own Web server, Mail
server, or FTP server.
Note: Configuring servers is equivalent to creating simple Allow and Forward rules for
common services, where the destination is This Gateway. For information on creating
more complex rules, see Using Rules on page 374.

Exposed host
If you need to allow unlimited incoming and outgoing connections between the Internet
and a particular host, you can define an exposed host. An exposed host is not protected
by the firewall, and it receives all traffic that was not forwarded to another computer by
use of Allow and Forward rules.
Warning: Defining an exposed host is not recommended unless you are fully aware of
the security risks. For example, an exposed host may be vulnerable to hacker attacks.
To allow services to be run on a specific host
1.
Click Security in the main menu, and click the Servers tab.
Chapter 13: Setting Your Security Policy
371
Configuring Servers
The Servers page appears, displaying a list of services and a host IP address for each
allowed service.
2.
Complete the fields using the information in the following table.
3.
Click Apply.
A success message appears.
Table 75: Servers Page Fields
In this column… Do this…
Allow
Select the check box next to the public server you want to configure. This
can be either of the following:
Host IP

A specific service or application (rows 1-9)

An exposed host (row 10)
Type the IP address of the computer that will run the service (one of your
network computers), or click the corresponding This Computer button to allow
your computer to host the service.
VPN Only
372
Select this option to allow only connections made through a VPN.
Check Point UTM-1 Embedded NGX User Guide
Configuring Servers
To stop the forwarding of services to a specific host
1.
Click Security in the main menu, and click the Servers tab.
The Servers page appears.
2.
In the desired server's row, click Clear.
The Host IP field is cleared.
3.
Click Apply.
Chapter 13: Setting Your Security Policy
373
Using Rules
Using Rules
The UTM-1 appliance checks the protocol used, the ports range, and the destination IP
address, when deciding whether to allow or block traffic.
User-defined rules have priority over the default security policy rules and provide you with
greater flexibility in defining and customizing your security policy.
For example, if you assign your company’s accounting department to the LAN network and
the rest of the company to the DMZ network, then as a result of the default security policy
rules, the accounting department will be able to connect to all company computers, while the
rest of the employees will not be able to access any sensitive information on the accounting
department computers. You can override the default security policy rules, by creating
firewall rules that allow specific DMZ computers (such a manager’s computer) to connect to
the LAN network and the accounting department.
The UTM-1 appliance processes user-defined rules in the order they appear in the Rules
table, so that rule 1 is applied before rule 2, and so on. This enables you to define exceptions
to rules, by placing the exceptions higher up in the Rules table.
374
Check Point UTM-1 Embedded NGX User Guide
Using Rules
For example, if you want to block all outgoing FTP traffic, except traffic from a specific IP
address, you can create a rule blocking all outgoing FTP traffic and move the rule down in
the Rules table. Then create a rule allowing FTP traffic from the desired IP address and move
this rule to a higher location in the Rules table than the first rule. In the figure below, the
general rule is rule number 2, and the exception is rule number 1.
The UTM-1 appliance will process rule 1 first, allowing outgoing FTP traffic from the
specified IP address, and only then it will process rule 2, blocking all outgoing FTP traffic.
The following rule types exist:
Table 76: Firewall Rule Types
Rule
Description
Allow and
This rule type enables you to do the following:
Forward

Permit incoming traffic from the Internet to a specific service and
destination IP address in your internal network and then forward all
such connections to a specific computer in your network. Such rules
are called NAT forwarding rules.
For example, if the gateway has two public IP addresses, 62.98.112.1
and 62.98.112.2, and the network contains two private Web servers, A
and B, you can forward all traffic with the destination 62.98.112.1 to
server A, while forwarding all traffic with the destination 62.98.112.2 to
server B.
Note: Creating an Allow and Forward rule for incoming traffic to the default
Chapter 13: Setting Your Security Policy
375
Using Rules
Rule
Description
destination This Gateway (which represents the UTM-1 IP address), is equivalent to
defining a server in the Servers page.

Permit outgoing traffic from your internal network to a specific service
and destination IP address on the Internet and then divert all such
connections to a specific IP address. Such rules are called transparent
proxy rules.
For example, you can redirect all traffic destined for a specific Web
server on the Internet to a different IP address.

Redirect the specified connections to a specific port. This option is
called Port Address Translation (PAT).

Assign traffic to a QoS class.
If Traffic Shaper is enabled for incoming traffic, then Traffic Shaper will
handle relevant connections as specified in the bandwidth policy for
the selected QoS class. For example, if Traffic Shaper is enabled for
incoming traffic, and you create an Allow and Forward rule associating
all incoming Web traffic with the Urgent QoS class, then Traffic Shaper
will handle incoming Web traffic as specified in the bandwidth policy
for the Urgent class.
For information on Traffic Shaper and QoS classes, see Using Traffic
Shaper.
Note: You must use this type of rule to allow incoming connections if your network
uses Hide NAT.
Allow
376
This rule type enables you to do the following:

Permit outgoing access from your internal network to a specific service
on the Internet.
Permit incoming access from the Internet to a specific service in your
internal network.

Assign traffic to a QoS class.
If Traffic Shaper is enabled for the direction of traffic specified in the
Check Point UTM-1 Embedded NGX User Guide
Using Rules
Rule
Description
rule (incoming or outgoing), then Traffic Shaper will handle relevant
connections as specified in the bandwidth policy for the selected QoS
class. For example, if Traffic Shaper is enabled for outgoing traffic, and
you create an Allow rule associating all outgoing Web traffic with the
Urgent QoS class, then Traffic Shaper will handle outgoing Web traffic
as specified in the bandwidth policy for the Urgent class.
For information on Traffic Shaper and QoS classes, see Using Traffic
Shaper.
Note: You cannot use an Allow rule to permit incoming traffic, if the network or VPN
uses Hide NAT. Use an ―Allow and Forward‖ rule instead. However, you can use
Allow rules for static NAT IP addresses.
Block
This rule type enables you to do the following:

Block outgoing access from your internal network to a specific service
on the Internet.

Block incoming access from the Internet to a specific service in your
internal network.

Block connections between hosts on different internal networks.
Adding and Editing Firewall Rules
To add or edit a firewall rule
1.
Click Security in the main menu, and click the Rules tab.
Chapter 13: Setting Your Security Policy
377
Using Rules
The Rules page appears.
2.
Do one of the following:

To add a new rule, click Add Rule.
 To edit an existing rule, click
next to the desired rule.
The UTM-1 Firewall Rule wizard opens, with the Step 1: Rule Type dialog box displayed.
3.
378
Select the type of rule you want to create.
Check Point UTM-1 Embedded NGX User Guide
Using Rules
4.
Click Next.
The Step 2: Service dialog box appears.
The example below shows an Allow and Forward rule.
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
Chapter 13: Setting Your Security Policy
379
Using Rules
The Step 3: Destination & Source dialog box appears.
7.
To configure advanced settings, click Show Advanced Settings.
New fields appear.
8.
Complete the fields using the relevant information in the following table.
9.
Click Next.
380
Check Point UTM-1 Embedded NGX User Guide
Using Rules
The Step 4: Rule Options dialog box appears.
10. Complete the fields using the relevant information in the following table.
11. Click Next.
The Step 5: Done dialog box appears.
12. If desired, type a description of the rule in the field provided.
Chapter 13: Setting Your Security Policy
381
Using Rules
13. Click Finish.
The new rule appears in the Rules page.
Table 77: Firewall Rule Fields
In this field…
Do this…
Any Service
Click this option to specify that the rule should apply to any service.
Standard Service
Click this option to specify that the rule should apply to a specific standard
service or a network service object.
You must then select the desired service or network service object from the
drop-down list.
Custom Service
Click this option to specify that the rule should apply to a specific non-standard
service.
The Protocol and Port Range fields are enabled. You must fill them in.
Protocol
Select the protocol for which the rule should apply (ESP, GRE, TCP, UDP,
ICMP, IGMP, or OSPF).
To specify that the rule should apply for any protocol, select ANY.
To specify a protocol by number, select Other. The Protocol Number field
appears.
Port Range
To specify the port range to which the rule applies, type the start port number
in the left text box, and the end port number in the right text box.
Note: If you do not enter a port range, the rule will apply to all ports. If you enter
only one port number, the range will include only that port.
Protocol Number
Type the number of the protocol for which the rule should apply.
Source
Select the source of the connections you want to allow/block. This list includes
network objects.
382
Check Point UTM-1 Embedded NGX User Guide
Using Rules
In this field…
Do this…
To specify an IP address, select Specified IP and type the desired IP address in
the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP address, select This Gateway.
To specify any source, select ANY.
Destination
Select the destination of the connections you want to allow/block. This list
includes network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the text box.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP addresses, select This Gateway.
To specify any destination except the UTM-1 Portal IP addresses, select ANY.
If the current time
Select this option to specify that the rule should be applied only during certain
is
hours of the day.
You must then use the fields and drop-down lists provided, to specify the
desired time range.
Forward the
Select the destination to which matching connections should be forwarded.
connection to
To specify an IP address, select Specified IP and type the desired IP address in
the text box.
This field only appears when defining an Allow and Forward rule.
Chapter 13: Setting Your Security Policy
383
Using Rules
In this field…
Do this…
Quality of Service
Select the QoS class to which you want to assign the specified connections.
class
If Traffic Shaper is enabled, Traffic Shaper will handle these connections as
specified in the bandwidth policy for the selected QoS class. If Traffic Shaper
is not enabled, this setting is ignored. For information on Traffic Shaper and
QoS classes, see Using Traffic Shaper.
This drop-down list only appears when defining an Allow rule or an Allow and
Forward rule.
Redirect to port
Select this option to redirect the connections to a specific port.
You must then type the desired port in the field provided.
This option is called Port Address Translation (PAT), and is only available
when defining an Allow and Forward rule.
Log accepted
connections /
Log blocked
Select this option to log the specified blocked or allowed connections.
By default, accepted connections are not logged, and blocked connections are
logged. You can modify this behavior by changing the check box's state.
connections
Enabling/Disabling Firewall Rules
You can temporarily disable a user-defined rule.
To enable/disable a firewall rule
1.
Click Security in the main menu, and click the Rules tab.
The Rules page appears.
2.
384
Next to the desired rule, in the Enabled column, do one of the following:
Check Point UTM-1 Embedded NGX User Guide
Using Rules

To enable the rule, click
The button changes to

To disable the rule, click
The button changes to
.
and the rule is enabled.
.
and the rule is disabled.
Reordering Firewall Rules
To reorder firewall rules
1.
Click Security in the main menu, and click the Rules tab.
The Rules page appears.
2.
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Enabling/Disabling Firewall Rule Logging
You can enable or disable logging for a firewall rule, by using the information in Adding
and Editing Firewall Rules on page 377, or by using the following shortcut.
To enable/disable logging for a firewall rule
1.
Click Security in the main menu, and click the Rules tab.
The Rules page appears.
2.
Next to the desired rule, in the Log column, do one of the following:

To enable logging, click
The button changes to

To disable logging, click
The button changes to
Chapter 13: Setting Your Security Policy
.
and logging is enabled for the rule.
.
and logging is disabled for the rule.
385
Using Port-Based Security
Viewing and Deleting Firewall Rules
To view or delete an existing firewall rule
1.
Click Security in the main menu, and click the Rules tab.
The Rules page appears with a list of existing firewall rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
b.
In the desired rule's row, click
.
A confirmation message appears.
Click OK.
The rule is deleted.
Using Port-Based Security
The UTM-1 appliance supports the IEEE 802.1x standard for secure authentication of users
and devices that are directly attached to UTM-1 appliance's LAN and DMZ ports, as well as
the wireless LAN. Authentication can be performed either by an external RADIUS server, or
by the UTM-1 appliance's built-in EAP authenticator. For information on the UTM-1 EAP
authenticator, see Using the UTM-1 EAP Authenticator on page 404.
When an 802.1x security scheme is implemented for a port, users attempting to connect to
that port are required to authenticate using their network user name and password. The
UTM-1 appliance sends the user's credentials to the configured authentication server, and if
authentication succeeds, a connection is established. If the user fails to authenticate, the port
is physically isolated from other ports on the gateway.
If desired, you can specify how users should be handled after successful or failed
authentication. Users who authenticate successfully on a specific port are assigned to the
network with which that port is associated. For example, if the port is assigned to the DMZ
network, all users who authenticate successfully on that port are assigned to the DMZ
network.
386
Check Point UTM-1 Embedded NGX User Guide
Using Port-Based Security
When using a RADIUS server for authentication, you can assign authenticated users to
specific network segments, by configuring dynamic VLAN assignment on the RADIUS
server. Upon successful authentication, the RADIUS server sends RADIUS option 81
[Tunnel-Private-Group-ID] to the UTM-1 appliance, indicating to which network segment
the user should be assigned. For example, if a member of the Accounting team connects to a
network port and attempts to log in, the UTM-1 appliance relays the information to the
RADIUS server, which replies with RADIUS option 81 and the value ―Accounting‖. The
appliance then assigns the user’s port to the Accounting network, granting the user access to
all the resources of the Accounting team.
The UTM-1 appliance also enables you to automatically assign users to a ―Quarantine‖
network when authentication fails. All Quarantine network security and network rules will
apply to those users. For example, you can create security rules allowing users on the
Quarantine network to access the Internet and blocking them from accessing sensitive
company resources. You can also configure Traffic Shaper to grant members of the
Quarantine network a lower amount of bandwidth than authorized users.
You can choose to exclude specific network objects from 802.1x port-based security
enforcement. Excluded network objects will be able to connect to the UTM-1 appliance's
ports and access the network without authenticating. For information on excluding network
objects from 802.1x port-based security enforcement, see Using Network Objects on page
210.
Configuring Port-Based Security
To configure 802.1x port-based security for a port
1.
Do one of the following:


To use the UTM-1 EAP authenticator for authenticating clients, follow the
workflow Using the UTM-1 EAP Authenticator for Authentication of Wired
Clients.
You will be referred back to this procedure at the appropriate stage in the
workflow, at which point you can continue from the next step.
To use a RADIUS server for authenticating clients, do the following:
1) Configure a RADIUS server.
See Using RADIUS Authentication on page 645.
Chapter 13: Setting Your Security Policy
387
Using Port-Based Security
2.
2) Configure the clients for 802.1x authentication.
For information, refer to your RADIUS server documentation.
To configure dynamic VLAN assignment, do the following:
a.
Add port-based VLAN networks as needed.
See Adding and Editing Port-Based VLANs on page 204.
b. Configure RADIUS option 81 [Tunnel-Private-Group-ID] on the RADIUS
server.
For information, refer to your RADIUS server documentation.
This step is only relevant when using a RADIUS server.
3.
To configure a Quarantine network other than the LAN or DMZ, add a
port-based VLAN network.
See Adding and Editing Port-Based VLANs on page 204.
4.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
5.
388
Next to the desired port, click Edit.
Check Point UTM-1 Embedded NGX User Guide
Using Port-Based Security
The Port Setup page appears.
6.
In the Port Security drop-down list, select 802.1x.
The Quarantine Network, Authentication Server, and Allow multiple hosts fields are
enabled.
7.
Complete the fields using the information in the following table.
8.
Click Apply.
A warning message appears.
9.
Click OK.
Table 78: Port-Based Security Fields
In this field…
Do this…
Assign to network
Specify how the UTM-1 appliance should handle users who authenticate
successfully, by selecting one of the following:
Authentication

A network name. All users who authenticate to this port
successfully are assigned to the specified network.

From RADIUS. Use dynamic VLAN assignment to assign users to
specific networks. This option is only relevant when using a
RADIUS server.
Specify which authentication server you are using, by selecting one of the
Chapter 13: Setting Your Security Policy
389
Using Port-Based Security
In this field…
Do this…
Server
following:

RADIUS. A RADIUS server.

Internal User Database. The UTM-1 EAP authenticator.
Quarantine
Specify which network should serve as the Quarantine network, by selecting
Network
one of the following:
Allow multiple
hosts

A network name. All users for whom authentication to this port
fails are assigned to the specified network.

None. No Quarantine network is selected.
To allow multiple hosts to connect to this port, select this option.
Normally, 802.1x port-based security allows only a single host to connect to
each port. However, when this option is selected, multiple clients can connect
to the same port via a hub or switch. Each client on the port must authenticate
separately.
For information on cascading the UTM-1 appliance to a hub or switch, see
Cascading Your Appliance on page 98.
Note: Enabling this option makes 802.1x port-based security less secure.
Therefore, it is recommended to enable this option only in locations where
the number of ports are a limiting factor, and where an external
802.1x-capable switch cannot be installed.
Resetting 802.1x Locking
When 802.1x port-based security is configured for a LAN port, the first host that attempts to
connect to this port is ―locked‖ to the port. In order to connect a different computer to the
port, you must first reset 802.1x locking.
To reset 802.1x locking on all ports
1.
390
Click Network in the main menu, and click the Ports tab.
Check Point UTM-1 Embedded NGX User Guide
Using Secure HotSpot
The Ports page appears.
2.
Click Reset 802.1x.
A confirmation message appears.
3.
Click OK.
The 802.1x status of all ports is reset to "Unauthenticated".
Using Secure HotSpot
You can enable your UTM-1 appliance as a public Internet access hotspot for specific
networks. When users on those networks attempt to access the Internet, they are
automatically re-directed to the My HotSpot page http://my.hotspot.
Note: You can configure Secure HotSpot to use HTTPS. In this case, the My HotSpot
page will be https://my.hotspot.
On this page, users must read and accept the My HotSpot terms of use, and if My HotSpot is
configured to be password-protected, they must log in using their UTM-1 username and
password. The users may then access the Internet or other corporate networks.
Users can also log out in the My HotSpot page.
Note: HotSpot users are automatically logged out after one hour of inactivity. If you are
using RADIUS authentication, you can change the Secure HotSpot session timeout by
configuring the RADIUS Session-Timeout Attribute. See Using RADIUS
Chapter 13: Setting Your Security Policy
391
Using Secure HotSpot
Authentication on page 645.
UTM-1 Secure HotSpot is useful in any wired or wireless environment where Web-based
user authentication or terms-of-use approval is required prior to gaining access to the
network. For example, Secure HotSpot can be used in public computer labs, educational
institutions, libraries, Internet cafés, and so on. You can also track and charge for Secure
HotSpot use, by enabling RADIUS accounting. For information, see Using RADIUS
Authentication on page 645.
The UTM-1 appliance allows you to add guest users quickly and easily. By default, guest
users are given a username and password that expire in 24 hours and granted HotSpot
Access permissions only. For information on adding quick guest users, see Adding Quick
Guest Users on page 642.
You can choose to exclude specific network objects from HotSpot enforcement. Excluded
network objects will be able to access the network without viewing the My HotSpot page.
Furthermore, users will be able to access the excluded network object without viewing the
My HotSpot page. For information on excluding network objects from HotSpot
enforcement, see Using Network Objects on page 210.
Important: SecuRemote/SecureClient/L2TP/Endpoint Connect VPN software users
who are authenticated by the Internal VPN Server are automatically exempt from
HotSpot enforcement. This allows, for example, authenticated employees to gain full
access to the corporate LAN, while guest users are permitted to access the Internet
only.
Note: HotSpot enforcement can block traffic passing through the firewall; however, it
does not block local traffic on the same network segment (traffic that does not pass
through the firewall).
Setting Up Secure HotSpot
To set up Secure HotSpot
1.
Enable Secure HotSpot for the desired networks.
See Enabling/Disabling Secure HotSpot on page 393.
2.
392
Customize Secure HotSpot as desired.
Check Point UTM-1 Embedded NGX User Guide
Using Secure HotSpot
See Customizing Secure HotSpot on page 394.
3.
Grant HotSpot Access permissions to users on the selected networks.
See Adding and Editing Users on page 637.
4.
To exclude specific computers from Secure HotSpot enforcement, add or edit
their network objects.
See Adding and Editing Network Objects on page 211.
You must select Exclude this computer/network from HotSpot enforcement option.
5.
Add quick guest users as needed.
See Adding Quick Guest Users on page 642.
Enabling/Disabling Secure HotSpot
To enable/disable Secure HotSpot
1.
Click Security in the main menu, and click the HotSpot tab.
Chapter 13: Setting Your Security Policy
393
Using Secure HotSpot
The My HotSpot page appears.
2.
In the HotSpot Networks area, do one of the following:

3.
To enable Secure HotSpot for a specific network, select the check box next to
the network.
 To disable Secure HotSpot for a specific network, clear the check box next to
the network.
Click Apply.
Customizing Secure HotSpot
To customize Secure HotSpot
1.
394
Click Security in the main menu, and click the HotSpot tab.
Check Point UTM-1 Embedded NGX User Guide
Using Secure HotSpot
The My HotSpot page appears.
2.
Complete the fields using the information in the following table.
3.
To preview the My HotSpot page, click Preview.
A browser window opens displaying the My HotSpot page.
4.
Click Apply.
Your changes are saved.
Table 79: My HotSpot Fields
In this field…
Do this…
Prior to login
Specify the degree of access to grant users who have not yet logged in to
Secure HotSpot or for whom authentication failed, by selecting one of the
following:
My HotSpot Title

Block Access to Other Networks. Users cannot access internal
networks, the Internet, or VPN. This is the default.

Block Access to External Networks Only. Users can access internal
networks, but not the Internet or VPN.

Block Access to VPN Only. Users can access internal networks and
the Internet, but not VPN.
Type the title that should appear on the My HotSpot page.
The default title is "Welcome to My HotSpot".
My HotSpot
Terms
Type the terms to which the user must agree before accessing the Internet.
You can use HTML tags as needed.
Chapter 13: Setting Your Security Policy
395
Using NAT Rules
In this field…
Do this…
My HotSpot is
Select this option to require users to enter their username and password
password-protect
before accessing the Internet.
ed
If this option is not selected, users will be required only to accept the terms of
use before accessing the network.
The Allow a user to login from more than one computer at the same time check box
appears.
Allow a user to
Select this option to allow a single user to log in to My HotSpot from multiple
login from more
computers at the same time.
than one
computer at the
same time
Use HTTPS
Select this option to use HTTPS for Secure HotSpot.
After login,
To redirect users to a specific URL after logging in to My HotSpot, select this
redirect to URL
option and type the desired URL in the field provided.
For example, you can redirect authenticated users to your company’s Web site
or a ―Welcome‖ page.
Using NAT Rules
Overview
In an IP network, each computer is assigned a unique IP address that defines both the host
and the network. A computer's IP address can be public and Internet-routable, or private and
non-routable. Since IPv4, the current version of IP, provides only 32 bits of address space,
available public IP addresses are becoming scarce, most having already been assigned.
396
Check Point UTM-1 Embedded NGX User Guide
Using NAT Rules
Internet Service Providers will usually allocate only one or a few public IP addresses at a
time, and while larger companies may purchase several such addresses for use, purchasing
addresses for every computer on the network is usually impossible.
Due to the lack of available public IP addresses, most computers in an organization are
assigned private, non-routable IP addresses. Even if more public IP addresses became
available, changing the private IP address of every machine in a large network to a public IP
address would be an administrative nightmare, being both labor intensive and time
consuming. Therefore, organization's computers will most likely remain with private,
non-routable IP addresses, even though in most cases they require access to the Internet.
In addition to the issue of arranging Internet access for computers with non-routable IP
addresses, IP networks present a security challenge. Since making a network’s internal
addresses public knowledge can reveal the topology of the entire network, the network
administrator may want to conceal both routable and non-routable IP addresses from outside
the organization, or even from other parts of the same organization, in order to enhance
security.
The UTM-1 appliance solves both issues through the use of Network Address Translation
(NAT) rules. A NAT rule is a setting used to change the source, destination, and/or service
of specific connections.
Supported NAT Rule Types
The UTM-1 appliance enables you to define the following types of custom NAT rules:

Static NAT (or One-to-One NAT). Translation of an IP address range to another IP
address range of the same size.
This type of NAT rule allows the mapping of Internet IP addresses or address ranges to
hosts inside the internal network. This is useful if you want each computer in your
private network to have its own Internet IP addresses.

Hide NAT (or Many-to-One NAT). Translation of an IP address range to a single IP
address.
This type of NAT rule enables you to share a single public Internet IP address among
several computers, by ―hiding‖ the private IP addresses of the internal computers
behind the UTM-1 appliance’s single Internet IP address. For more information on Hide
NAT, see How Does Hide NAT Work? on page 398.

Few-to-Many NAT. Translation of a smaller IP address range to a larger IP address
range.
Chapter 13: Setting Your Security Policy
397
Using NAT Rules
When this type of NAT rule is used, static NAT is used to map the IP addresses in the
smaller range to the IP addresses at the beginning of the larger range. The remaining IP
addresses in the larger range remain unused.

Many-to-Few NAT. Translation of a larger IP address range to a smaller IP address
range.
When this type of NAT rule is used, static NAT is used to map the IP addresses in the
larger range to all but the final IP address in the smaller range. Hide NAT is then used to
map all of the remaining IP addresses in the larger range to the final IP address in the
smaller range.

Service-Based NAT. Translation of a connection's original service to a different
service.
The UTM-1 appliance also supports implicitly defined NAT rules. Such rules are created
automatically upon the following events:

Hide NAT is enabled on an internal network

An Allow and Forward firewall rule is defined

Static NAT is configured for a network object (for information, see Using
Network Objects on page 210)

NAT rules are received from the Service Center
Implicitly defined NAT rules can only be edited or deleted indirectly. For example, in order
to remove a NAT rule created when a certain network object was defined, you must modify
the relevant network object.
The Address Translation page displays both custom NAT rules and implicitly defined NAT
rules, and it allows you to create, edit, and delete custom NAT rules.
How Does Hide NAT Work?
In Hide NAT, traffic to and from the internal networks traverses an enforcement module.
When a packet from an internal network passes through the gateway, the source IP address is
changed to the hiding IP address, and the source port is changed to a dynamically assigned
port that uniquely identifies the connection. The relationship between the dynamically
assigned port and the internal IP address is recorded in the gateway’s state tables. When
reply packets arrive, the enforcement module uses the destination port to determine to which
connection the packet belongs, and then adjusts the destination port and IP address
accordingly.
398
Check Point UTM-1 Embedded NGX User Guide
Using NAT Rules
Adding and Editing NAT Rules
This procedure explains how to add and edit custom NAT rules. You cannot add or edit an
implicitly defined NAT rule directly.
To add or edit a custom NAT rule
1.
Click Security in the main menu, and click the NAT tab.
The Address Translation page appears.
2.
Do one of the following:

To add a new rule, click New.

To edit an existing rule, click
Chapter 13: Setting Your Security Policy
next to the desired rule.
399
Using NAT Rules
The Address Translation wizard opens, with the Step 1 of 3: Original Connection Details
dialog box displayed.
3.
Complete the fields using the relevant information in the following table.
4.
Click Next.
The Step 2 of 3: Translations to Perform dialog box appears.
400
Check Point UTM-1 Embedded NGX User Guide
Using NAT Rules
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The Step 3 of 3: Save Address Translation dialog box appears.
7.
If desired, type a description of the rule in the field provided.
8.
Click Finish.
The new rule appears in the Address Translation page.
Table 80: Address Translation Wizard Fields
Field
Description
The source is
Select the original source of the connections you want to translate. This list
includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
Chapter 13: Setting Your Security Policy
401
Using NAT Rules
Field
Description
And the destination
Select the original destination of the connections you want to translate. This
is
list includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the text box.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify the UTM-1 IP addresses, select This Gateway.
To specify any destination except the UTM-1 Portal IP addresses, select
ANY.
And the service is
Select the original service used for the connections you want to translate.
This list includes network service objects.
Change the source
Select the new source to which the original source should be translated. This
to
list includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify that the original source should not be translated, select Don't
Change.
402
Check Point UTM-1 Embedded NGX User Guide
Using NAT Rules
Field
Description
Change the
Select the new destination to which the original destination should be
destination to
translated. This list includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify that the original destination should not be translated, select Don't
Change.
Change the
Select the new service to which the original service should be translated.
service to
This list includes network service objects.
To specify that the original service should not be translated, select Don't
Change.
Viewing and Deleting NAT Rules
This procedure explains how to view all NAT rules and how to delete custom NAT rules.
You cannot delete implicitly defined NAT rules directly.
To view and delete NAT rules
1.
Click Security in the main menu, and click the NAT tab.
The Address Translation page appears with a list of all existing NAT rules.
Implicitly defined NAT rules are marked Automatic Rule in the right-most column.
2.
To delete a custom NAT rule, do the following.
a.
In the desired rule's row, click
.
A confirmation message appears.
Chapter 13: Setting Your Security Policy
403
Using the EAP Authenticator
b.
Click OK.
The rule is deleted.
Using the EAP Authenticator
Wi-Fi Protected Access Enterprise (WPA-Enterprise) and 802.1x are Network Access
Control (NAC) protocols that can be used to authenticate users connecting to the Check
Point UTM-1 appliance. Both WPA-Enterprise and 802.1x can be used to control access to
the wireless network; however, WPA-Enterprise has the added capability of encrypting
transmitted data, and 802.1x can be used to secure connections to the UTM-1 appliance's
LAN and DMZ ports as well.
Traditionally, WPA-Enterprise and 802.1x require installing an external Remote
Authentication Dial-In User Service (RADIUS) server. When a user tries to authenticate
using 802.1x or WPA-Enterprise, the UTM-1 appliance sends the entered user credentials to
the RADIUS server. The server then checks whether the RADIUS database contains a
matching set of credentials. If so, then the user is logged in.
While purchasing and configuring a RADIUS server may pose little challenge for a large
enterprise, such a solution may be costly and complex, and may therefore be unsuitable for
smaller networks. In such cases, it is recommended to configure the UTM-1 appliance's
built-in Extended Authentication Protocol (EAP) authenticator, which allows using the local
user database, enabling the use of WPA-Enterprise or 802.1x without an external RADIUS
server.
Workflows
The UTM-1 built-in EAP authenticator can be used to authenticate wireless clients or wired
clients connecting to appliance ports.
Using the EAP Authenticator for Authentication of Wireless Clients
To use the EAP authenticator for authentication of wireless clients
1.
Configure the UTM-1 appliance as follows:
a.
404
Configure the desired wireless network for use with the EAP authenticator.
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
For information on configuring the primary WLAN, see Manually Configuring a
Wireless Network on page 301. For information on configuring a VAP, see
Configuring Virtual Access Points on page 313.
Note: The Security field must set to 802.1x or WPA-Enterprise, and the Authentication Server
field must be set to Internal User Database.
b.
Ensure that the UTM-1 appliance has a certificate installed in the UTM-1
Portal's VPN > Certificate page.
The certificate can be any of the following:
 A self-signed certificate generated by the UTM-1 appliance, version 8.0 or
later.
If a self-signed certificate is installed on the appliance, but was generated by an
earlier firmware version, you must generate a new certificate. For instructions
on generating a self-signed certificate, see Generating a Certificate on page
620.
 A certificate received from the Service Center.
Note: In order to work with a SmartCenter certificate, the SmartCenter administrator
must configure SmartCenter's internal CA for server authentication, by doing the
following:
1. Perform a cpstop operation.
2. In the $FWDIR/conf/InternalCA.C file, add the
ike_cert_extended_key_usage property with the value 1.
3. Perform a cpstart operation.
If the certificate was already installed on the appliance before configuring
SmartCenter's internal CA, the administrator must renew the certificate; otherwise, the
administrator can remotely install the certificate or send it to you for local installation.
For information on installing a certificate locally, see Installing a Certificate on page
620.
c.
d.
Export the UTM-1 appliance's CA certificate.
See Exporting the UTM-1 Appliance CA Certificate on page 628.
For each client that should be allowed to connect to the UTM-1 appliance,
add a user with Network Access permissions to the local user database.
See Adding and Editing Users on page 637.
Chapter 13: Setting Your Security Policy
405
Using the EAP Authenticator
e.
2.
Provide each of the users with the authentication credentials you
configured for them.
Configure each wireless client as follows:
a.
3.
Configure the client for server authentication.
See Configuring Clients for Server Authentication on Wireless Connections on
page 408.
b. Install the UTM-1 appliance's CA certificate as a trusted root CA.
See Installing the UTM-1 Appliance's CA Certificate on Clients on page 413.
Connect the wireless client to the wireless network.
See Connecting Clients to the UTM-1 Appliance on page 418.
Using the EAP Authenticator for Authentication of Wired Clients
To use the EAP authenticator for authentication of wired clients
1.
Configure the UTM-1 appliance as follows:
a.
Configure the desired port for port-based security using the UTM-1 EAP
authenticator.
See Configuring Port-Based Security on page 387.
Note: The Port Security field must set to 802.1x, and the Authentication Server field must be
set to Internal User Database.
b.
406
Ensure that the UTM-1 appliance has a certificate installed in the UTM-1
Portal's VPN > Certificate page.
The certificate can be any of the following:
 A self-signed certificate generated by the UTM-1 appliance, version 8.0 or
later.
If a self-signed certificate is installed on the appliance, but was generated by an
earlier firmware version, you must generate a new certificate. For instructions
on generating a self-signed certificate, see Generating a Certificate on page
620.
 A certificate received from the Service Center.
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
Note: In order to work with a SmartCenter certificate, the SmartCenter administrator
must configure SmartCenter's internal CA for server authentication, by doing the
following:
1. Perform a cpstop operation.
2. In the $FWDIR/conf/InternalCA.C file, add the
ike_cert_extended_key_usage property with the value 1.
3. Perform a cpstart operation.
If the certificate was already installed on the appliance before configuring
SmartCenter's internal CA, the administrator must renew the certificate; otherwise, the
administrator can remotely install the certificate or send it to you for local installation.
For information on installing a certificate locally, see Installing a Certificate on page
620.
c.
2.
Export the UTM-1 appliance's CA certificate.
See Exporting the UTM-1 Appliance CA Certificate on page 628.
d. For each client that should be allowed to connect to the UTM-1 appliance,
add a user with Network Access permissions to the local user database.
See Adding and Editing Users on page 637.
e. Provide each of the users with the authentication credentials you
configured for them.
Configure each wireless client as follows:
a.
3.
Configure the client for server authentication.
See Configuring Clients for Server Authentication on Wired Connections on
page 411.
b. Install the UTM-1 appliance's CA certificate as a trusted root CA.
See Installing the UTM-1 Appliance's CA Certificate on Clients on page 413.
Connect the client directly to the port, and enter the Network Access user's
authentication credentials when prompted.
Chapter 13: Setting Your Security Policy
407
Using the EAP Authenticator
Configuring Clients for Server Authentication on Wireless
Connections
To configure a Microsoft Windows client for server authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
3.
Double-click on the wireless network connection.
4.
Do one of the following:

If the Choose a Wireless Network screen appears, click Change Advanced
Settings.
 If you are already connected to a wireless network, click Properties.
The Wireless Network Connection Properties dialog box appears displaying the General
tab.
5.
Click the Wireless Networks tab.
The Wireless Networks tab appears.
6.
408
Click Add and add your network.
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
The Wireless network properties dialog box appears displaying the Association tab.
7.
In the Network name (SSID) field, type the UTM-1 appliance wireless network
name.
8.
In the Network Authentication drop-down list, select WPA.
Note: You must select WPA, regardless of whether the UTM-1 appliance is configured
to use the WPA-Enterprise or 802.1x security protocol.
9.
In the Data encryption drop-down list, select AES.
10. Click the Authentication tab.
Chapter 13: Setting Your Security Policy
409
Using the EAP Authenticator
The Authentication tab appears.
11. In the EAP type drop-down list, select Protected EAP (PEAP).
12. Select the Authenticate as computer when computer information is available
check box.
13. Click Properties.
The Protected EAP Properties dialog box appears.
14. Make sure that the Validate server certificate check box is selected.
410
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
15. In the Select Authentication Method drop-down list, select Secured password
(EAP-MSCHAP v2).
16. If the user credentials for connecting to the UTM-1 appliance differ from the
user credentials for connecting to Windows, do the following:
a.
Click Configure.
The EAP MSCHAPv2 Properties dialog box appears.
b. Clear the check box.
c. Click OK.
17. Click OK in all open windows.
Configuring Clients for Server Authentication on Wired
Connections
To configure a Microsoft Windows client for server authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
3.
Right-click on Local Area Connection, and click Properties in the popup menu
that appears.
The Local Area Connection Properties dialog box appears displaying the General tab.
4.
Click the Authentication tab.
Chapter 13: Setting Your Security Policy
411
Using the EAP Authenticator
The Authentication tab appears.
5.
Select the Enable IEEE 802.1x authentication for this network check box.
6.
In the EAP type drop-down list, select Protected EAP (PEAP).
7.
Select the Authenticate as computer when computer information is available
check box.
8.
Click Properties.
The Protected EAP Properties dialog box appears.
9.
412
Make sure that the Validate server certificate check box is selected.
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
10. In the Select Authentication Method drop-down list, select Secured password
(EAP-MSCHAP v2).
11. If the user credentials for connecting to the UTM-1 appliance differ from the
user credentials for connecting to Windows, do the following:
a.
Click Configure.
The EAP MSCHAPv2 Properties dialog box appears.
b. Clear the check box.
c. Click OK.
12. Click OK in all open windows.
Installing the UTM-1 Appliance's CA Certificate on Clients
To install the UTM-1 appliance's CA certificate on a Microsoft Windows client
1.
On the client, right-click on the UTM-1 appliance's CA certificate you exported,
and click Install PFX in the pop-up menu that appears.
For information on exporting the CA certificate, see Exporting the UTM-1 Appliance
CA Certificate on page 628.
Chapter 13: Setting Your Security Policy
413
Using the EAP Authenticator
The Certificate Import Wizard opens displaying the Welcome to Certificate Import Wizard
screen.
2.
Click Next.
The File to Import dialog box appears.
3.
Browse to the UTM-1 appliance's CA certificate (*.p12 file).
4.
Click Next.
414
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
The Password dialog box appears.
Do not type a password.
5.
Click Next.
The Certificate Store dialog box appears.
6.
Click Automatically select the certificate store based on the type of certificate.
7.
Click Next.
Chapter 13: Setting Your Security Policy
415
Using the EAP Authenticator
The Completing the Certificate Import Wizard screen appears.
8.
Click Finish.
If the UTM-1 appliance certificate was self-signed, a warning message appears.
Do the following:
Click Yes.
A success message appears.
b. Click OK.
To check that the certificate was successfully installed as a trusted root CA, do
the following:
a.
9.
a.
b.
c.
416
On the client, open Internet Explorer.
In the Tools menu, click Internet Options.
The Internet Options dialog box appears displaying the General tab.
Click the Content tab.
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
The Content tab appears.
d.
e.
f.
Click Certificates.
The Certificates dialog box appears.
Click the Trusted Root Certification Authorities tab.
The Trusted Root Certification Authorities tab appears.
In the list, locate the UTM-1 appliance's CA certificate.
The certificate's name is in the format CA-<Identifier>, where
<Identifier> is the UTM-1 appliance's MAC address or gateway name.
Chapter 13: Setting Your Security Policy
417
Using the EAP Authenticator
g.
To view further information about the certificate, double-click on it.
The Certificate dialog box appears with additional information.
Connecting Wireless Clients to the UTM-1 Appliance
To connect a Microsoft Windows wireless client to the UTM-1 appliance with WPA
Enterprise authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
A list of wireless networks appears.
3.
Select the UTM-1 appliance wireless network.
4.
Click Connect.
A popup message appears asking you to supply credentials.
5.
Click on the popup message.
The Enter Credentials dialog box appears.
418
Check Point UTM-1 Embedded NGX User Guide
Using the EAP Authenticator
6.
Type the Network Access user's user name and password in the fields provided.
7.
Click OK.
The wireless client attempts to connect to the network.
Upon successful connection, the client indicates that it is connected to the network.
Chapter 13: Setting Your Security Policy
419
Overview
Chapter 14
Using SmartDefense
This chapter explains how to use Check Point SmartDefense Services.
This chapter includes the following topics:
Overview ..................................................................................................421
Configuring SmartDefense .......................................................................422
SmartDefense Categories .........................................................................429
Resetting SmartDefense to its Defaults .................................................... 475
Overview
The UTM-1 appliance includes Check Point SmartDefense Services, based on Check Point
Application Intelligence. SmartDefense provides a combination of attack safeguards and
attack-blocking tools that protect your network in the following ways:

Validating compliance to standards

Validating expected usage of protocols (Protocol Anomaly Detection)

Limiting application ability to carry malicious data

Controlling application-layer operations
In addition, SmartDefense aids proper usage of Internet resources, such as FTP, instant
messaging, Peer-to-Peer (P2P) file sharing, file-sharing operations, and File Transfer
Protocol (FTP) uploading, among others.
Chapter 14: Using SmartDefense
421
Configuring SmartDefense
Configuring SmartDefense
You can configure SmartDefense using the following tools:

SmartDefense Wizard. Resets all SmartDefense settings to their defaults, and then
creates a SmartDefense security policy according to your network and security
preferences. See Using the SmartDefense Wizard on page 422.

SmartDefense Tree. Enables you to fine tune individual settings in the
SmartDefense policy. You can use the SmartDefense tree instead of, or in addition
to, the wizard. See Using the SmartDefense Tree on page 427.
Using the SmartDefense Wizard
The SmartDefense Wizard allows you to configure your SmartDefense security policy
quickly and easily through its user-friendly interface.
Note: The SmartDefense wizard clears any existing SmartDefense settings.
After using the wizard, you can fine tune the policy settings using the SmartDefense tree.
See Using the SmartDefense Tree on page 427.
To configure the SmartDefense policy using the wizard
1.
422
Click Security in the main menu, and click the SmartDefense tab.
Check Point UTM-1 Embedded NGX User Guide
Configuring SmartDefense
The SmartDefense page appears.
2.
Click SmartDefense Wizard.
The SmartDefense Wizard opens, with the Step 1: SmartDefense Level dialog box
displayed.
Chapter 14: Using SmartDefense
423
Configuring SmartDefense
3.
Drag the lever to the desired level of SmartDefense enforcement.
For information on the levels, see the following table.
4.
Click Next.
The Step 2: Application Intelligence Server Types dialog box appears.
5.
Select the check boxes next to the types of public servers that are running on
your network.
6.
Click Next.
424
Check Point UTM-1 Embedded NGX User Guide
Configuring SmartDefense
The Step 3: Application Blocking dialog box appears.
7.
Select the check boxes next to the types of applications you want to block from
running on your network.
8.
Click Next.
The Step 4: Confirmation dialog box appears.
Chapter 14: Using SmartDefense
425
Configuring SmartDefense
9.
Click Finish.
Existing SmartDefense settings are cleared, and the security policy is applied.
Table 81: SmartDefense Security Levels
This level…
Does this…
Minimal
Disables all SmartDefense protections, except those that cannot be disabled.
Normal
Enables the following:

Teardrop

Ping of Death

LAND

Packet Sanity

Max Ping Size (set to 1500)

Welchia

Cisco IOS

Null Payload

IGMP

Small PMTU (Log Only)
This level blocks the most common attacks.
High
Extra Strict
426
Enables the same protections as Normal level, as well as the following:

Host Port Scan

Sweep Scan

HTTP Header Rejection

Strict TCP (Log Only)
Enables the same protections as High level, as well as the following:

Strict TCP (Log + Block)

Small PMTU (Log + Block)

Max Ping Size (set to 512)

Network Quota
Check Point UTM-1 Embedded NGX User Guide
Configuring SmartDefense
Using the SmartDefense Tree
For convenience, SmartDefense is organized as a tree, in which each branch represents a
category of settings.
When a category is expanded, the settings it contains appear as nodes. For information on
each category and the nodes it contains, see SmartDefense Categories on page 429.
Each node represents an attack type, a sanity check, or a protocol or service that is vulnerable
to attacks. To control how SmartDefense handles a specific attack, you must configure the
relevant node's settings.
Chapter 14: Using SmartDefense
427
Configuring SmartDefense
To configure a SmartDefense node
1.
Click Security in the main menu, and click the SmartDefense tab.
The SmartDefense page appears.
The left pane displays a tree containing SmartDefense categories.
2.
 To expand a category, click the icon next to it.
 To collapse a category, click the icon next to it.
Expand the relevant category, and click on the desired node.
The right pane displays a description of the node, followed by fields.
3.
To modify the node's current settings, do the following:
a)
4.
Complete the fields using the relevant information in SmartDefense
Categories on page 429.
b) Click Apply.
To reset the node to its default values:
a)
428
Click Default.
A confirmation message appears.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
b) Click OK.
The fields are reset to their default values, and your changes are saved.
SmartDefense Categories
SmartDefense includes the following categories:

Denial of Service on page 430

FTP on page 453

HTTP on page 458

IGMP on page 461

Instant Messaging Traffic on page 466

IP and ICMP on page 435

Microsoft Networks on page 460

Peer-to-Peer on page 465

Port Scan on page 451

TCP on page 445

VoIP on page 463

Games on page 468

SCADA on page 469
Chapter 14: Using SmartDefense
429
SmartDefense Categories
Denial of Service
Denial of Service (DoS) attacks are aimed at overwhelming the target with spurious data, to
the point where it is no longer able to respond to legitimate service requests.
This category includes the following attacks:

DDoS Attack on page 434

LAND on page 432

Non-TCP Flooding on page 433

Ping of Death on page 431

Teardrop on page 430
Teardrop
In a Teardrop attack, the attacker sends two IP fragments, the latter entirely contained within
the former. This causes some computers to allocate too much memory and crash.
You can configure how Teardrop attacks should be handled.
Table 82: Teardrop Fields
In this field…
Do this…
Action
Specify what action to take when a Teardrop attack occurs, by selecting one
430
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…
of the following:
Track

Block. Block the attack. This is the default.

None. No action.
Specify whether to log Teardrop attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
Ping of Death
In a Ping of Death attack, the attacker sends a fragmented PING request that exceeds the
maximum IP packet size (64KB). Some operating systems are unable to handle such
requests and crash.
You can configure how Ping of Death attacks should be handled.
Table 83: Ping of Death Fields
In this field…
Do this…
Action
Specify what action to take when a Ping of Death attack occurs, by selecting
one of the following:

Block. Block the attack. This is the default.

None. No action.
Chapter 14: Using SmartDefense
431
SmartDefense Categories
In this field…
Do this…
Track
Specify whether to log Ping of Death attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
LAND
In a LAND attack, the attacker sends a SYN packet, in which the source address and port are
the same as the destination (the victim computer). The victim computer then tries to reply to
itself and either reboots or crashes.
You can configure how LAND attacks should be handled.
Table 84: LAND Fields
In this field…
Do this…
Action
Specify what action to take when a LAND attack occurs, by selecting one of
the following:
Track
432

Block. Block the attack. This is the default.

None. No action.
Specify whether to log LAND attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Non-TCP Flooding
Advanced firewalls maintain state information about connections in a State table. In
Non-TCP Flooding attacks, the attacker sends high volumes of non-TCP traffic. Since such
traffic is connectionless, the related state information cannot be cleared or reset, and the
firewall State table is quickly filled up. This prevents the firewall from accepting new
connections and results in a Denial of Service (DoS).
You can protect against Non-TCP Flooding attacks by limiting the percentage of state table
capacity used for non-TCP connections.
Table 85: Non-TCP Flooding Fields
In this field…
Do this…
Action
Specify what action to take when the percentage of state table capacity used
for non-TCP connections reaches the Max. percent non TCP traffic threshold.
Select one of the following:
Track

Block. Block any additional non-TCP connections.

None. No action. This is the default.
Specify whether to log non-TCP connections that exceed the Max. Percent
Non-TCP Traffic threshold, by selecting one of the following:

Log. Log the connections.

None. Do not log the connections. This is the default.
Chapter 14: Using SmartDefense
433
SmartDefense Categories
In this field…
Do this…
Max. Percent
Type the maximum percentage of state table capacity allowed for non-TCP
Non-TCP Traffic
connections.
The default value is 10%.
DDoS Attack
In a distributed denial-of-service attack (DDoS attack), the attacker directs multiple hosts in
a coordinated attack on a victim computer or network. The attacking hosts send large
amounts of spurious data to the victim, so that the victim is no longer able to respond to
legitimate service requests.
You can configure how DDoS attacks should be handled.
Table 86: Distributed Denial of Service Fields
In this field…
Do this…
Action
Specify what action to take when a DDoS attack occurs, by selecting one of
the following:
434

Block. Block the attack. This is the default.

None. No action.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…
Track
Specify whether to log DDoS attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
IP and ICMP
This category allows you to enable various IP and ICMP protocol tests, and to configure
various protections against IP and ICMP-related attacks. It includes the following:

Checksum Verification on page 445

Cisco IOS DOS on page 442

IP Fragments on page 438

Max Ping Size on page 437

Network Quota on page 439

Null Payload on page 443

Packet Sanity on page 435

Welchia on page 441
Packet Sanity
Packet Sanity performs several Layer 3 and Layer 4 sanity checks. These include verifying
packet size, UDP and TCP header lengths, dropping IP options, and verifying the TCP flags.
Chapter 14: Using SmartDefense
435
SmartDefense Categories
You can configure whether logs should be issued for offending packets.
Table 87: Packet Sanity Fields
In this field…
Do this…
Action
Specify what action to take when a packet fails a sanity test, by selecting one
of the following:
Track

Block. Block the packet. This is the default.

None. No action.
Specify whether to issue logs for packets that fail the packet sanity tests, by
selecting one of the following:

Log. Issue logs. This is the default.

None. Do not issue logs.
Disable relaxed
The UDP length verification sanity check measures the UDP header length
UDP length
and compares it to the UDP header length specified in the UDP header. If the
verification
two values differ, the packet may be corrupted.
However, since different applications may measure UDP header length
differently, the UTM-1 appliance relaxes the UDP length verification sanity
check by default, performing the check but not dropping offending packets.
This is called relaxed UDP length verification.
Specify whether the UTM-1 appliance should relax the UDP length verification
436
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…
sanity check or not, by selecting one of the following:

True. Disable relaxed UDP length verification. The UTM-1
appliance will drop packets that fail the UDP length verification
check.

False. Do not disable relaxed UDP length verification. The UTM-1
appliance will not drop packets that fail the UDP length verification
check. This is the default.
Max Ping Size
PING (ICMP echo request) is a program that uses ICMP protocol to check whether a remote
machine is up. A request is sent by the client, and the server responds with a reply echoing
the client's data.
An attacker can echo the client with a large amount of data, causing a buffer overflow. You
can protect against such attacks by limiting the allowed size for ICMP echo requests.
Table 88: Max Ping Size Fields
In this field…
Do this…
Action
Specify what action to take when an ICMP echo response exceeds the Max
Ping Size threshold, by selecting one of the following:

Block. Block the request. This is the default.
Chapter 14: Using SmartDefense
437
SmartDefense Categories
In this field…
Do this…

Track
None. No action.
Specify whether to log ICMP echo responses that exceed the Max Ping Size
threshold, by selecting one of the following:
Max Ping Size

Log. Log the responses. This is the default.

None. Do not log the responses.
Specify the maximum data size for ICMP echo response.
The default value is 548.
IP Fragments
When an IP packet is too big to be transported by a network link, it is split into several
smaller IP packets and transmitted in fragments. To conceal a known attack or exploit, an
attacker might imitate this common behavior and break the data section of a single packet
into several fragmented packets. Without reassembling the fragments, it is not always
possible to detect such an attack. Therefore, the UTM-1 appliance always reassembles all
the fragments of a given IP packet, before inspecting it to make sure there are no attacks or
exploits in the packet.
You can configure how fragmented packets should be handled.
438
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 89: IP Fragments Fields
In this field…
Do this…
Forbid IP Fragments
Specify whether all fragmented packets should be dropped, by selecting
one of the following:

True. Drop all fragmented packets.

False. No action. This is the default.
Under normal circumstances, it is recommended to leave this field set to
False. Setting this field to True may disrupt Internet connectivity, because it
does not allow any fragmented packets.
Max Number of
Type the maximum number of fragmented packets allowed. Packets
Incomplete Packets
exceeding this threshold will be dropped.
The default value is 300.
Timeout for
When the UTM-1 appliance receives packet fragments, it waits for
Discarding
additional fragments to arrive, so that it can reassemble the packet.
Incomplete Packets
Type the number of seconds to wait before discarding incomplete packets.
The default value is 10.
Track
Specify whether to log fragmented packets, by selecting one of the
following:

Log. Log all fragmented packets.

None. Do not log the fragmented packets. This is the default.
Network Quota
An attacker may try to overload a server in your network by establishing a very large number
of connections per second. To protect against Denial Of Service (DoS) attacks, Network
Quota enforces a limit upon the number of connections per second that are allowed from the
same source IP address.
Chapter 14: Using SmartDefense
439
SmartDefense Categories
You can configure how connections that exceed that limit should be handled.
Table 90: Network Quota Fields
In this field…
Do this…
Action
Specify what action to take when the number of network connections
from the same source reaches the Max. Connections/Second per Source IP
threshold. Select one of the following:
Track

Block. Block all new connections from the source. Existing
connections will not be blocked. This is the default.

None. No action.
Specify whether to log connections from a specific source that exceed the
Max. Connections/Second per Source IP threshold, by selecting one of the
following:
440

Log. Log the connections. This is the default.

None. Do not log the connections.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…
Max.
Type the maximum number of network connections allowed per second
Connections/Second
from the same source IP address.
from Same Source IP
The default value is 100.
Set a lower threshold for stronger protection against DoS attacks.
Note: Setting this value too low can lead to false alarms.
Welchia
The Welchia worm uses the MS DCOM vulnerability or a WebDAV vulnerability. After
infecting a computer, the worm begins searching for other live computers to infect. It does so
by sending a specific ping packet to a target and waiting for the reply that signals that the
target is alive. This flood of pings may disrupt network connectivity.
You can configure how the Welchia worm should be handled.
Table 91: Welchia Fields
In this field…
Do this…
Action
Specify what action to take when the Welchia worm is detected, by selecting
Chapter 14: Using SmartDefense
441
SmartDefense Categories
In this field…
Do this…
one of the following:
Track

Block. Block the attack. This is the default.

None. No action.
Specify whether to log Welchia worm attacks, by selecting one of the
following:

Log. Log the attack. This is the default.

None. Do not log the attack.
Cisco IOS DOS
Cisco routers are configured to process and accept Internet Protocol version 4 (IPv4) packets
by default. When a Cisco IOS device is sent a specially crafted sequence of IPv4 packets
(with protocol type 53 - SWIPE, 55 - IP Mobility, 77 - Sun ND, or 103 - Protocol
Independent Multicast - PIM), the router will stop processing inbound traffic on that
interface.
You can configure how Cisco IOS DOS attacks should be handled.
Note: You cannot enable CISCO IOS DOS PIM protection in SmartDefense, when the
PIM-SM multicast routing protocol is enabled. For information on disabling the PIM-SM
protocol, refer to the Embedded NGX CLI Reference Guide.
442
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 92: Cisco IOS DOS
In this field…
Do this…
Action
Specify what action to take when a Cisco IOS DOS attack occurs, by
selecting one of the following:
Track

Block. Block the attack. This is the default.

None. No action.
Specify whether to log Cisco IOS DOS attacks, by selecting one of
the following:
Number of Hops to Protect

Log. Log the attack. This is the default.

None. Do not log the attack.
Type the number of hops from the enforcement module that Cisco
routers should be protected.
The default value is 10.
Action Protection for
Specify what action to take when an IPv4 packet of the specific
SWIPE - Protocol 53 /
protocol type is received, by selecting one of the following:
IP Mobility - Protocol 55 /

Block. Drop the packet. This is the default.
SUN-ND - Protocol 77 /

None. No action.
PIM - Protocol 103
Null Payload
Some worms, such as Sasser, use ICMP echo request packets with null payload to detect
potentially vulnerable hosts.
Chapter 14: Using SmartDefense
443
SmartDefense Categories
You can configure how null payload ping packets should be handled.
Table 93: Null Payload Fields
In this field…
Do this…
Action
Specify what action to take when null payload ping packets are detected, by
selecting one of the following:
Track

Block. Block the packets. This is the default.

None. No action.
Specify whether to log null payload ping packets, by selecting one of the
following:
444

Log. Log the packets. This is the default.

None. Do not log the packets.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Checksum Verification
SmartDefense identifies any IP, TCP, or UDP packets with incorrect checksums. You can
configure how these packets should be handled.
Table 94: Checksum Verification Fields
In this field…
Do this…
Action
Specify what action to take when packets with incorrect checksums are
detected, by selecting one of the following:
Track

Block. Block the packets. This is the default.

None. No action.
Specify whether to log packets with incorrect checksums, by selecting one of
the following:

Log. Log the packets.

None. Do not log the packets. This is the default.
TCP
This category allows you to configure various protections related to the TCP protocol. It
includes the following:

Flags on page 450

Sequence Verifier on page 450
Chapter 14: Using SmartDefense
445
SmartDefense Categories

Small PMTU on page 447

Strict TCP on page 446

SynDefender on page 448
Strict TCP
Out-of-state TCP packets are SYN-ACK or data packets that arrive out of order, before the
TCP SYN packet.
Note: In normal conditions, out-of-state TCP packets can occur after the UTM-1
restarts, since connections which were established prior to the reboot are unknown.
This is normal and does not indicate an attack.
Note: Certain SmartDefense protections implicitly apply the Strict TCP protection to
relevant connections. In such cases, "TCP Out-of-State" log messages may appear in
the Security Log, even though the Strict TCP protection is disabled.
You can configure how out-of-state TCP packets should be handled.
Table 95: Strict TCP
In this field…
Do this…
Action
Specify what action to take when an out-of-state TCP packet arrives, by
selecting one of the following:

446
Block. Block the packets.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…

Track
None. No action. This is the default.
Specify whether to log null payload ping packets, by selecting one of the
following:

Log. Log the packets. This is the default.

None. Do not log the packets.
Small PMTU
Small PMTU (Packet MTU) is a bandwidth attack in which the client fools the server into
sending large amounts of data using small packets. Each packet has a large overhead that
creates a "bottleneck" on the server.
You can protect against this attack by specifying a minimum packet size for data sent over
the Internet.
Table 96: Small PMTU Fields
In this field…
Do this…
Action
Specify what action to take when a packet is smaller than the Minimal MTU Size
threshold, by selecting one of the following:

Block. Block the packet.

None. No action. This is the default.
Chapter 14: Using SmartDefense
447
SmartDefense Categories
In this field…
Do this…
Track
Specify whether to issue logs for packets are smaller than the Minimal MTU Size
threshold, by selecting one of the following:

Log. Issue logs. This is the default.

None. Do not issue logs.
Minimal MTU
Type the minimum value allowed for the MTU field in IP packets sent by a
Size
client.
An overly small value will not prevent an attack, while an overly large value
might degrade performance and cause legitimate requests to be dropped.
The default value is 300.
SynDefender
In a SYN attack, the attacker sends many SYN packets without finishing the three-way
handshake. This causes the attacked host to be unable to accept new connections.
You can protect against this attack by specifying a maximum amount of time for completing
handshakes.
448
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 97: SynDefender Fields
In this field…
Do this…
Action
Specify what action to take when a SYN attack occurs, by selecting one of the
following:

Block. Block the packet. This is the default.

None. No action.
A SYN attack is when more than 5 incomplete TCP handshakes are detected
within 10 seconds. A handshake is considered incomplete when it exceeds
the Maximum time for completing the handshake threshold.
Track
Specify whether to issue logs for the events specified by the Log Mode
parameter, by selecting one of the following:
Log mode

Log. Issue logs. This is the default.

None. Do not issue logs.
Specify upon which events logs should be issued, by selecting one of the
following:

None. Do not issue logs.

Log per attack. Issue logs for each SYN attack. This is the default.

Log individual unfinished handshakes. Issue logs for each incomplete
handshake.
This field is only relevant if the Track field is set to Log.
Maximum Time
Type the maximum amount of time in seconds after which a TCP handshake
for Completing
is considered incomplete.
the Handshake
The default value is 10 seconds.
Protect external
Specify whether SynDefender should be enabled for external (WAN)
interfaces only
interfaces only, by selecting one of the following:

Disabled. Enable SynDefender for all the firewall interfaces. This is
the default.

Enabled. Enable SynDefender for external interfaces only.
Chapter 14: Using SmartDefense
449
SmartDefense Categories
Sequence Verifier
The UTM-1 appliance examines each TCP packet's sequence number and checks whether it
matches a TCP connection state. You can configure how the appliance handles packets that
match a TCP connection in terms of the TCP session but have incorrect sequence numbers.
Table 98: Strict TCP
In this field…
Do this…
Action
Specify what action to take when TCP packets with incorrect sequence
numbers arrive, by selecting one of the following:
Track

Block. Block the packets.

None. No action. This is the default.
Specify whether to log TCP packets with incorrect sequence numbers, by
selecting one of the following:

Log. Log the packets. This is the default.

None. Do not log the packets.
Flags
The URG flag is used to indicate that there is urgent data in the TCP stream, and that the data
should be delivered with high priority. Since handling of the URG flag is inconsistent
between different operating systems, an attacker can use the URG flag to conceal certain
attacks.
450
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
You can configure how the URG flag should be handled.
Table 99: Flags Fields
In this field…
Do this…
URG Flag
Specify whether to clear or allow the URG flag, by selecting one of the
following:

Clear. Clear the URG flag on all incoming packets. This is the
default.

Allow. Allow the URG flag.
Port Scan
An attacker can perform a port scan to determine whether ports are open and vulnerable to an
attack. This is most commonly done by attempting to access a port and waiting for a
response. The response indicates whether or not the port is open.
This category includes the following types of port scans:

Host Port Scan. The attacker scans a specific host's ports to determine which of the
ports are open.

Sweep Scan. The attacker scans various hosts to determine where a specific port is
open.
Chapter 14: Using SmartDefense
451
SmartDefense Categories
You can configure how the UTM-1 appliance should react when a port scan is detected.
Table 100: Port Scan Fields
In this field…
Do this…
Number of ports
SmartDefense detects ports scans by measuring the number of ports
accessed
accessed over a period of time. The number of ports accessed must exceed
the Number of ports accessed value, within the number of seconds specified by
the In a period of [seconds] value, in order for SmartDefense to consider the
activity a scan.
Type the minimum number of ports that must be accessed within the In a period
of [seconds] period, in order for SmartDefense to detect the activity as a port
scan.
For example, if this value is 30, and 40 ports are accessed within a specified
period of time, SmartDefense will detect the activity as a port scan.
For Host Port Scan, the default value is 30. For Sweep Scan, the default value
is 50.
452
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
In this field…
Do this…
In a period of
SmartDefense detects ports scans by measuring the number of ports
[seconds]
accessed over a period of time. The number of ports accessed must exceed
the Number of ports accessed value, within the number of seconds specified by
the In a period of [seconds] value, in order for SmartDefense to consider the
activity a scan.
Type the maximum number of seconds that can elapse, during which the
Number of ports accessed threshold is exceeded, in order for SmartDefense to
detect the activity as a port scan.
For example, if this value is 20, and the Number of ports accessed threshold is
exceeded for 15 seconds, SmartDefense will detect the activity as a port scan.
If the threshold is exceeded for 30 seconds, SmartDefense will not detect the
activity as a port scan.
The default value is 20 seconds.
Track
Specify whether to issue logs for scans, by selecting one of the following:

Log. Issue logs. This is the default.

None. Do not issue logs. This is the default.
Detect scans from
Specify whether to detect only scans originating from the Internet, by selecting
Internet only
one of the following:

False. Do not detect only scans from the Internet. This is the
default.

True. Detect only scans from the Internet.
FTP
This category allows you to configure various protections related to the FTP protocol. It
includes the following:

Block Known Ports on page 455

Block Port Overflow on page 455

Blocked FTP Commands on page 457
Chapter 14: Using SmartDefense
453
SmartDefense Categories

FTP Bounce on page 454
FTP Bounce
When connecting to an FTP server, the client sends a PORT command specifying the IP
address and port to which the FTP server should connect and send data. An FTP Bounce
attack is when an attacker sends a PORT command specifying the IP address of a third party
instead of the attacker's own IP address. The FTP server then sends data to the victim
machine.
You can configure how FTP bounce attacks should be handled.
Table 101: FTP Bounce Fields
In this field…
Do this…
Action
Specify what action to take when an FTP Bounce attack occurs, by selecting
one of the following:
Track
454

Block. Block the attack. This is the default.

None. No action.
Specify whether to log FTP Bounce attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Block Known Ports
You can choose to block the FTP server from connecting to well-known ports.
Note: Known ports are published ports associated with services (for example, SMTP is
port 25).
This provides a second layer of protection against FTP bounce attacks, by preventing such
attacks from reaching well-known ports.
Table 102: Block Known Ports Fields
In this field…
Do this…
Action
Specify what action to take when the FTP server attempts to connect to a
well-known port, by selecting one of the following:

Block. Block the connection.

None. No action. This is the default.
Block Port Overflow
FTP clients send PORT commands when connecting to the FTP server. A PORT command
consists of a series of numbers between 0 and 255, separated by commas.
Chapter 14: Using SmartDefense
455
SmartDefense Categories
To enforce compliance to the FTP standard and prevent potential attacks against the FTP
server, you can block PORT commands that contain a number greater than 255.
Table 103: Block Port Overflow
In this field…
Do this…
Action
Specify what action to take for PORT commands containing a number greater
than 255, by selecting one of the following:
456

Block. Block the PORT command. This is the default.

None. No action.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Blocked FTP Commands
Some seldom-used FTP commands may compromise FTP server security and integrity. You
can specify which FTP commands should be allowed to pass through the security server, and
which should be blocked.
To enable FTP command blocking

In the Action drop-down list, select Block.
The FTP commands listed in the Blocked Commands box will be blocked.
FTP command blocking is enabled by default.
To disable FTP command blocking

In the Action drop-down list, select None.
All FTP commands are allowed, including those in the Blocked Commands box.
To block a specific FTP command
1.
In the Allowed Commands box, select the desired FTP command.
2.
Click Block.
The FTP command appears in the Blocked Commands box.
3.
Click Apply.
When FTP command blocking is enabled, the FTP command will be blocked.
Chapter 14: Using SmartDefense
457
SmartDefense Categories
To allow a specific FTP command
1.
In the Blocked Commands box, select the desired FTP command.
2.
Click Accept.
The FTP command appears in the Allowed Commands box.
3.
Click Apply.
The FTP command will be allowed, regardless of whether FTP command blocking is
enabled or disabled.
HTTP
This category allows you to configure various protections related to the HTTP protocol. It
includes the following:

Header Rejection on page 458

Worm Catcher on page 459
Header Rejection
Some exploits are carried in standard HTTP headers with custom values (for example, in the
Host header), or in custom HTTP headers. You can protect against such exploits by rejecting
HTTP requests that contain specific headers and header values.
458
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 104: Header Rejection Fields
In this field…
Do this…
Action
Specify what action to take when an HTTP header-based exploit is
detected, by selecting one of the following:
Track

Block. Block the attack.

None. No action. This is the default.
Specify whether to log HTTP header-based exploits, by selecting one of
the following:
HTTP header values

Log. Log the attack.

None. Do not log the attack. This is the default.
Select the HTTP header values to detect.
list
Worm Catcher
A worm is a self-replicating malware (malicious software) that propagates by actively
sending itself to new machines. Some worms propagate by using security vulnerabilities in
the HTTP protocol.
You can specify how HTTP-based worm attacks should be handled.
Chapter 14: Using SmartDefense
459
SmartDefense Categories
Table 105: Worm Catcher Fields
In this field…
Do this…
Action
Specify what action to take when an HTTP-based worm attack is detected,
by selecting one of the following:
Track

Block. Block the attack.

None. No action. This is the default.
Specify whether to log HTTP-based worm attacks, by selecting one of the
following:
HTTP-based worm

Log. Log the attack.

None. Do not log the attack. This is the default.
Select the worm patterns to detect.
patterns list
Microsoft Networks
This category includes File and Print Sharing.
Microsoft operating systems and Samba clients rely on Common Internet File System
(CIFS), a protocol for sharing files and printers. However, this protocol is also widely used
by worms as a means of propagation.
You can configure how CIFS worms should be handled.
460
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 106: File Print and Sharing Fields
In this field…
Do this…
Action
Specify what action to take when a CIFS worm attack is detected, by
selecting one of the following:
Track

Block. Block the attack.

None. No action. This is the default.
Specify whether to log CIFS worm attacks, by selecting one of the
following:


CIFS worm patterns
list
Log. Log the attack.
None. Do not log the attack. This is the default.
Select the worm patterns to detect.
Patterns are matched against file names (including file paths but
excluding the disk share name) that the client is trying to read or
write from the server.
IGMP
This category includes the IGMP protocol.
IGMP is used by hosts and routers to dynamically register and discover multicast group
membership. Attacks on the IGMP protocol usually target a vulnerability in the multicast
routing software/hardware used, by sending specially crafted IGMP packets.
Chapter 14: Using SmartDefense
461
SmartDefense Categories
You can configure how IGMP attacks should be handled.
Table 107: IGMP Fields
In this field…
Do this…
Action
Specify what action to take when an IGMP attack occurs, by selecting one
of the following:
Track

Block. Block the attack. This is the default.

None. No action.
Specify whether to log IGMP attacks, by selecting one of the following:

Log. Log the attack. This is the default.

None. Do not log the attack.
Enforce IGMP to
According to the IGMP specification, IGMP packets must be sent to
multicast addresses
multicast addresses. Sending IGMP packets to a unicast or broadcast
address might constitute and attack; therefore the UTM-1 appliance blocks
such packets.
Specify whether to allow or block IGMP packets that are sent to
non-multicast addresses, by selecting one of the following:
462

Block. Block IGMP packets that are sent to non-multicast
addresses. This is the default.

None. No action.
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
VoIP
Voice over IP (VoIP) traffic is subject to various threats, such as:

Call redirections, in which calls intended for one recipient are redirected to
another

Stealing calls, where the caller pretends to be someone else

System hacking, using ports that were opened for VoIP connections
This category allows you to configure various protections related to VoIP protocols. It
includes the following:

SIP on page 463

H.323 on page 464
SIP
The SmartDefense SIP Application Level Gateway (ALG) processes the SIP protocol,
allows firewall and NAT traversal, and enables Traffic Shaper to operate on SIP
connections.
By default, the SIP ALG checks SIP sessions for RFC compliance. If desired, you can allow
non-RFC-compliant SIP connections, so that VoIP devices that initiate non-standard SIP
calls can communicate through the firewall. You can also disable the SIP ALG altogether, if
it is not needed by your SIP clients, or if it interferes with their operation.
Chapter 14: Using SmartDefense
463
SmartDefense Categories
Table 108: SIP Fields
In this field…
Do this…
SIP Protocol
Specify whether to enable SIP support, by selecting one of the following:
Handler

Enabled. Enable SIP support. This is the default.

Disabled. Disable SIP support.
RFC
Specify what action to take when non-RFC-compliant SIP packets arrive, by
Non-compliant
selecting one of the following:
Messages

Block. Block the packets. This is the default.

None. No action.
H.323
H.323 telephony is used by various devices and applications, such as Microsoft Netmeeting.
SmartDefense allows you to choose whether to disable or enable the H.323 Application
Level Gateway (ALG), which allows firewall and NAT traversal of H.323 calls.
Table 109: H.323 Fields
In this field…
Do this…
Peer-to-peer
Specify whether to enable H.323 support, by selecting one of the following:
H.323 Support

Enabled. Enable H.323 support.

Disabled. Disabled H.323 support. This is the default.
464
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Peer-to-Peer
SmartDefense can block peer-to-peer file-sharing traffic, by identifying the proprietary
protocols and preventing the initial connection to the peer-to-peer networks. This prevents
not only downloads, but also search operations.
This category includes the following nodes:

BitTorrent

eMule

Gnutella

KaZaA

Winny
Note: SmartDefense can detect peer-to-peer traffic regardless of the TCP port being
used to initiate the session.
In each node, you can configure how peer-to-peer connections of the selected type should be
handled, using the following table.
Table 110: Peer to Peer Fields
In this field…
Do this…
Action
Specify what action to take when a connection is attempted, by selecting
Chapter 14: Using SmartDefense
465
SmartDefense Categories
In this field…
Do this…
one of the following:
Track

Block. Block the connection.

None. No action. This is the default.
Specify whether to log peer-to-peer connections, by selecting one of the
following:

Log. Log the connection.

None. Do not log the connection. This is the default.
Block proprietary
Specify whether proprietary protocols should be blocked on all ports, by
protocols on all ports
selecting one of the following:

Block. Block the proprietary protocol on all ports. This in effect
prevents all communication using this peer-to-peer application.
This is the default.

None. Do not block the proprietary protocol on all ports.
Block masquerading
Specify whether to block using the peer-to-peer application over HTTP, by
over HTTP protocol
selecting one of the following:

Block. Block using the application over HTTP. This is the
default.

None. Do not block using the application over HTTP.
This field is not relevant for eMule and Winny.
Instant Messaging Traffic
SmartDefense can block instant messaging applications that use VoIP protocols, by
identifying the messaging application's fingerprints and HTTP headers.
This category includes the following nodes:

ICQ

MSN Messenger

Skype

Yahoo
466
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Note: SmartDefense can detect instant messaging traffic regardless of the TCP port
being used to initiate the session.
Note: Skype versions up to 2.0.0.103 are supported.
In each node, you can configure how instant messaging connections of the selected type
should be handled, using the following table.
Table 111: Instant Messengers Fields
In this field…
Do this…
Action
Specify what action to take when a connection is attempted, by selecting
one of the following:
Track

Block. Block the connection.

None. No action. This is the default.
Specify whether to log instant messenger connections, by selecting one of
the following:

Log. Log the connection.

None. Do not log the connection. This is the default.
Chapter 14: Using SmartDefense
467
SmartDefense Categories
In this field…
Do this…
Block proprietary
Specify whether proprietary protocols should be blocked on all ports, by
protocol /
selecting one of the following:
Block proprietary

Block. Block the proprietary protocol on all ports. This in effect
prevents all communication using this instant messenger
application. This is the default.

None. Do not block the proprietary protocol on all ports.
protocols on all ports
Block masquerading
Specify whether to block using the instant messenger application over
over HTTP protocol
HTTP, by selecting one of the following:

Block. Block using the application over HTTP. This is the
default.

None. Do not block using the application over HTTP.
Games
This category includes XBox LIVE.
XBox 360 requires gateways hosting XBox LIVE games to use the "Open NAT" method
rather than the normal "Strict NAT" method. Therefore, if you want to host online games on
an XBox 360 console, you must first configure your UTM-1 appliance to use the "Open
NAT" method.
468
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Table 112: XBox LIVE Fields
In this field…
Do this…
Xbox Live OpenNAT
Specify whether the UTM-1 appliance should use the "Open NAT"
method, by selecting one of the following:

Enabled. Use the "Open NAT" method. You will be able to host
XBox LIVE games and join existing ones.

Disabled. Do not use the "Open NAT" method. You will not be
able to host XBox LIVE games, but you will still be able to join
existing ones. This is the default.
SCADA
This category allows you to configure various protections related to supervisory control and
data acquisition (SCADA) equipment. It includes the following:

Modbus/TCP on page 469

Modbus/TCP Policy on page 471
Modbus/TCP
SCADA equipment uses the Modbus/TCP protocol over TCP port 502 for communication.
You can configure SmartDefense to scan Modbus/TCP connections, enforce compliance to
the Modbus/TCP standard, and limit Modbus/TCP requests to a specified set of functions,
devices, and registers.
Chapter 14: Using SmartDefense
469
SmartDefense Categories
Table 113: Modbus/TCP Fields
In this field…
Do this…
Action
Specify what action to take when a Modbus/TCP connection does not
match the protocol compliance and/or the Modbus function policy , by
selecting one of the following:
Track

Block. Block the connection.

None. No action. This is the default.
Specify whether to log Modbus/TCP connections that do not match
protocol compliance and/or the Modbus function policy, by selecting one of
the following:

Log. Log the connection.

None. Do not log the connection. This is the default.
Verify protocol
Specify whether to verify compliance to the Modbus/TCP standard, by
compliance
selecting one of the following:

Enabled. Verify compliance.

Disabled. Do not verify compliance. This is the default.
Specify Modbus
Specify whether to block Modbus commands that do not comply with the
function policy
Modbus function policy, by selecting one of the following:

Enabled. Block all Modbus commands that do not match the
function policy.

Disabled. Do not enforce the Modbus function policy. This is the
default.
If you select Enabled, you must configure the Modbus function policy. See
Modbus/TCP Policy on page 471.
470
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
Modbus/TCP Policy
If you enabled blocking Modbus commands that do not comply with the Modbus function
policy (see Modbus/TCP on page 469), then you must configure the Modbus function
policy. This policy is comprised of a list of allowed Modbus/TCP commands.
Adding and Editing Allowed Commands
To add or edit an allowed command
1.
Do one of the following:

To add a new command, click Add.

To edit an existing command, click
Chapter 14: Using SmartDefense
next to the desired command.
471
SmartDefense Categories
The Modbus/TCP Allowed Command Wizard opens displaying the Step1: Select Function
dialog box.
2.
Complete the fields using the information in the following table.
3.
Click Next.
The Step 2: Additional Information dialog box appears.
472
Check Point UTM-1 Embedded NGX User Guide
SmartDefense Categories
4.
Complete the fields using the information in the following table.
5.
Click Next.
The Step 3: Destination & Source dialog box appears.
6.
Complete the fields using the information in the following table.
7.
Click Finish.
The new command appears in the Modbus/TCP Policy table.
Table 114: Modbus/TCP Allowed Command Wizard Fields
In this field…
Do this…
Any Function
Click this option to specify that the allowed command can include any
function.
Standard
Click this option to specify that the allowed command must include a specific
Function
standard function.
You must then select the desired function from the drop-down list.
Custom Function
Click this option to specify that the allowed command must include a specific
Chapter 14: Using SmartDefense
473
SmartDefense Categories
In this field…
Do this…
non-standard function.
The Function Range fields are enabled. You must fill them in.
Function Range
To specify the function range, type the start function number in the left text
box, and the end function number in the right text box.
The function numbers must be between 1 and 255.
Note: If you enter only one function number, the range will include only that
function.
Any Unit
Click this option to specify that the allowed function(s) can access any
Modbus/TCP unit.
Specified Unit ID
Click this option to specify that the allowed function(s) can access a specific
Modbus/TCP unit only, then type the allowed unit's ID number in the field
provided. The ID number must be between 0 and 255.
The connection
Select the source of the functions you want to allow. This list includes network
source is
objects.
To specify an IP address, select Specified IP and type the desired IP address in
the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP address, select This Gateway.
To specify any source, select ANY.
And the
Select the destination of the functions you want to allow. This list includes
destination is
network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the text box.
474
Check Point UTM-1 Embedded NGX User Guide
Resetting SmartDefense to its Defaults
In this field…
Do this…
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP addresses, select This Gateway.
To specify any destination except the UTM-1 Portal IP addresses, select ANY.
Deleting Allowed Commands
To delete an allowed command
1.
In the desired command’s row, click
.
A confirmation message appears.
2.
Click OK.
The command is deleted.
Resetting SmartDefense to its Defaults
If desired, you can reset the SmartDefense security policy to its default settings. For
information on the default value of each SmartDefense setting, see SmartDefense
Categories on page 429.
For information on resetting individual nodes in the SmartDefense tree to their default
settings, see Using the SmartDefense Tree on page 427.
To reset SmartDefense to its defaults
1.
Click Security in the main menu, and click the SmartDefense tab.
The SmartDefense page appears.
2.
Click Reset to Defaults.
A confirmation message appears.
3.
Click OK.
Chapter 14: Using SmartDefense
475
Resetting SmartDefense to its Defaults
The SmartDefense policy is reset to its default settings.
476
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 15
Using Antivirus and Antispam Filtering
This chapter explains how to use antivirus and antispam filtering.
This chapter includes the following topics:
Overview ..................................................................................................477
Using VStream Antivirus .........................................................................479
Using VStream Antispam .........................................................................495
Using Centralized Email Filtering ............................................................ 525
Overview
The UTM-1 appliance enables you to perform both antivirus and antispam filtering, to
ensure your network remains secure.
Antivirus Filtering Solutions
You can scan connections for viruses, by using VStream Antivirus and/or the Email
Antivirus subscription service (part of the centralized Email Filtering service). The
following table describes the main differences between VStream Antivirus and the Email
Antivirus service:
Table 115: Comparison of Antivirus Filtering Methods
Supported Protocols
VStream Antivirus
Email Antivirus
VStream Antivirus supports
Email Antivirus is specific to email,
multiple protocols, including
scanning incoming POP3 and outgoing
incoming SMTP and outgoing
SMTP connections only.
POP3 connections.
Chapter 15: Using Antivirus and Antispam Filtering
477
Overview
Point of Enforcement
VStream Antivirus
Email Antivirus
VStream Antivirus scans for
Email Antivirus is centralized, redirecting
viruses in the UTM-1 gateway
traffic through the Service Center for
itself.
scanning.
You can use either antivirus solution, or both in conjunction.
Antispam Filtering Solutions
You can scan email messages for spam, by using VStream Antispam and/or the Email
Antispam subscription service (part of the centralized Email Filtering service). The
following table describes the main differences between VStream Antispam and the Email
Antispam service:
Table 116: Comparison of Antispam Filtering Methods
Supported Protocols
VStream Antispam
Email Antispam
VStream Antispam supports both
Email Antispam scans incoming POP3 and
incoming and outgoing POP3 and
outgoing SMTP connections only.
SMTP, as well as POP3 and
SMTP connections between
internal networks.
Point of Enforcement
VStream Antispam scans for
Email Antispam is centralized, redirecting
spam in the UTM-1 gateway itself.
traffic through the Service Center for
scanning.
You can use either antispam solution, or both in conjunction.
478
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
Using VStream Antivirus
The UTM-1 appliance includes VStream Antivirus, an embedded stream-based antivirus
engine based on Check Point Stateful Inspection and Application Intelligence technologies,
that performs virus scanning at the kernel level.
VStream Antivirus scans files for malicious content on the fly, without downloading the
files into intermediate storage. This means minimal added latency and support for unlimited
file sizes; and since VStream Antivirus stores only minimal state information per
connection, it can scan thousands of connections concurrently. In order to scan archive files
on the fly, VStream Antivirus performs real-time decompression and scanning of ZIP, TAR,
and GZ archive files, with support for nested archive files.
If you are subscribed to the VStream Antivirus subscription service, VStream Antivirus
virus signatures are automatically updated, so that security is always up-to-date, and your
network is always protected.
VStream Antivirus Actions
When VStream Antivirus detects malicious content, the action it takes depends on the
protocol in which the virus was found. See the following table. In each case, VStream
Antivirus blocks the file and writes a log to the Event Log.
Table 117: VStream Antivirus Actions
If a virus if found in
VStream Antivirus does this...
this protocol...
HTTP
The protocol is detected
on this port...

Terminates the
connection
All ports on which VStream
Antivirus is enabled by the
policy, not only port 80
POP3

Terminates the
connection

Deletes the virus-infected
email from the server
Chapter 15: Using Antivirus and Antispam Filtering
The standard TCP port 110.
479
Using VStream Antivirus
If a virus if found in
VStream Antivirus does this...
this protocol...
IMAP
SMTP
FTP
TCP and UDP
The protocol is detected
on this port...

Terminates the
connection

Replaces the
virus-infected email with a
message notifying the
user that a virus was
found

Rejects the virus-infected
email with error code 554

Sends a "Virus detected"
message to the sender

Terminates the data
connection

Sends a "Virus detected"
message to the FTP client

Terminates the
connection
The standard TCP port 143
The standard TCP port 25
The standard TCP port 21
Generic TCP and UDP ports,
other than those listed above
Note: In protocols that are not listed in this table, VStream Antivirus uses a "best effort"
approach to detect viruses. In such cases, detection of viruses is not guaranteed and
depends on the specific encoding used by the protocol.
Default Antivirus Policy
The VStream Antivirus default policy includes the following rules:

All SMTP connections are scanned, regardless of the connection's direction.

All POP3 connections are scanned, regardless of the connection's direction.

All IMAP connections are scanned, regardless of the connection's direction.
You can easily override the default antivirus policy, by creating user-defined rules. For
further information, see Configuring the VStream Antivirus Policy on page 482.
480
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
Enabling/Disabling VStream Antivirus
To enable/disable VStream Antivirus
1.
Click Antivirus in the main menu, and click the Antivirus tab.
The VStream Antivirus page appears.
2.
Drag the On/Off lever upwards or downwards.
VStream Antivirus is enabled/disabled for all internal network computers.
Viewing VStream Antivirus Signature Database
Information
VStream Antivirus maintains two databases: a daily database and a main database. The daily
database is updated frequently with the newest virus signatures. Periodically, the contents of
the daily database are moved to the main database, leaving the daily database empty. This
system of incremental updates to the main database allows for quicker updates and saves on
network bandwidth.
Chapter 15: Using Antivirus and Antispam Filtering
481
Using VStream Antivirus
You can view information about the VStream Antivirus signature databases currently in use,
in the VStream Antivirus page.
Table 118: VStream Antivirus Page Fields
This field…
Displays…
Main database
The date and time at which the main database was last updated, followed
by the version number.
Daily database
The date and time at which the daily database was last updated, followed
by the version number.
Next update
The next date and time at which the UTM-1 appliance will check for
updates.
Status
The current status of the database. This includes the following statuses:

Database Not Installed

OK
Configuring the VStream Antivirus Policy
VStream Antivirus includes a flexible mechanism that allows the user to define exactly
which traffic should be scanned, by specifying the protocol, ports, and source and
destination IP addresses.
VStream Antivirus processes policy rules in the order they appear in the Antivirus Policy
table, so that rule 1 is applied before rule 2, and so on. This enables you to define exceptions
to rules, by placing the exceptions higher up in the Rules table.
482
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
For example, if you want to scan all outgoing SMTP traffic, except traffic from a specific IP
address, you can create a rule scanning all outgoing SMTP traffic and move the rule down in
the Antivirus Policy table. Then create a rule passing SMTP traffic from the desired IP
address and move this rule to a higher location in the Antivirus Policy table than the first rule.
In the figure below, the general rule is rule number 2, and the exception is rule number 1.
The UTM-1 appliance will process rule 1 first, passing outgoing SMTP traffic from the
specified IP address, and only then it will process rule 2, scanning all outgoing SMTP traffic.
The following rule types exist:
Table 119: VStream Antivirus Rule Types
Rule
Description
Pass
This rule type enables you to specify that VStream Antivirus should not scan traffic
matching the rule.
Scan
This rule type enables you to specify that VStream Antivirus should scan traffic
matching the rule.
If a virus is found, it is blocked and logged.
Chapter 15: Using Antivirus and Antispam Filtering
483
Using VStream Antivirus
Adding and Editing VStream Antivirus Rules
To add or edit a VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears.
2.
484
Do one of the following:

To add a new rule, click Add Rule.

To edit an existing rule, click
next to the desired rule.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
The VStream Policy Rule Wizard opens, with the Step 1: Rule Type dialog box displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Service dialog box appears.
The example below shows a Scan rule.
Chapter 15: Using Antivirus and Antispam Filtering
485
Using VStream Antivirus
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The Step 3: Destination & Source dialog box appears.
7.
To configure advanced settings, click Show Advanced Settings.
New fields appear.
486
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
8.
Complete the fields using the relevant information in the following table.
9.
Click Next.
The Step 4: Done dialog box appears.
10. If desired, type a description of the rule in the field provided.
11. Click Finish.
The new rule appears in the Antivirus Policy page.
Table 120: VStream Antivirus Rule Fields
In this field…
Do this…
Any Service
Click this option to specify that the rule should apply to any service.
Standard Service
Click this option to specify that the rule should apply to a specific standard
service or network service object.
You must then select the desired service or network service object from the
drop-down list.
Chapter 15: Using Antivirus and Antispam Filtering
487
Using VStream Antivirus
In this field…
Do this…
Custom Service
Click this option to specify that the rule should apply to a specific non-standard
service.
The Protocol and Port Range fields are enabled. You must fill them in.
Protocol
Select the protocol (TCP, UDP, or ANY) for which the rule should apply.
Port Range
To specify the port range to which the rule applies, type the start port number
in the left text box, and the end port number in the right text box.
Note: If you do not enter a port range, the rule will apply to all ports. If you enter
only one port number, the range will include only that port.
If the connection
Select the source of the connections you want to allow/block. This list includes
source is
network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify any source, select ANY.
And the
Select the destination of the connections you want to allow or block. This list
destination is
includes network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the text box.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP addresses, select This Gateway.
To specify any destination except the UTM-1 Portal IP addresses, select ANY.
488
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
In this field…
Do this…
Data Direction
Select the direction of connections to which the rule should apply:

Download and Upload data. The rule applies to downloaded and
uploaded data. This is the default.

Download data. The rule applies to downloaded data, that is, data
flowing from the destination of the connection to the source of the
connection.

Upload data. The rule applies to uploaded data, that is, data flowing
from the source of the connection to the destination of the
connection.
If the current time
Select this option to specify that the rule should be applied only during certain
is
hours of the day.
You must then use the fields and drop-down lists provided, to specify the
desired time range.
Enabling/Disabling VStream Antivirus Rules
You can temporarily disable a VStream Antivirus rule.
To enable/disable a VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears.
2.
Next to the desired rule, do one of the following:

To enable the rule, click
The button changes to

To disable the rule, click
The button changes to
.
and the rule is enabled.
.
and the rule is disabled.
Chapter 15: Using Antivirus and Antispam Filtering
489
Using VStream Antivirus
Reordering VStream Antivirus Rules
To reorder VStream Antivirus rules
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears.
2.
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Viewing and Deleting VStream Antivirus Rules
To view or delete an existing VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears with a list of existing VStream Antivirus rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
b.
In the desired rule's row, click
.
A confirmation message appears.
Click OK.
The rule is deleted.
Configuring VStream Antivirus Advanced Settings
To configure VStream Antivirus advanced settings
1.
490
Click Antivirus in the main menu, and click the Advanced tab.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
The Advanced Antivirus Settings page appears.
2.
Complete the fields using the following table.
3.
Click Apply.
4.
To restore the default VStream Antivirus settings, do the following:
Click Default.
A confirmation message appears.
b) Click OK.
The VStream Antivirus settings are reset to their defaults. For information on the
default values, refer to the following table.
a)
Chapter 15: Using Antivirus and Antispam Filtering
491
Using VStream Antivirus
Table 121: Advanced Antivirus Settings Fields
In this field…
Do this…
File Types
Block potentially unsafe file
Select this option to block all emails containing potentially unsafe
types in email messages
attachments.
Unsafe file types are:

DOS/Windows executables, libraries and drivers

Compiled HTML Help files

VBScript encoded files

Files with {CLSID} in their name

The following file extensions: ade, adp, bas, bat, chm,
cmd, com, cpl, crt, exe, hlp, hta, inf, ins, isp, js, jse, lnk,
mdb, mde, msc, msi, msp, mst, pcd, pif, reg, scr, sct,
shs, shb, url, vb, vbe, vbs, wsc, wsf, wsh.
To view a list of unsafe file types and their descriptions, click Show
next to this option.
Pass safe file types without
Select this option to accept common file types that are known to be
scanning
safe, without scanning them.
Safe files types are:
492

GIF

BMP

JFIF standard

EXIF standard

PNG

MPEG video stream

MPEG sys stream

Ogg Stream

MP3 file with ID3 version 2

MP3

PDF

PostScript
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antivirus
In this field…
Do this…

WMA/WMV/ASF

RealMedia file

JPEG - only the header is scanned, and the rest of the
file is skipped
To view a list of safe file types, click Show next to this option.
Selecting this option reduces the load on the gateway by skipping
safe file types. This option is selected by default.
Archive File Handling
Maximum Nesting Level
Type the maximum number of nested content levels that VStream
Antivirus should scan.
Setting a higher number increases security. Setting a lower number
prevents attackers from overloading the gateway by sending
extremely nested archive files.
The default value is 5 levels.
Maximum Compression
Fill in the field to complete the maximum compression ratio of files
Ratio 1:x
that VStream Antivirus should scan.
For example, to specify a 1:80 maximum compression ratio, type
80.
Setting a higher number allows the scanning of highly compressed
files, but creates a potential for highly compressible files to create a
heavy load on the appliance. Setting a lower number prevents
attackers from overloading the gateway by sending extremely
compressible files.
The default value is 100.
Chapter 15: Using Antivirus and Antispam Filtering
493
Using VStream Antivirus
In this field…
Do this…
When archived file exceeds
Specify how VStream Antivirus should handle files that exceed the
limit or extraction fails
Maximum nesting level or the Maximum compression ratio, and files for
which scanning fails. Select one of the following:

Pass file without scanning. Scan only the number of levels
specified, and skip the scanning of more deeply nested
archives. Furthermore, skip scanning highly
compressible files, and skip scanning archives that
cannot be extracted because they are corrupt. This is
the default.

Block file. Block the file.
When a password-protected VStream Antivirus cannot extract and scan password-protected
file is found in archive
files inside archives. Specify how VStream Antivirus should handle
such files, by selecting one of the following:

Pass file without scanning. Accept the file without scanning
it. This is the default.

Block file. Block the file.
Corrupt Files
When a corrupt file is found
Specify how VStream Antivirus should handle corrupt files and
or decoding fails
protocol anomalies, by selecting one of the following:

Ignore and continue scanning. Log the corrupt file or
protocol anomaly, and scan the information on a
best-effort basis. This is the default.

Block file. Block and log the corrupt file or protocol
anomaly.
Updating VStream Antivirus
When you are subscribed to the VStream Antivirus updates service, VStream Antivirus
virus signatures are automatically updated, keeping security up-to-date with no need for user
intervention. However, you can still check for updates manually, if needed.
494
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
To update the VStream Antivirus virus signature database
1.
Click Antivirus in the main menu, and click the Antivirus tab.
The VStream Antivirus page appears.
2.
Click Update Now.
The VStream Antivirus database is updated with the latest virus signatures.
Using VStream Antispam
The UTM-1 appliance includes VStream Antispam, an embedded antispam engine that
scans emails for spam. VStream Antispam is composed three antispam engines, each of
which can be enabled or disabled separately:

IP Reputation
The IP Reputation engine protects mail servers by checking the email sender’s IP
address against an online and constantly updated IP reputation database, before
accepting the SMTP email connection. If the IP address belongs to a known spammer,
the connection can be immediately blocked at the TCP connection level, thereby
stopping the spam before it reaches your mail server.
Note: If you have a mail server in your network, it is recommended to enable the IP
Reputation engine as a first line of defense for incoming SMTP connections. When
enabled, the IP Reputation engine blocks emails that would otherwise reach your mail
server and require extensive analysis by the Content Based Antispam and Block List
engines, both of which examine email content and consume network, gateway, and
mail server resources. By reducing the amount of emails that require in-depth
analysis, the IP Reputation engine helps prevent Denial of Service (DoS) attacks on
your gateway or mail server.
If you do not have a mail server in your network, there is no need to enable the IP
Reputation engine. (If you do enable this engine anyway, it will have no negative
effects.)

Block List
VStream Antispam allows configuring a list of senders whose emails should be
blocked. When an email reaches your mail server, the Block List engine determines
Chapter 15: Using Antivirus and Antispam Filtering
495
Using VStream Antispam
whether the sender's email address appears on the list. If so, then VStream Antispam
blocks the emails.

Content Based Antispam
The Content Based Antispam engine calculates a ―spam fingerprint‖ for each incoming
email message. The fingerprint is then sent to a VStream Antispam data center and
compared to a constantly updated database of spam messages. The data center returns a
"spam score", which is a value in percentages indicating the likelihood that the message
is spam. If the spam score exceeds a user-configurable threshold called the ―confidence
level‖, the message can be flagged as spam, or the message can be deleted altogether.
In addition, VStream Antispam allows you to define a Safe Sender List, which consists of
senders who are exempt from the Block List and Content Based Antispam engines.
The following table provides a comparison of the VStream Antispam engines.
Table 122: Comparison of VStream Antispam Engines
IP Reputation
Content Based Antispam and Block
List
Supported Protocols
Protects mail servers only, and
Protects both mail servers and mail
applies to the SMTP protocol only
clients, and applies to both POP3 and
SMTP protocols
Email Scanning Time
Detection Method
Scans the email before accepting
Scans the email after accepting the
the connection
connection
Examines the sender's IP address
Content Based Antispam examines the
email's content, and Block List examines
the email's Sender field.
SMTP Error Message
Mail Rejection
Method
Does not return an SMTP error
Returns an SMTP error message to the
message to the email sender
email sender
Resets the TCP connection
Marks the email Subject line, marks the
email header, rejects the email (SMTP
only), or deletes the email (POP3 only)
496
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
IP Reputation
Content Based Antispam and Block
List
Server Overload
Prevents spammers from
Does not prevent spammers from
Protection
overloading gateway and mail
overloading gateway and mail server
server resources
resources
Important: In order to use VStream Antispam, your UTM-1 appliance must be subscribed
to a Service Center.
How VStream Antispam Works
Figure 38: VStream Antispam Flow
VStream Antispam works as follows:
1.
A TCP connection arrives at the SMTP port (TCP 25) or the POP3 port (TCP
110).
2.
The connection is checked against the VStream Antispam policy, to determine
whether it should be scanned.
3.
If the IP Reputation engine is enabled, and the connection is an SMTP
connection:
Chapter 15: Using Antivirus and Antispam Filtering
497
Using VStream Antispam
a.
4.
5.
VStream Antispam sends the connection's source IP address to a VStream
Antispam data center.
b. The VStream Antispam data center checks the reputation of this IP address
against a list of known spam sender IP addresses, and then returns a spam
score.
c. One of the following things happens:
 If the spam score does not exceed the configured confidence level, the
email passes to the next enabled VStream Antispam engine for processing.
 If the spam score exceeds the configured confidence level, VStream
Antispam determines that the email is spam and handles it as specified by
the IP Reputation engine's settings.
d. VStream Antispam caches the results of the IP Reputation check.
VStream Antispam checks whether the email sender appears on the Safe Sender
List. If so, then the email is accepted.
If the Block List engine is enabled:
a.
6.
VStream Antispam examines the email content and compares the sender to
the list of blocked senders.
b. One of the following things happens:
 If the sender is not on the list of blocked senders, the email passes to the
next enabled VStream Antispam engine for processing.
 If the sender is on the list of blocked senders, VStream Antispam
determines that the email is spam and handles it as specified by the Block
List engine's settings.
By default, VStream Antispam marks the email subject.
If the Content Based Antispam engine is enabled:
a.
b.
c.
d.
498
VStream Antispam examines the email content and creates a spam
fingerprint.
VStream Antispam sends the fingerprint to a VStream Antispam data
center, where it is checked against an online database of spam messages.
The VStream Antispam data center returns a spam score.
One of the following things happens:
 If the spam score does not exceed the configured confidence level, the
email is accepted.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam

7.
If the spam score exceeds the configured confidence level, VStream
Antispam determines that email is spam and handles it and handles it as
specified by the Content Based Antispam engine's settings.
By default, VStream Antispam marks the email as spam.
One of the following things happen:


If the connection is an SMTP connection, the mail server forwards the email to
the recipient.
If the connection is a POP3 connection, the email client receives the email.
Header Marking
VStream Antispam adds the following headers to each email that is scanned by the Content
Based Antispam or Block List engine, but not blocked:

X-VStream-Spam-Level. Contains an integer between 0 and 100, where 100
indicates the highest likelihood that the email is spam.

X-VStream-Engine. The VStream Antispam engine, (either "Content Based
Antispam" or "Block List")

X-Spam-Level. Contains one to five asterisks, where five asterisks indicate the
highest likelihood that the email is spam.

X-Spam-Flag. Contains YES if the email is deemed to be spam, according to
the currently configured thresholds.
For example:
X-VStream-Spam-Level: 81%
X-VStream-Engine: Content Based Antispam
X-Spam-Level: ***
X-Spam-Flag: YES
If your email client allows defining rules based on message headers, you can create rules
specifying that emails with certain headers should be moved to specific folders. For
example, you can configure your email client to move all emails with the X-Spam-Flag:
YES header directly to a "Spam Email" folder.
Chapter 15: Using Antivirus and Antispam Filtering
499
Using VStream Antispam
Default Antispam Policy
The VStream Antispam default policy includes the following rules:

All incoming SMTP connections are scanned, unless they originate from VPN.
This protects mail servers in your network.

All outgoing POP3 connections are scanned. This protects mail clients in your
network.
You can easily override the default antispam policy, for example to exclude certain
addresses or networks from spam scanning, by creating user-defined rules. For further
information, see Configuring the VStream Antispam Policy on page 515.
Enabling/Disabling VStream Antispam
You must enable at least one VStream Antispam engine in order for VStream Antispam to
work. Once you have enabled the desired engines, you must configure them, using the
relevant sections in this guide.
To enable/disable VStream Antispam
1.
500
Click Antispam in the main menu, and click the Antispam tab.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
The VStream Antispam page appears.
2.
Complete the fields using the information in the following table.
Table 123: VStream Antispam Fields
In this field…
Do this…
Content Based
Specify the Content Based Antispam engine's mode, by dragging the lever
Antispam
to one of the following:

On. The Content Based Antispam engine is on. VStream
Antispam will check email fingerprints against an online spam
detection database. Emails that fail the check will be handled
according to configured Content Based Antispam settings.

Monitor Only. The Content Based Antispam engine is on.
VStream Antispam will check email fingerprints against an
online spam detection database. Emails that fail the check will
be logged only, and any action configured in the Content Based
Antispam Settings page will not be performed.

Off. The Content Based Antispam engine is off.
Chapter 15: Using Antivirus and Antispam Filtering
501
Using VStream Antispam
In this field…
Do this…
You can then click Settings to configure the Content Based Antispam
settings. For further information, see Configuring the Content Based
Antispam Engine on page 504.
Block List
Specify the Block List engine's mode, by dragging the lever to one of the
following:

On. The Block List engine is on. VStream Antispam will check
email messages against a list of blocked senders. Emails that
fail the check will be handled according to configured Block List
settings.

Monitor Only. The Block List engine is on. VStream Antispam will
check email messages against a list of blocked senders. Emails
that fail the check will be logged only, and any action configured
in the Antispam Block List Settings page will not be performed.

Off. The Block List engine is off.
You can then click Settings to configure the Block List settings. For further
information, see Configuring the Block List Engine Settings on page
510.
IP Reputation
Specify the IP Reputation engine's mode for SMTP connections, by
Checking
dragging the lever to one of the following:
502

On. The IP Reputation engine is on. VStream Antispam will
check the reputation of email senders against an online IP
reputation database prior to accepting the TCP connection.
Emails that fail the check will be handled according to
configured IP Reputation settings.

Monitor Only. The IP Reputation engine is on. VStream Antispam
will check the reputation of email senders against an online IP
reputation database. Emails that fail the check will be logged
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
In this field…
Do this…
only, and any action configured in the Antispam IP Reputation
Settings page will not be performed.

Off. The IP Reputation engine is off.
You can then click Settings to configure the IP Reputation settings. For
further information, see Configuring the IP Reputation Engine on page
512.
Viewing VStream Antispam Statistics
To view VStream Antispam statistics

Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
Table 124: VStream Antispam Status Fields
This field…
Displays...
Email Messages
Statistics for the Content Based Antispam and Block List engines.
Pending
The number of SMTP and POP3 email messages pending for the Content
Based Antispam and Block List engines.
Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be spam.
Suspected Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be suspected spam.
Chapter 15: Using Antivirus and Antispam Filtering
503
Using VStream Antispam
This field…
Displays...
Not scanned
The number of SMTP and POP3 email messages that were not scanned,
due to temporary loss of contact with the VStream Antispam data center, or
due to gateway resource overload.
Non Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be legitimate.
Total
The total number of SMTP and POP3 email messages scanned by the
Content Based Antispam and Block List engines.
IP Reputation
Statistics for the IP Reputation engine.
Pending
The number of SMTP email connections currently pending for handling by
the IP Reputation engine.
Allowed
The number of SMTP email connections allowed by the IP Reputation
engine.
Blocked
The number of SMTP email connections blocked by the IP Reputation
engine.
Total
The total number of SMTP email connections scanned by the IP Reputation
engine.
Configuring the Content Based Antispam Engine
You can configure how VStream Antispam should handle spam and suspected spam that is
detected by the Content Based Antispam engine.
For information on enabling this engine, see Enabling/Disabling VStream Antispam on
page 500.
504
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
To configure Content Based Antispam engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
Next to the Content Based Antispam lever, click Settings.
The Content Based Antispam Settings page appears.
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Table 125: Content Based Antispam Settings Fields
In this field…
Do this…
Spam
Configure how VStream Antispam should handle spam that is detected
using the Content Based Antispam engine.
Action
Specify the action VStream Antispam should take upon detecting spam, by
selecting one of the following:

None. Take no action.

Reject. Block the email. The email will be permanently deleted.

Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Chapter 15: Using Antivirus and Antispam Filtering
505
Using VStream Antispam
In this field…
Do this…
Note: If the Content Based Antispam engine is in Monitor Only mode, this
setting is ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 500.
Mark Text
Type the prefix to the text appearing in the Subject field of the spam
notification email.
For example, if you type [SPAM] and the original email's Subject field
displays "Earn Money the Easy Way", the spam notification email's Subject
field will display: "[SPAM] Earn Money the Easy Way".
The default value is [SPAM].
Note: If your email client allows defining rules based on the Subject field, you
can create rules specifying that emails whose Subject field contains certain
words should be moved to specific folders. For example, you can configure
your email client to move all emails whose Subject field contains [SPAM]
directly to the Deleted Items folder.
Track
Specify whether VStream Antispam should log spam, by selecting one of
the following:
Confidence

Log. VStream Antispam should log spam.

None. VStream Antispam should not log spam.
Type the minimum spam confidence level (SCL). If an email's SCL matches
or exceeds this threshold, the email is considered spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as spam. Setting a lower SCL increases the amount of spam that
is identified as legitimate email.
The default value is 90.
506
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
In this field…
Do this…
Suspected Spam
Configure how VStream Antispam should handle suspected spam that is
detected using the Content Based Antispam engine.
Action
Specify the action VStream Antispam should take upon detecting potential
spam, by selecting one of the following:

None. Take no action.

Reject. Block the email. The email will be permanently deleted.

Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Note: If the Content Based Antispam engine is in Monitor Only mode, this
setting is ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 500.
Mark Text
Type the prefix to the text appearing in the Subject field of the suspected
spam notification email.
For example, if you type [SUSPECTED SPAM] and the original email's
Subject field displays "Earn Money the Easy Way", the suspected spam
notification email's Subject field will display: "[SUSPECTED SPAM] Earn
Money the Easy Way".
The default value is [SUSPECTED SPAM].
Note: If your email client allows defining rules based on the Subject field, you
can create rules specifying that emails whose Subject field contains certain
words should be moved to specific folders. For example, you can configure
your email client to move all emails whose Subject field contains
[SUSPECTED SPAM] directly to a Quarantine folder.
Track
Specify whether VStream Antispam should log suspected spam, by
selecting one of the following:

Log. VStream Antispam should log suspected spam.

None. VStream Antispam should not log suspected spam.
Chapter 15: Using Antivirus and Antispam Filtering
507
Using VStream Antispam
In this field…
Do this…
Confidence
Type the minimum spam confidence level (SCL). If an email's SCL matches
or exceeds this threshold, the email is considered suspected spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as suspected spam. Setting a lower SCL increases the amount of
potential spam that is identified as legitimate email.
The default value is 80.
Configuring the Block List Engine
You can configure a list of email addresses and domain names that VStream Antispam
should automatically block, if the Block List engine is enabled.
For information on enabling the Block List engine, see Enabling/Disabling VStream
Antispam on page 500.
Adding Blocked Senders
To add a blocked sender
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
508
Next to the Block List lever, click Edit List.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
The Blocked Sender List page appears.
3.
Click Add.
The Add Email to List dialog box appears.
4.
In the field provided, do one of the following:


5.
To block all email from a specific sender, type the sender's email address.
To block all email from addresses ending with a specific domain, type the
domain name.
For example, if you type "@special-offers.com", then email addresses such as
[email protected] and [email protected] will be blocked.
Click OK.
The sender appears in the Block Sender List table.
Chapter 15: Using Antivirus and Antispam Filtering
509
Using VStream Antispam
Viewing and Deleting Blocked Senders
To delete a blocked sender
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
Next to the Block List lever, click Edit List.
The Blocked Sender List page appears.
3.
In the desired sender's row, click
.
The sender is deleted.
Configuring the Block List Engine Settings
To configure Block List engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
510
Next to the Block List lever, click Settings.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
The Antispam Block List Settings page appears.
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Table 126: Antispam Block List Settings Fields
In this field…
Do this…
Block Action
Specify the action VStream Antispam should take upon receiving an email
from a blocked sender, by selecting one of the following:

None. Take no action.

Reject. Block the email.

Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Note: If the Block List engine is in Monitor Only mode, this setting is ignored.
For information on changing the engine's mode, see Enabling/Disabling
VStream Antispam on page 500.
Chapter 15: Using Antivirus and Antispam Filtering
511
Using VStream Antispam
In this field…
Do this…
Mark Text
Type the prefix to the text appearing in the Subject field of the spam
notification email.
For example, if you type [SPAM] and the original email's Subject field
displays "Earn Money the Easy Way", the spam notification email's Subject
field will display: "[SPAM] Earn Money the Easy Way".
The default value is [SPAM].
Note: If your email client allows defining rules based on the Subject field, you
can create rules specifying that emails whose Subject field contains certain
words should be moved to specific folders. For example, you can configure
your email client to move all emails whose Subject field contains [SPAM]
directly to the Deleted Items folder.
Track Blocked
Specify whether VStream Antispam should log emails from blocked
Email
senders, by selecting one of the following:

Log. VStream Antispam should log emails from blocked
senders.

None. VStream Antispam should not log emails from blocked
senders.
Configuring the IP Reputation Engine
You can configure how VStream Antispam should handle spam and suspected spam that is
detected by the IP Reputation engine.
For information on enabling this engine, see Enabling/Disabling VStream Antispam on
page 500.
To configure IP Reputation engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
512
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
2.
Next to the IP Reputation Checking lever, click Settings.
The Antispam IP Reputation Settings page appears.
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Table 127: Antispam IP Reputation Settings Fields
In this field…
Do this…
Spam
Configure how VStream Antispam should handle spam that is detected
using the IP Reputation engine.
Action
Specify the action VStream Antispam should take upon detecting spam, by
selecting one of the following:

Reject. Block the email.

None. Take no action.
Note: If the IP Reputation engine is in Monitor Only mode, this setting is
ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 500.
Track
Specify whether VStream Antispam should log spam, by selecting one of
the following:
Chapter 15: Using Antivirus and Antispam Filtering
513
Using VStream Antispam
In this field…
Confidence
Do this…

Log. VStream Antispam should log spam.

None. VStream Antispam should not log spam.
Type the minimum spam confidence level (SCL) needed to fail this check. If
an email's SCL matches or exceeds this threshold, the email is considered
spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as spam. Setting a lower SCL increases the amount of spam that
is identified as legitimate email.
The default value is 90.
Suspected Spam
Configure how VStream Antispam should handle suspected spam that is
detected using the IP Reputation engine.
Action
Specify the action VStream Antispam should take upon detecting potential
spam, by selecting one of the following:

Reject. Block the email.

None. Take no action.
Note: If the IP Reputation engine is in Monitor Only mode, this setting is
ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 500.
Track
Specify whether VStream Antispam should log suspected spam, by
selecting one of the following:
514

Log. VStream Antispam should log suspected spam.

None. VStream Antispam should not log suspected spam.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
In this field…
Do this…
Confidence
Type the minimum spam confidence level (SCL) needed to fail this check. If
an email's SCL matches or exceeds this threshold, the email is considered
suspected spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as suspected spam. Setting a lower SCL increases the amount of
potential spam that is identified as legitimate email.
The default value is 80.
Configuring the VStream Antispam Policy
VStream Antispam includes a flexible mechanism that allows the user to define exactly
which emails should be scanned for spam and which should be considered safe, by
specifying the protocol, and the source and destination IP addresses.
VStream Antispam processes policy rules in the order they appear in the Antispam Policy
table, so that rule 1 is applied before rule 2, and so on. This enables you to define exceptions
to rules, by placing the exceptions higher up in the Rules table.
Chapter 15: Using Antivirus and Antispam Filtering
515
Using VStream Antispam
For example, if you want to scan all outgoing SMTP traffic, except traffic from a specific IP
address, you can create a rule scanning all outgoing SMTP traffic and move the rule down in
the Antispam Policy table. Then create a rule passing SMTP traffic from the desired IP
address and move this rule to a higher location in the Antispam Policy table than the first rule.
In the figure below, the general rule is rule number 2, and the exception is rule number 1.
The UTM-1 appliance will process rule 1 first, passing outgoing SMTP traffic from the
specified IP address, and only then it will process rule 2, scanning all outgoing SMTP traffic.
The following rule types exist:
Table 128: VStream Antispam Rule Types
Rule
Description
Pass
This rule type enables you to specify that VStream Antispam should allow all
emails matching the rule, without scanning the emails.
Scan
This rule type enables you to specify that VStream Antispam should scan all
emails matching the rule.
Reject
This rule type enables you to specify that VStream Antispam should reject all
emails matching the rule, without scanning the emails.
516
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
Adding and Editing VStream Antispam Rules
To add or edit a VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
Do one of the following:

To add a new rule, click Add Rule.

To edit an existing rule, click
Chapter 15: Using Antivirus and Antispam Filtering
next to the desired rule.
517
Using VStream Antispam
The VStream Antispam Policy Rule Wizard opens, with the Step 1: Rule Type dialog box
displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Destination & Source dialog box appears.
518
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The Step 3: Done dialog box appears.
7.
If desired, type a description of the rule in the field provided.
8.
Click Finish.
The new rule appears in the Antispam Policy page.
Table 129: VStream Antispam Policy Rule Wizard Fields
In this field…
Do this…
If the email
Select the email protocol to which the rule should apply. The supported
protocol is
protocols are SMTP and POP3.
To specify both SMTP and POP3, select ANY.
Note: When defining a Reject rule, this field is set to Mail Server (SMTP).
Chapter 15: Using Antivirus and Antispam Filtering
519
Using VStream Antispam
In this field…
Do this…
The connection
Select the source of the connections to which the rule should apply.
source is
To specify an IP address, select Specified IP and type the desired IP address in
the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify connections originating from this gateway, select This Gateway.
To specify any source except this gateway, select ANY.
And the
Select the destination of the connections to which the rule should apply. This
destination is
list includes network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the text box.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
To specify the UTM-1 IP addresses, select This Gateway.
To specify any destination except the UTM-1 Portal IP addresses, select ANY.
Description
Type a description of the rule.
Enabling/Disabling VStream Antispam Rules
You can temporarily disable a VStream Antispam rule.
520
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
To enable/disable a VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
Next to the desired rule, do one of the following:

To enable the rule, click
The button changes to

.
and the rule is enabled.
To disable the rule, click
The button changes to
.
and the rule is disabled.
Reordering VStream Antispam Rules
To reorder VStream Antispam rules
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Viewing and Deleting VStream Antispam Rules
To view or delete an existing VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears with a list of existing VStream Antispam rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
In the desired rule's row, click
Chapter 15: Using Antivirus and Antispam Filtering
.
521
Using VStream Antispam
b.
A confirmation message appears.
Click OK.
The rule is deleted.
Configuring the Safe Sender List
You can configure a list of email addresses and domain names that are "safe". VStream
Antispam will treat all emails sent from these addresses or domains as legitimate (non-spam)
mail.
Note: The IP Reputation check is performed before accepting the TCP connection, at
which point the sender’s email address is not yet available. Therefore, if the IP
Reputation engine is enabled, and an SMTP session is received from an IP address
that is reputed to be a source of spam, VStream Antispam will block the connection,
regardless of whether the sender's email address is on the Safe Sender List.
Adding Safe Senders
To add a safe sender
1.
522
Click Antispam in the main menu, and click the Safe Senders tab.
Check Point UTM-1 Embedded NGX User Guide
Using VStream Antispam
The Safe Sender List page appears.
2.
Click Add.
The Add Email to List dialog box appears.
3.
In the field provided, do one of the following:


4.
To allow all email from a specific sender, type the sender's email address.
To allow all email from addresses ending with a specific domain, type the
domain name.
For example, if you type "@mycompany.com", then email addresses such as
[email protected] and [email protected] will be allowed.
Click OK.
The sender appears in the Safe Senders table.
Chapter 15: Using Antivirus and Antispam Filtering
523
Using VStream Antispam
Viewing and Deleting Safe Senders
To view or delete a safe sender
1.
Click Antispam in the main menu, and click the Safe Senders tab.
The Safe Sender List page appears.
2.
In the desired sender's row, click Erase.
The sender is deleted.
Configuring VStream Antispam Advanced Settings
To configure VStream Antispam advanced settings
1.
Click Antispam in the main menu, and click the Advanced tab.
The Advanced Antispam Settings page appears.
2.
In the Track Non Spam Emails drop-down list, do one of the following:

524
To specify that VStream Antispam should log email that is detected as
legitimate mail, select Log.
Check Point UTM-1 Embedded NGX User Guide
Using Centralized Email Filtering

3.
To specify that VStream Antivirus should not log email that is detected as
legitimate mail, select None.
In the Track Safe Senders drop-down list, do one of the following:

4.
To specify that VStream Antispam should log email sent by addresses on the
Safe Sender List, select Log.
 To specify that VStream Antivirus should not log email sent by addresses on
the Safe Sender List, select None.
Click Apply.
Using Centralized Email Filtering
There are two centralized Email Filtering services:

Email Antivirus
When the Email Antivirus service is enabled, your email is automatically scanned for
the detection and elimination of all known viruses and vandals. If a virus is detected, it
is removed and replaced with a warning message.

Email Antispam
When the Email Antispam service is enabled, your email is automatically scanned for
the detection of spam. If spam is detected, the email’s Subject line is modified to
indicate that it is suspected spam. If your email client allows defining rules based on the
Subject field, you can create rules to divert such messages to a special folder.
Note: Email Filtering services are only available if you are connected to a Service Center
and subscribed to the services. For information on using subscription services, see
Using Subscription Services on page 553.
Note: For information on the differences between the centralized Email Filtering services
and VStream Antivirus or VStream Antispam, see Overview on page 477.
Chapter 15: Using Antivirus and Antispam Filtering
525
Using Centralized Email Filtering
Enabling/Disabling Email Filtering
To enable/disable Email Filtering
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Next to Email Antivirus, drag the On/Off lever upwards or downwards.
Email Antivirus is enabled/disabled.
Selecting Protocols for Scanning
If you are locally managed, you can define which protocols should be scanned for viruses
and spam:

Email retrieving (POP3). If enabled, all incoming email in the POP3 protocol will
be scanned.

Email sending (SMTP). If enabled, all outgoing email will be scanned.
Protocols marked with
526
will be scanned, while those marked with
will not.
Check Point UTM-1 Embedded NGX User Guide
Using Centralized Email Filtering
Note: If the UTM-1 appliance is remotely managed, contact your Service Center
administrator to change these settings.
To enable virus and spam scanning for a protocol
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
In the Options area, click
or
next to the desired protocol.
Configuring Email Filtering Advanced Settings
Note: If the UTM-1 appliance is remotely managed, contact your Service Center
administrator to change these settings.
To configure Email Filtering advanced settings
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Next to the Bypass scanning if Service Center is unavailable option, specify how
the gateway should handle Email Filtering when the service is enabled and the
Service Center is unavailable, by doing do one of the following:

To temporarily block all email traffic, click
.
This ensures constant protection from spam and viruses.
The button changes to

.
To temporarily allow all email traffic, click
.
This ensures continuous access to email; however, it does not protect against
viruses and spam, so use this option cautiously.
The button changes to
.
Chapter 15: Using Antivirus and Antispam Filtering
527
Using Centralized Email Filtering
When the Service Center is available again, the gateway will enforce the configured
Email Filtering policy.
Temporarily Disabling Email Filtering
If you are having problems sending or receiving email you can temporarily disable the Email
Filtering services.
To temporarily disable Email Filtering
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Click Snooze.


528
Email Antivirus and Email Antispam are temporarily disabled for all internal
network computers.
The Snooze button changes to Resume.
Check Point UTM-1 Embedded NGX User Guide
Using Centralized Email Filtering

3.
The Email Filtering Off popup window opens.
To re-enable Email Antivirus and Email Antispam, click Resume, either in the
popup window, or on the Email Filtering page.



The services are re-enabled for all internal network computers.
If you clicked Resume in the Email Filtering page, the button changes to Snooze.
If you clicked Resume in the Email Filtering Off popup window, the popup
window closes.
Chapter 15: Using Antivirus and Antispam Filtering
529
Overview
Chapter 16
Using Web Content Filtering
This chapter explains how to use Web content filtering.
This chapter includes the following topics:
Overview ..................................................................................................531
Using Web Rules ...................................................................................... 532
Using Web Filtering ................................................................................. 539
Customizing the Access Denied Page ...................................................... 545
Overview
You can allow or block users from accessing Web content, by configuring Web rules and/or
the Web Filtering service. The following table describes the main differences between Web
rules and the Web Filtering service:
Table 130: Comparison of Web Content Filtering Methods
Filtering Action
Web Rules
Web Filtering
Web rules allow and block specific
The Web Filtering service is category
URLs.
based; that is, it filters Web sites based on
the category to which they belong.
Point of Enforcement
HTTP requests are analyzed in
HTTP requests are analyzed in the
the gateway, by comparing each
gateway, by extracting each request's URL
request against a list of rules.
and then sending the URL to the Service
Center, to determine to which categories
the URL belongs. The request is then
allowed or denied according to the
configured list of allowed categories.
Chapter 16: Using Web Content Filtering
531
Using Web Rules
Web Rules
Web Filtering
Subscription and
Web rules are included with the
The Web Filtering service is
Connection
UTM-1 appliance and do not
subscription-based and requires a
Requirement
require a Service Center
connection to the Service Center.
subscription or connection.
You can use either Web content filtering solution or both in conjunction. When a user
attempts to access a Web site, the UTM-1 appliance first evaluates the Web rules. If the site
is not blocked or allowed by the Web rules, the Web Filtering service is then consulted.
Regardless of which method is used, if a user attempts to access a blocked page, the Access
Denied page appears. For information on customizing this page, see Customizing the Access
Denied Page on page 545.
If desired, you can permit specific users to override Web content filtering, by granting them
Web Filtering Override permissions. Such users will be able to view Web pages without
restriction, after they have provided their username password via the Access Denied page.
For information on granting Web Filtering Override permissions, see Adding and Editing
Users on page 637.
In addition, you can choose to exclude specific network objects from Web content filtering
enforcement. Users connecting from these network objects will be able to view Web pages
without restriction, regardless of whether they have Web Filtering Override permissions. For
information on configuring network objects, see Using Network Objects on page 210.
Using Web Rules
You can block or allow access to specific Web pages, by defining Web rules.
Note: Web rules affect outgoing traffic only and cannot be used to allow or limit access
from the Internet to internal Web servers.
The UTM-1 appliance processes Web rules in the order they appear in the Web Rules table,
so that rule 1 is applied before rule 2, and so on. This enables you to define exceptions to
rules, by placing the exceptions higher up in the Web Rules table.
532
Check Point UTM-1 Embedded NGX User Guide
Using Web Rules
For example, if you want to block all the pages of a particular Web site, except a specific
page, you can create a rule blocking access to all of the Web site's pages and move the rule
down in the Web Rules table. Then create a rule allowing access to the desired page and
move this rule to a higher location in the Web Rules table than the first rule. In the figure
below, the general rule is rule number 2, and the exception is rule number 1.
The UTM-1 appliance will process rule 1 first, allowing access to the desired page, and only
then it will process rule 2, blocking access to the rest of the site.
The following rule types exist:
Table 131: Web Rule Types
Rule
Description
Allow
This rule type enables you to specify that a specific Web page should be allowed.
Block
This rule type enables you to specify that a specific Web page should be blocked.
Chapter 16: Using Web Content Filtering
533
Using Web Rules
Adding and Editing Web Rules
To add or edit a Web rule
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
2.
534
Do one of the following:

To add a new rule, click Add Rule.

To edit an existing rule, click
next to the desired rule.
Check Point UTM-1 Embedded NGX User Guide
Using Web Rules
The UTM-1 Web Rule Wizard opens, with the Step 1: Rule Type dialog box displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Rule Location dialog box appears.
The example below shows a Block rule.
Chapter 16: Using Web Content Filtering
535
Using Web Rules
5.
To configure advanced settings, click Show Advanced Settings.
New fields appear.
6.
Complete the fields using the relevant information in the following table.
7.
Click Next.
The Step 3: Confirm Rule dialog box appears.
536
Check Point UTM-1 Embedded NGX User Guide
Using Web Rules
8.
Click Finish.
The new rule appears in the Web Rules page.
Table 132: Web Rules Fields
In this field…
Do this…
Block/Allow
Type the URL or IP address to which the rule should apply.
access to the
following URL
Wildcards (*) are supported. For example, to block all URLs that start with
"http://www.casino-", set this field's value to: www.casino-*
Note: If you block a Web site based on its domain name
(http://<domain_name>), the Web site is not automatically blocked when
surfing to the Web server's IP address (http://<IP_address>). Likewise, if you
block a Web site based on its IP address, the Web site is not automatically
blocked when surfing to the domain name. To prevent access to both the
domain name and the IP address, you must block both.
Log allowed
connections /
Log blocked
Select this option to log the specified blocked or allowed connections.
By default, allowed Web pages are not logged, and blocked Web pages are
logged.
connections
If the connection
Select the source of the connections you want to allow/block. This list includes
source is
network objects.
To specify an IP address, select Specified IP and type the desired IP address in
the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
Chapter 16: Using Web Content Filtering
537
Using Web Rules
In this field…
Do this…
If the current time
Select this option to specify that the rule should be applied only during certain
is
hours of the day.
You must then use the fields and drop-down lists provided, to specify the
desired time range.
Reordering Web Rules
To reorder Web rules
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
2.
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Enabling/Disabling Web Rule Logging
You can enable or disable logging for a Web rule, by using the information in Adding and
Editing Web Rules on page 534, or by using the following shortcut.
To enable/disable logging for a Web rule
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
2.
Next to the desired rule, in the Log column, do one of the following:

To enable logging, click
The button changes to

538
To disable logging, click
.
and logging is enabled for the rule.
.
Check Point UTM-1 Embedded NGX User Guide
Using Web Filtering
The button changes to
and logging is disabled for the rule.
Viewing and Deleting Web Rules
To view or delete an existing Web rule
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears with a list of existing Web rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
b.
In the desired rule's row, click
.
A confirmation message appears.
Click OK.
The rule is deleted.
Using Web Filtering
When the Web Filtering service is enabled, access to Web content is restricted according to
the categories specified in the Allow Categories area of the Web Filtering page.
Note: The Web Filtering service is only available if you are connected to a Service
Center and subscribed to this service. For information on using subscription services,
see Using Subscription Services on page 553.
Chapter 16: Using Web Content Filtering
539
Using Web Filtering
Enabling/Disabling Web Filtering
To enable/disable Web Filtering
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Drag the On/Off lever upwards or downwards.
Web Filtering is enabled/disabled.
540
Check Point UTM-1 Embedded NGX User Guide
Using Web Filtering
Selecting Categories for Blocking
You can define which types of Web sites should be considered appropriate for your family
or office members, by selecting the categories. Categories marked with
visible, while categories marked with
password for viewing.
will remain
will be blocked and will require the administrator
Note: If the UTM-1 appliance is remotely managed, contact your Service Center
administrator to change these settings.
Note: The list of supported categories may vary, depending on the Service Center to
which the UTM-1 appliance is connected.
To allow/block a category
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
In the Allow Categories area, use the scroll bar to scroll through all of the
categories.
3.
Click
or
next to the desired category.
Configuring Web Filtering Advanced Settings
Note: If the UTM-1 appliance is remotely managed, contact your Service Center
administrator to change these settings.
To configure Web Filtering advanced settings
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
Chapter 16: Using Web Content Filtering
541
Using Web Filtering
2.
Next to the Bypass scanning if Service Center is unavailable option, specify how
the gateway should handle Web Filtering when the service is enabled and the
Service Center is unavailable, by doing do one of the following:

To temporarily block all connections to the Internet, click
.
This ensures that users will not gain access to undesirable Web sites, even when the
Service Center is unavailable.
The button changes to

.
To temporarily allow all connections to the Internet, click
This ensures continuous access to the Internet.
.
The button changes to
.
When the Service Center is available again, the gateway will enforce the configured
Web Filtering policy.
Temporarily Disabling Web Filtering
If desired, you can temporarily disable the Web Filtering service.
To temporarily disable Web Filtering
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Click Snooze.

542
Web Filtering is temporarily disabled for all internal network computers.
Check Point UTM-1 Embedded NGX User Guide
Using Web Filtering
3.

The Snooze button changes to Resume.

The Web Filtering Off popup window opens.
To re-enable the service, click Resume, either in the popup window, or on the
Web Filtering page.


The service is re-enabled for all internal network computers.
If you clicked Resume in the Web Filtering page, the button changes to Snooze.
Chapter 16: Using Web Content Filtering
543
Using Web Filtering

If you clicked Resume in the Web Filtering Off popup window, the popup
window closes.
Configuring Automatic Snooze
You can automatically disable the Web Filtering service during certain hours of the day, by
configuring Automatic Snooze.
To configure Automatic Snooze
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
In the Advanced area, next to Automatic Snooze, click Set.
The Web Filtering Automatic Snooze Settings page appears.
3.
Do one of the following:


544
To enable Automatic Snooze:
1) Select the Automatic Snooze check box.
2) In the fields provided, specify the hours between which the Web
Filtering service should be disabled.
To disable Automatic Snooze, clear the Automatic Snooze check box.
Check Point UTM-1 Embedded NGX User Guide
Customizing the Access Denied Page
4.
Click Apply.
Automatic Snooze is enabled/disabled.
If you enabled Automatic Snooze, the Web Filtering page displays the hours during
which the Web Filtering service will be disabled.
Resetting Web Filtering Categories to Defaults
If desired, you can reset the Web Filtering categories to their default settings.
To restore Web Filtering defaults
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Click Defaults
A confirmation message appears.
3.
Click OK.
Customizing the Access Denied Page
The Access Denied page appears when a user attempts to access a page that is blocked either
by a Web rule or by the Web Filtering service. You can customize this page using the
following procedure.
To customize the Access Denied page
1.
Do one of the following:


Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
Chapter 16: Using Web Content Filtering
545
Customizing the Access Denied Page
2.
Click Settings.
The Customize Access Denied Page appears. In the following example, this page was
accessed via the Web Rules page.
3.
In the text box, type the message that should appear when a user attempts to
access a blocked Web page.
You can use HTML tags as needed.
4.
To display the Access Denied page using HTTPS, select the Use HTTPS check
box.
5.
To preview the Access Denied page, click Preview.
A browser window opens displaying the Access Denied page.
6.
Click Apply.
Your changes are saved.
546
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 17
Updating the Firmware
This chapter explains how to update the UTM-1 appliance's firmware.
This chapter includes the following topics:
Overview ..................................................................................................547
Using Software Updates ...........................................................................548
Updating the Firmware Manually ............................................................. 550
Overview
You can update your UTM-1 appliance with new product features and protection against
new security threats. To do so, you must update your appliance's firmware, by using one of
the following methods:

Software Updates. This subscription service allows checking for new security and
software updates, either automatically or manually. Detected updates are
downloaded and installed without user intervention.

Manual updates. If you are not subscribed to the Software Updates service, you
must update the firmware manually.
Note: To obtain firmware updates, whether via the Software Updates service, or for the
purpose of updating you appliance manually, you must purchase a support/software
subscription plan for your appliance.

SmartUpdate. When connected to SmartCenter, you can also update UTM-1
firmware using SmartCenter's SmartUpdate.component. For information refer to
the Check Point SmartUpdate documentation.
Chapter 17: Updating the Firmware
547
Using Software Updates
Using Software Updates
Checking for Software Updates when Remotely Managed
If your UTM-1 appliance is remotely managed, it automatically checks for software updates
and installs them without user intervention. However, you can still check for updates
manually, if needed.
To manually check for security and software updates
1.
Click Services in the main menu, and click the Software Updates tab.
The Software Updates page appears.
2.
Click Update Now.
The system checks for new updates and installs them.
548
Check Point UTM-1 Embedded NGX User Guide
Using Software Updates
Checking for Software Updates when Locally Managed
If your UTM-1 appliance is locally managed, you can set it to automatically check for
software updates, or you can set it so that software updates must be checked for manually.
To configure software updates when locally managed
1.
Click Services in the main menu, and click the Software Updates tab.
The Software Updates page appears.
2.
To set the UTM-1 appliance to automatically check for and install new software
updates, drag the Automatic/Manual lever upwards.
The UTM-1 appliance checks for new updates and installs them according to its
schedule.
Note: When the Software Updates service is set to Automatic, you can still manually
check for updates.
3.
To set the UTM-1 appliance so that software updates must be checked for
manually, drag the Automatic/Manual lever downwards.
The UTM-1 appliance does not check for software updates automatically.
4.
To manually check for software updates, click Update Now.
Chapter 17: Updating the Firmware
549
Updating the Firmware Manually
The system checks for new updates and installs them.
Updating the Firmware Manually
Updating the UTM-1 firmware manually
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
Click Firmware Update.
The Firmware Update page appears.
3.
Click Browse.
A browse window appears.
4.
Select the image file and click Open.
The Firmware Update page reappears. The path to the firmware update image file
appears in the Browse text box.
5.
Click Upload.
Your UTM-1 appliance firmware is updated.
550
Check Point UTM-1 Embedded NGX User Guide
Updating the Firmware Manually
Updating may take a few minutes. Do not power off the appliance.
At the end of the process the UTM-1 appliance restarts automatically.
Chapter 17: Updating the Firmware
551
Updating the Firmware Manually
Chapter 18
SMART Management and Subscription
Services
A Service Center provisions gateways with configurations, settings, and/or value-added
security services. Services are provided transparently over the Internet, without any need to
install additional software on the network computers behind the gateways.
The UTM-1 appliance can connect to the following types of Service Centers:

Check Point's Security Management Architecture (SMART)
SMART management allows deploying and centrally managing a single security policy
on an unlimited number of UTM-1 appliances. Connecting to SMART management is
therefore recommended for enterprises.

The Check Point Security Management Portal (SMP)
Select service providers use the SMP to provide subscription-based security,
configuration, and networking services. For example, you can connect to an SMP in
order to receive such value-add services as firewall security updates, Web Filtering, and
Dynamic DNS.
This chapter explains how to connect your appliance to SMART management or to an SMP.
Note: Although some procedures in this chapter specifically relate to the SMP, you can
use these same procedures to connect to and use SMART management.
This chapter includes the following topics:
Connecting to a Service Center ............................................................... 554
Viewing Services Information ................................................................. 559
Refreshing Your Service Center Connection ........................................... 560
Configuring Your Account ...................................................................... 560
Disconnecting from Your Service Center ................................................ 561
Chapter 18: SMART Management and Subscription Services
553
Connecting to a Service Center
Connecting to a Service Center
To connect to a Service Center
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
554
In the Service Account area, click Connect.
Check Point UTM-1 Embedded NGX User Guide
Connecting to a Service Center
The UTM-1 Services Wizard opens, with the Service Center dialog box displayed.
3.
Make sure the Connect to a Service Center check box is selected.
4.
To specify a Service Center, choose Specified IP and then in the Specified IP
field, enter the desired Service Center’s IP address, as given to you by your
system administrator.
5.
Click Next.

The Connecting screen appears.
Chapter 18: SMART Management and Subscription Services
555
Connecting to a Service Center



556
If the Service Center requires authentication, the Service Center Login dialog
box appears.
Enter your gateway ID and registration key in the appropriate fields, as given to
you by your service provider, then click Next.
The Connecting screen appears.
The Confirmation dialog box appears with a list of services to which you are
subscribed.
Check Point UTM-1 Embedded NGX User Guide
Connecting to a Service Center
6.
Click Next.
The Done screen appears with a success message.
7.
Click Finish.
The following things happen:


If a new firmware is available, the UTM-1 appliance may start downloading it.
This may take several minutes. Once the download is complete, the UTM-1
appliance restarts using the new firmware.
The Welcome page appears.
Chapter 18: SMART Management and Subscription Services
557
Connecting to a Service Center
558

The services to which you are subscribed are now available on your UTM-1
appliance and listed as such on the Account page. See Viewing Services
Information on page 559 for further information.

The Services submenu includes the services to which you are subscribed.
Check Point UTM-1 Embedded NGX User Guide
Viewing Services Information
Viewing Services Information
The Account page displays the following information about your subscription.
Table 133: Account Page Fields
This field…
Displays…
Service Center
The name of the Service Center to which you are connected (if known).
Name
Gateway ID
Your gateway ID.
Subscription will
The date on which your subscription to services will end.
end on
Service
The services available in your service plan.
Subscription
The status of your subscription to each service:
Status
Information

Subscribed

Not Subscribed
The status of each service:

Connected. You are connected to the service through the Service
Center.

Connecting. Connecting to the Service Center.

N/A. The service is not available.
The mode to which each service is set.
If you are subscribed to Dynamic DNS, this field displays your gateway's
domain name.
For further information, see Web Filtering on page 539, Virus Scanning on
page 525, and Automatic and Manual Updates on page 548.
Chapter 18: SMART Management and Subscription Services
559
Refreshing Your Service Center Connection
Refreshing Your Service Center Connection
This option restarts your UTM-1 appliance’s connection to the Service Center and refreshes
your UTM-1 appliance’s service settings.
To refresh your Service Center connection
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Refresh.
The UTM-1 appliance reconnects to the Service Center.
Your service settings are refreshed.
Configuring Your Account
This option allows you to access your Service Center's Web site, which may offer additional
configuration options for your account. Contact your Service Center for a user ID and
password.
To configure your account
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Configure.
Note: If no additional settings are available from your Service Center, this button will
not appear.
Your Service Center's Web site opens.
3.
560
Follow the on-screen instructions.
Check Point UTM-1 Embedded NGX User Guide
Disconnecting from Your Service Center
Disconnecting from Your Service Center
If desired, you can disconnect from your Service Center.
To disconnect from your Service Center
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Connect.
The UTM-1 Services Wizard opens, with the first Subscription Services dialog box
displayed.
3.
Clear the Connect to a Service Center check box.
4.
Click Next.
The Done screen appears with a success message.
5.
Click Finish.
The following things happen:


You are disconnected from the Service Center.
The services to which you were subscribed are no longer available on your
UTM-1 appliance.
Chapter 18: SMART Management and Subscription Services
561
Overview
Chapter 19
Working with VPNs
This chapter describes how to use your UTM-1 appliance as a Remote Access VPN Client,
VPN server, or VPN gateway.
Note: For maximum security, you can integrate all UTM-1 appliances into an overall
enterprise security policy. Check Point's Security Management Architecture (SMART)
delivers a single enterprise-wide security policy that you can centrally manage and
automatically deploy to an unlimited number of UTM-1 gateways.
To connect an appliance to a Check Point SMART management server, you must
connect the appliance to the Service Center using the Services page Connect tab.
This chapter does not discuss creating and managing VPNs using SMART management
tools. For more information on connecting and managing VPNs using SMART
management tools, refer to your SmartCenter documentation.
This chapter includes the following topics:
Overview ................................................................................................. 563
Setting Up Your UTM-1 Appliance as a VPN Server ............................. 570
Adding and Editing VPN Sites .............................................................. 583
Viewing and Deleting VPN Sites ............................................................ 615
Enabling/Disabling a VPN Site ............................................................... 615
Logging in to a Remote Access VPN Site ............................................... 616
Logging Out of a Remote Access VPN Site ............................................ 619
Using Certificates .................................................................................... 619
Viewing VPN Tunnels ............................................................................. 629
Viewing IKE Traces for VPN Connections ............................................. 631
Viewing VPN Topology .......................................................................... 633
Overview
You can configure your UTM-1 appliance as part of a virtual private network (VPN). A
VPN is a private data network consisting of a group of gateways that can securely connect to
each other. Each member of the VPN is called a VPN site, and a connection between two
Chapter 19: Working with VPNs
563
Overview
VPN sites is called a VPN tunnel. VPN tunnels encrypt and authenticate all traffic passing
through them. Through these tunnels, employees can safely use their company’s network
resources when working at home. For example, they can securely read email, use the
company’s intranet, or access the company’s database from home.
The UTM-1 appliance supports the following types of VPN sites:

SecuRemote Remote Access VPN Server. Makes a network remotely available to
authorized users who connect to the Remote Access VPN Server using the Check
Point SecuRemote VPN Client (provided for free with your UTM-1) or another
UTM-1.

SecuRemote Internal VPN Server. SecuRemote can also be used from your internal
networks, allowing you to secure your wired or wireless network with strong
encryption and authentication.

Endpoint Connect VPN Server. Makes a network available to authorized users who
connect from the Internet or from your internal networks using the Check Point
Endpoint Connect VPN Client. Endpoint Connect provides mobile users with
seamless connectivity to corporate resources, by encrypting and authenticating
data transmitted during secure remote access sessions.

L2TP VPN Server. Makes a network available to authorized users who connect
from the Internet or from your internal networks using an L2TP client such as the
Microsoft L2TP IPSec VPN Client.

Site-to-Site VPN Gateway. Can connect with another Site-to-Site VPN Gateway in
a permanent, bi-directional relationship.

Remote Access VPN Client. Can connect to a Remote Access VPN Server, but
other VPN sites cannot initiate a connection to the Remote Access VPN Client.
Defining a Remote Access VPN Client is a hardware alternative to using remote
access software.
All UTM-1 models provide VPN functionality. The UTM-1 appliance can act as a Remote
Access VPN Client, a VPN Server, or a Site-to-Site VPN Gateway.
A virtual private network (VPN) must include at least one Remote Access VPN Server or
gateway. The type of VPN sites you include in a VPN depends on the type of VPN you want
to create, Site-to-Site or Remote Access.
564
Check Point UTM-1 Embedded NGX User Guide
Overview
Note: A locally managed VPN Server or gateway must have a static IP address. If you
need a VPN Server or gateway with a dynamic IP address, you must use either
Check Point SMART management or Check Point Security Management Portal
(SMP) management.
A SecuRemote/SecureClient or UTM-1 Remote Access VPN Client can have a
dynamic IP address, regardless of whether it is locally or remotely managed.
Note: This chapter explains how to define a VPN locally. However, if your appliance is
centrally managed by a Service Center, then the Service Center can automatically
deploy VPN configuration for your appliance.
Chapter 19: Working with VPNs
565
Overview
Site-to-Site VPNs
A Site-to-Site VPN consists of two or more Site-to-Site VPN Gateways that can
communicate with each other in a bi-directional relationship. The connected networks
function as a single network. You can use this type of VPN to mesh office branches into one
corporate network.
Figure 39: Site-to-Site VPN
566
Check Point UTM-1 Embedded NGX User Guide
Overview
To create a Site-to-Site VPN with two VPN sites
1.
On the first VPN site’s UTM-1 appliance, do the following:
a.
2.
Define the second VPN site as a Site-to-Site VPN Gateway, using the
procedure Adding and Editing VPN Sites on page 583.
b. Enable a Remote Access VPN Server using the procedure Setting Up Your
UTM-1 Appliance as a VPN Server on page 570.
On the second VPN site’s UTM-1 appliance, do the following:
a.
b.
Define the first VPN site as a Site-to-Site VPN Gateway, using the
procedure Adding and Editing VPN Sites on page 583.
Enable a Remote Access VPN Server using the procedure Setting Up Your
UTM-1 Appliance as a VPN Server on page 570.
Note: You can manually configure each VPN site's internal encryption domain via the
CLI. For information, refer to the Embedded NGX CLI Reference Guide.
Chapter 19: Working with VPNs
567
Overview
Remote Access VPNs
A Remote Access VPN consists of one Remote Access VPN Server or Site-to-Site VPN
Gateway, and one or more Remote Access VPN Clients. You can use this type of VPN to
make an office network remotely available to authorized users, such as employees working
from home, who connect to the office Remote Access VPN Server with their Remote Access
VPN Clients.
Figure 40: Remote Access VPN
568
Check Point UTM-1 Embedded NGX User Guide
Overview
To create a Remote Access VPN with two VPN sites
1.
On the remote user VPN site's UTM-1 appliance, add the office Remote Access
VPN Server as a Remote Access VPN site.
See Adding and Editing VPN Sites on page 583.
The remote user's UTM-1 appliance will act as a Remote Access VPN Client.
2.
On the office VPN site's UTM-1 appliance, enable a Remote Access VPN
Server.
See Setting Up Your UTM-1 Appliance as a VPN Server on page 570.
Internal VPN Server
You can use your UTM-1 appliance as an internal VPN Server, for enhanced wired and
wireless security. When an internal VPN Server is enabled, internal network PCs and PDAs
with the appropriate software installed can establish a Remote Access VPN session to the
gateway. This means that connections from internal network users to the gateway can be
encrypted and authenticated.
The benefits of using an internal VPN Server are two-fold:

Accessibility
Using SecureClient, Endpoint Connect, or L2TP, you can enjoy a secure connection
from anywhere—in your wireless network or on the road—without changing any
settings. The standard is completely transparent and allows you to access company
resources the same way, whether you are sitting at your desk or anywhere else.
Note: Only SecureClient and Endpoint Connect can connect to the SecuRemote
Internal VPN server, not SecuRemote.

Security
Many of today's attacks are increasingly introduced from inside the network. Internal
security threats cause outages, downtime, and lost revenue. Wired networks that deal
with highly sensitive information—especially networks in public places, such as
classrooms—are vulnerable to users trying to hack the internal network.
Chapter 19: Working with VPNs
569
Setting Up Your UTM-1 Appliance as a VPN Server
Using an internal VPN Server, along with a strict security policy for non-VPN users,
can enhance security both for wired networks and for wireless networks, which are
particularly vulnerable to security breaches.
For information on setting up your UTM-1 appliance as an internal VPN Server, see
Configuring the Internal VPN Server on page 574.
Setting Up Your UTM-1 Appliance as a VPN Server
You can make your network available to authorized users connecting from the Internet or
from your internal networks, by setting up your UTM-1 appliance as a VPN Server.
When the SecuRemote Remote Access VPN Server or SecuRemote Internal VPN Server is
enabled, users can connect to the server via Check Point SecuRemote/SecureClient or via a
UTM-1 appliance in Remote Access VPN mode.
The Endpoint Connect VPN Server can be enabled in addition to one or more of the
SecuRemote VPN Servers, to allow users to connect from relevant locations using an
Endpoint Connect VPN Client. For example, if both the SecuRemote Remote Access VPN
Server and the Endpoint Connect VPN Server are enabled, but the SecuRemote Internal
VPN Server is not enabled, then users will be able to use the Endpoint Connect VPN Client
to connect from the Internet but not from your internal networks. Endpoint Connect users are
automatically assigned to the OfficeMode network, enabling you to configure special
security rules for them.
When the L2TP (Layer 2 Tunneling Protocol) VPN Server is enabled, users can connect to
the server using an L2TP client such as the Microsoft Windows L2TP IPSEC VPN Client.
L2TP users are automatically assigned to the OfficeMode network, enabling you to
configure special security rules for them.
SecuRemote/SecureClient supports split tunneling, which means that VPN Clients can
connect directly to the Internet, while traffic to and from VPN sites passes through the VPN
Server. In contrast, the L2TP VPN Client does not support split tunneling, meaning that all
Internet traffic to and from a VPN Client passes through the VPN Server and is routed to the
Internet.
Enabling the UTM-1 VPN Server for users connecting from your internal networks adds a
layer of security to such connections. For example, while you could create a firewall rule
allowing a specific user on the DMZ to access the LAN, enabling VPN access for the user
570
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
means that such connections can be encrypted and authenticated. For more information, see
Internal VPN Server on page 569.
Note: The use of all Remote VPN Clients is subject to Check Point’s purchasing terms
and conditions.
To set up your UTM-1 appliance as a VPN Server
1.
Configure the VPN Server in one or more of the following ways:

2.
To accept SecuRemote/SecureClient or UTM-1 remote access connections
from the Internet.
See Configuring the SecuRemote Remote Access VPN Server on page 573.
 To accept SecuRemote/SecureClient connections from your internal networks.
See Configuring the SecuRemote Internal VPN Server on page 574.
 To accept Endpoint Connect remote access connections from the Internet
and/or from your internal networks.
See Configuring the Endpoint Connect VPN Server on page 574.
 To accept L2TP remote access connections from the Internet, as well L2TP
connections from your internal networks.
See Configuring the L2TP VPN Server on page 575.
If you configured the SecuRemote Internal VPN Server, install
SecuRemote/SecureClient on the desired internal network computers.
See Installing SecuRemote on page 576.
3.
If you configured both the SecuRemote Internal VPN Server and the Endpoint
Connect VPN Server, install Endpoint Connect on the desired internal network
computers.
See Installing Endpoint Connect on page 576.
4.
If you configured the L2TP VPN Server, do the following:
a.
b.
Configure the OfficeMode network.
See Configuring the OfficeMode Network on page 197.
All users connecting via L2TP will be assigned to the OfficeMode network.
Configure L2TP VPN Clients on the desired internal network computers.
Chapter 19: Working with VPNs
571
Setting Up Your UTM-1 Appliance as a VPN Server
5.
See Configuring L2TP VPN Clients on page 577.
Set up remote VPN access for users.
See Setting Up Remote VPN Access for Users on page 644.
Note: Disabling the VPN Server for a specific type of connection will cause all existing
VPN tunnels of that type to disconnect.
572
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
Configuring the SecuRemote Remote Access VPN Server
To configure the SecuRemote Remote Access VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Select the Allow remote users to connect from the Internet check box.
New check boxes appear.
3.
To allow authenticated users connecting from the Internet to bypass NAT when
connecting to your internal network, select the Bypass NAT check box.
4.
To allow authenticated users connecting from the Internet to bypass the default
firewall policy and access your internal network without restriction, select the
Bypass default firewall policy check box.
User-defined rules will still apply to the authenticated users.
5.
Click Apply.
The SecuRemote Remote Access VPN Server is enabled for the specified connection
types.
Chapter 19: Working with VPNs
573
Setting Up Your UTM-1 Appliance as a VPN Server
Configuring the SecuRemote Internal VPN Server
To configure the SecuRemote Internal VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Select the Allow remote users to connect from my internal networks check box.
New check boxes appear.
3.
To allow authenticated users connecting from internal networks to bypass the
default firewall policy and access your internal network without restriction,
select the Bypass default firewall policy check box.
User-defined rules will still apply to the authenticated users.
Note: Bypass NAT is always enabled for the SecuRemote Internal VPN Server, and
cannot be disabled.
4.
Click Apply.
The SecuRemote Internal VPN Server is enabled for the specified connection types.
Configuring the Endpoint Connect VPN Server
To configure the Endpoint Connect VPN Server
1.
Do one or more of the following:


574
To accept Endpoint Connect remote access connections from the Internet,
configure the SecuRemote Remote Access VPN Server.
See Configuring the SecuRemote Remote Access VPN Server on page 573.
To accept Endpoint Connect connections from your internal networks,
configure the SecuRemote Internal VPN Server.
See Configuring the SecuRemote Internal VPN Server on page 574.
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
2.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
3.
Select the Allow Endpoint Connect users to connect check box.
The Listening Port field appears.
4.
(Optional) In the Listening Port field, type the TCP port on which the appliance
should accept incoming Endpoint Connect connection requests.
The default listening port is 443.
5.
Click Apply.
The Endpoint Connect Remote Access VPN Server is enabled.
Configuring the L2TP VPN Server
To configure the L2TP VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Select the Allow L2TP clients to connect check box.
New check boxes appear.
3.
In the Preshared Secret field, type the preshared secret to use for secure
communications between the L2TP clients and the VPN Server.
The secret can contain spaces and special characters. It is used to secure L2TP
connections for all users.
In addition to entering this secret, each L2TP user will have to authenticate with a
username and password.
For information on defining users with VPN access permissions, see Setting Up Remote
VPN Access for Users on page 644.
4.
To allow authenticated users to bypass the default firewall policy and access
your internal network without restriction, select the Bypass default firewall
policy check box.
Chapter 19: Working with VPNs
575
Setting Up Your UTM-1 Appliance as a VPN Server
User-defined rules will still apply to the authenticated users.
5.
Click Apply.
The L2TP VPN Server is enabled for the specified connection types.
Installing SecuRemote
If you configured the SecuRemote Internal VPN Server, you must install the
SecuRemote/SecureClient VPN Client on all internal network computers that should be
allowed to remotely access your network via SecuRemote connections.
To install SecureClient/SecuRemote
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Click the Download link.
The VPN clients for UTM-1 Edge and [email protected] page opens in a new window.
3.
Follow the online instructions to complete installation.
SecureClient/SecuRemote is installed.
For information on using SecureClient/SecuRemote, see the User Help. To access
SecureClient/SecuRemote User Help, right-click on the VPN Client icon in the taskbar,
select Settings, and then click Help.
Installing Endpoint Connect
If you configured the Endpoint Connect Internal VPN Server, you must install the Endpoint
Connect VPN Client on all computers that should be allowed to remotely access your
network.
To install Endpoint Connect
1.
576
Click VPN in the main menu, and click the VPN Server tab.
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
The VPN Server page appears.
2.
Click the Download link.
The VPN clients for UTM-1 Edge and [email protected] page opens in a new window.
3.
Follow the online instructions to complete installation.
Endpoint Connect is installed.
Configuring L2TP VPN Clients
If you configured the L2TP VPN Server, you must configure the L2TP VPN Client on all
computers that should be allowed to remotely access your network via L2TP connections.
This procedure is relevant for computers with a Windows XP operating system.
Note: The UTM-1 appliance supports the following authentication methods:

PAP. For both local users and RADIUS users

EAP-MD5, CHAP. For local users, but not for RADIUS users
To configure L2TP VPN Clients on Microsoft Windows
1.
Click Start > Settings > Control Panel.
The Control Panel window appears.
2.
Double-click the Network and Dial-up Connections icon.
The Network and Dial-up Connections window appears.
3.
Click File > New Connection.
Chapter 19: Working with VPNs
577
Setting Up Your UTM-1 Appliance as a VPN Server
The New Connection Wizard opens displaying the Welcome to the New Connection
Wizard screen.
4.
Click Next.
The Network Connection Type dialog box appears.
5.
Choose Connect to the network at my workplace.
6.
Click Next.
578
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
7.
The Network Connection dialog box appears.
8.
Choose Virtual Private Network connection.
9.
Click Next.
The Connection Name dialog box appears.
10. In the Company Name field, type your company's name.
11. Click Next.
Chapter 19: Working with VPNs
579
Setting Up Your UTM-1 Appliance as a VPN Server
The Public Network dialog box appears.
12. Choose Do not dial the initial connection.
13. Click Next.
The VPN Server Selection dialog box appears.
14. In the field, type the UTM-1 appliance's IP address.
580
Check Point UTM-1 Embedded NGX User Guide
Setting Up Your UTM-1 Appliance as a VPN Server
The Completing the New Connection Wizard screen appears.
15. Click Finish.
16. In the Network and Dial-up Connections window, right-click on the L2TP
connection, and click Properties in the popup menu.
The connection's Properties dialog box opens.
17. In the Security tab, choose Advanced (custom settings).
18. Click Settings.
Chapter 19: Working with VPNs
581
Setting Up Your UTM-1 Appliance as a VPN Server
The Advanced Security Settings dialog box opens.
19. In the Data encryption drop-down list, select Optional encryption.
20. Choose Allow these protocols.
21. Select the Unencrypted password (PAP) check box, and clear all other check
boxes.
22. Click OK.
23. In Properties dialog box's Security tab, click IPSec Settings.
The IPSec Settings dialog box opens.
24. Select the Use pre-shared key for authentication check box.
25. In the Key field, type the preshared secret you configured on the L2TP VPN
Server.
26. Click OK.
27. In Properties dialog box, click the Networking tab.
582
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
28. In the Type of VPN drop-down list, select L2TP IPSec VPN.
29. Click OK.
Adding and Editing VPN Sites
To add or edit VPN sites
1.
Click VPN in the main menu, and click the VPN Sites tab.
Chapter 19: Working with VPNs
583
Adding and Editing VPN Sites
The VPN Sites page appears with a list of VPN sites.
2.
Do one of the following:
 To add a VPN site, click New Site.
 To edit a VPN site, click Edit in the desired VPN site’s row.
The UTM-1 VPN Site Wizard opens, with the Welcome to the VPN Site Wizard dialog box
displayed.
3.
584
Do one of the following:
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites

4.
Select Remote Access VPN to establish remote access from your Remote
Access VPN Client to a Remote Access VPN Server.
 Select Site-to-Site VPN to create a permanent bi-directional connection to
another Site-to-Site VPN Gateway.
Click Next.
Configuring a Remote Access VPN Site
If you selected Remote Access VPN, the VPN Gateway Address dialog box appears.
1.
Enter the IP address of the Remote Access VPN Server to which you want to
connect, as given to you by the network administrator.
2.
To allow the VPN site to bypass the default firewall policy and access your
internal network without restriction, select the Bypass default firewall policy
check box.
User-defined rules will still apply to the VPN site.
3.
Click Next.
Chapter 19: Working with VPNs
585
Adding and Editing VPN Sites
The VPN Network Configuration dialog box appears.
4.
Specify how you want to obtain the VPN network configuration. Refer to VPN
Network Configuration Fields on page 595.
5.
Click Next.
The following things happen in the order below:
586
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites


If you chose Specify Configuration, a second VPN Network Configuration dialog
box appears.
Complete the fields using the information in VPN Network Configuration Fields
on page 595 and click Next.
If you chose Specify Configuration or Route All Traffic, the Backup Gateway
dialog box appears.
Chapter 19: Working with VPNs
587
Adding and Editing VPN Sites

In the Backup Gateway IP field, type the name of the VPN site to use if the primary
VPN site fails, and then click Next.
The Authentication Method dialog box appears.
6.
Complete the fields using the information in Authentication Methods Fields on
page 597.
7.
Click Next.
588
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
Username and Password Authentication Method
If you selected Username and Password, the VPN Login dialog box appears.
1.
Complete the fields using the information in VPN Login Fields on page 597.
2.
Click Next.

If you selected Automatic Login, the Connect dialog box appears.
Chapter 19: Working with VPNs
589
Adding and Editing VPN Sites
Do the following:
1) To try to connect to the Remote Access VPN Server, select the Try to
Connect to the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all existing
tunnels to this site will be terminated.

3.
2) Click Next.
If you selected Try to Connect to the VPN Gateway, the Connecting… screen
appears, and then the Contacting VPN Site screen appears.
The Site Name dialog box appears.
Enter a name for the VPN site.
You may choose any name.
4.
590
Click Next.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
The VPN Site Created screen appears.
5.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the VPN
Sites list. If you edited a VPN site, the modifications are reflected in the VPN Sites list.
Chapter 19: Working with VPNs
591
Adding and Editing VPN Sites
Certificate Authentication Method
If you selected Certificate, the Connect dialog box appears.
1.
To try to connect to the Remote Access VPN Server, select the Try to Connect to
the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all existing
tunnels to this site will be terminated.
2.
Click Next.
If you selected Try to Connect to the VPN Gateway, the Connecting… screen appears, and
then the Contacting VPN Site screen appears.
592
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
The Site Name dialog box appears.
3.
Enter a name for the VPN site.
You may choose any name.
4.
Click Next.
The VPN Site Created screen appears.
Chapter 19: Working with VPNs
593
Adding and Editing VPN Sites
5.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the VPN
Sites list. If you edited a VPN site, the modifications are reflected in the VPN Sites list.
RSA SecurID Authentication Method
If you selected RSA SecurID, the Site Name dialog box appears.
1.
Enter a name for the VPN site.
You may choose any name.
2.
594
Click Next.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
The VPN Site Created screen appears.
3.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the VPN
Sites list. If you edited a VPN site, the modifications are reflected in the VPN Sites list.
Table 134: VPN Network Configuration Fields
In this field…
Do this…
Download
Click this option to obtain the network configuration by downloading it from
Configuration
the VPN site.
This option will automatically configure your VPN settings, by downloading
the network topology definition from the Remote Access VPN Server.
Note: Downloading the network configuration is only possible if you are
connecting to a Check Point VPN-1 or UTM-1 Site-to-Site VPN Gateway.
Specify
Click this option to provide the network configuration manually.
Configuration
Chapter 19: Working with VPNs
595
Adding and Editing VPN Sites
In this field…
Do this…
Route All Traffic
Click this option to route all network traffic through the VPN site.
For example, if your VPN consists of a central office and a number of remote
offices, and the remote offices are only allowed to access Internet resources
through the central office, you can choose to route all traffic from the remote
offices through the central office.
Note: You can only configure one VPN site to route all traffic.
Route Based VPN
Click this option to create a virtual tunnel interface (VTI) for this site, so that
it can participate in a route-based VPN.
Route-based VPNs allow routing connections over VPN tunnels, so that
remote VPN sites can participate in dynamic or static routing schemes. This
improves network and VPN management efficiency for large networks.
For constantly changing networks, it is recommended to use a route-based
VPN combined with OSPF dynamic routing. This enables you to make
frequent changes to the network topology, such as adding an internal
network, without having to reconfigure static routes.
OSPF is enabled using CLI. For information on using CLI, see Controlling
the Appliance via the Command Line on page 665. For information on the
relevant commands for OSPF, refer to the Embedded NGX CLI Reference
Guide.
This option is only available when configuring a Site-to-Site VPN gateway.
Destination network
Type up to three destination network addresses at the VPN site to which you
want to connect.
Subnet mask
Select the subnet masks for the destination network addresses.
Note: Obtain the destination networks and subnet masks from the VPN site’s
system administrator.
596
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
Table 135: Authentication Methods Fields
In this field…
Do this…
Username and
Select this option to use a user name and password for VPN authentication.
Password
In the next step, you can specify whether you want to log in to the VPN site
automatically or manually.
Certificate
Select this option to use a certificate for VPN authentication.
If you select this option, a certificate must have been installed. (Refer to
Installing a Certificate on page 620 for more information about certificates
and instructions on how to install a certificate.)
RSA SecurID
Token
Select this option to use an RSA SecurID token for VPN authentication.
When authenticating to the VPN site, you must enter a four-digit PIN code
and the SecurID passcode shown in your SecurID token's display. The RSA
SecurID token generates a new passcode every minute.
SecurID is only supported in Remote Access manual login mode.
Table 136: VPN Login Fields
In this field…
Do this…
Manual Login
Click this option to configure the site for Manual Login.
Manual Login connects only your computer to the VPN site, and only when
the appropriate user name and password have been entered. For further
information on Automatic and Manual Login, see, Logging in to a VPN Site
on page 616.
Automatic Login
Click this option to enable the UTM-1 appliance to log in to the VPN site
automatically.
You must then fill in the Username and Password fields.
Chapter 19: Working with VPNs
597
Adding and Editing VPN Sites
In this field…
Do this…
Automatic Login provides all the computers on your internal network with
constant access to the VPN site. For further information on Automatic and
Manual Login, see Logging in to a VPN Site on page 616.
Username
Type the user name to be used for logging in to the VPN site.
Password
Type the password to be used for logging in to the VPN site.
598
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
Configuring a Site-to-Site VPN Gateway
If you selected Site-to-Site VPN, the VPN Gateway Address dialog box appears.
1.
Complete the fields using the information in VPN Gateway Address Fields on
page 611.
2.
Click Next.
Chapter 19: Working with VPNs
599
Adding and Editing VPN Sites
The VPN Network Configuration dialog box appears.
3.
Specify how you want to obtain the VPN network configuration. Refer to VPN
Network Configuration Fields on page 595.
4.
Click Next.

600
If you chose Specify Configuration, a second VPN Network Configuration dialog
box appears.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites


Complete the fields using the information in VPN Network Configuration Fields
on page 595, and then click Next.
If you chose Specify Configuration or Route All Traffic, the Backup Gateway
dialog box appears.
In the Backup Gateway IP field, type the name of the VPN site to use if the primary
VPN site fails, and then click Next.
If you chose Route Based VPN, the Route Based VPN dialog box appears.
Chapter 19: Working with VPNs
601
Adding and Editing VPN Sites

Complete the fields using the information in Route Based VPN Fields on page 612,
and then click Next.
The Authentication Method dialog box appears.
5.
Complete the fields using the information in Authentication Methods Fields on
page 612.
6.
Click Next.
602
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
Shared Secret Authentication Method
If you selected Shared Secret, the Authentication dialog box appears.
If you chose Download Configuration, the dialog box contains additional fields.
1.
Complete the fields using the information in VPN Authentication Fields on
page 613 and click Next.
Chapter 19: Working with VPNs
603
Adding and Editing VPN Sites
The Security Methods dialog box appears.
2.
To configure advanced security settings, click Show Advanced Settings.
New fields appear.
3.
604
Complete the fields using the information in Security Methods Fields on page
613 and click Next.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
The Connect dialog box appears.
4.
To try to connect to the Remote Access VPN Server, select the Try to Connect to
the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all existing
tunnels to this site will be terminated.
5.
Click Next.

If you selected Try to Connect to the VPN Gateway, the Connecting… screen
appears, and then the Contacting VPN Site screen appears.
Chapter 19: Working with VPNs
605
Adding and Editing VPN Sites

6.
The Site Name dialog box appears.
Type a name for the VPN site.
You may choose any name.
7.
To keep the tunnel to the VPN site alive even if there is no network traffic
between the UTM-1 appliance and the VPN site, select Keep this site alive.
8.
Click Next.
606
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites

9.
If you selected Keep this site alive, and previously you chose Download
Configuration, the "Keep Alive" Configuration dialog box appears.
Do the following:
1) Type up to three IP addresses which the UTM-1 appliance should ping
in order to keep the tunnel to the VPN site alive.
2) Click Next.
 The VPN Site Created screen appears.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the VPN
Sites list. If you edited a VPN site, the modifications are reflected in the VPN Sites list.
Certificate Authentication Method
If you selected Certificate, the following things happen:
Chapter 19: Working with VPNs
607
Adding and Editing VPN Sites
1.
608

If you chose Download Configuration, the Authentication dialog box appears.

Complete the fields using the information in VPN Authentication Fields on page
613 and click Next.
The Security Methods dialog box appears.
To configure advanced security settings, click Show Advanced Settings.
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
New fields appear.
2.
Complete the fields using the information in Security Methods Fields on page
613 and click Next.
The Connect dialog box appears.
3.
To try to connect to the Remote Access VPN Server, select the Try to Connect to
the VPN Gateway check box.
Chapter 19: Working with VPNs
609
Adding and Editing VPN Sites
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all existing
tunnels to this site will be terminated.
4.
Click Next.



5.
If you selected Try to Connect to the VPN Gateway, the following things happen:
The Connecting… screen appears.
The Contacting VPN Site screen appears.
The Site Name dialog box appears.
Enter a name for the VPN site.
You may choose any name.
6.
To keep the tunnel to the VPN site alive even if there is no network traffic
between the UTM-1 appliance and the VPN site, select Keep this site alive.
7.
Click Next.
610
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites

8.
If you selected Keep this site alive, and previously you chose Download
Configuration, the "Keep Alive" Configuration dialog box appears.
Do the following:
1) Type up to three IP addresses which the UTM-1 appliance should ping
in order to keep the tunnel to the VPN site alive.
2) Click Next.
 The VPN Site Created screen appears.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the VPN
Sites list. If you edited a VPN site, the modifications are reflected in the VPN Sites list.
Table 137: VPN Gateway Address Fields
In this field…
Do this…
Gateway Address
Type the IP address of the Site-to-Site VPN Gateway to which you want to
connect, as given to you by the network administrator.
Chapter 19: Working with VPNs
611
Adding and Editing VPN Sites
In this field…
Do this…
Bypass NAT
Select this option to allow the VPN site to bypass NAT when connecting to
your internal network.
This option is selected by default.
Bypass default
Select this option to allow the VPN site to bypass the default firewall policy
firewall policy
and access your internal network without restriction.
User-defined rules will still apply to the VPN site.
Table 138: Route Based VPN Fields
In this field…
Do this…
Tunnel Local IP
Type a local IP address for this end of the VPN tunnel.
Tunnel Remote IP
Type the IP address of the remote end of the VPN tunnel.
OSPF Cost
Type the cost of this link for dynamic routing purposes.
The default value is 10.
If OSPF is not enabled, this setting is not used. OSPF is enabled using the
UTM-1 command line interface (CLI). For information on using CLI, see
Controlling the Appliance via the Command Line on page 665. For
information on the relevant commands for OSPF, refer to the Embedded
NGX CLI Reference Guide.
Table 139: Authentication Methods Fields
In this field…
Do this…
Shared Secret
Select this option to use a shared secret for VPN authentication.
A shared secret is a string used to identify VPN sites to each other.
612
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing VPN Sites
In this field…
Do this…
Certificate
Select this option to use a certificate for VPN authentication.
If you select this option, a certificate must have been installed. (Refer to
Installing a Certificate on page 620 for more information about certificates
and instructions on how to install a certificate.)
Table 140: VPN Authentication Fields
In this field…
Do this…
Topology User
Type the topology user’s user name.
Topology Password
Type the topology user’s password.
Use Shared Secret
Type the shared secret to use for secure communications with the VPN site.
This shared secret is a string used to identify the VPN sites to each other.
The secret can contain spaces and special characters.
Table 141: Security Methods Fields
In this field…
Do this…
Phase 1
Security Methods
Diffie-Hellman
Select the encryption and integrity algorithm to use for IKE negotiations:

Automatic. The UTM-1 appliance automatically selects the best
security methods supported by the site. This is the default.

A specific algorithm
Select the Diffie-Hellman group to use:

Automatic. The UTM-1 appliance automatically selects a group.
Chapter 19: Working with VPNs
613
Adding and Editing VPN Sites
In this field…
group
Do this…
This is the default.

A specific group
A group with more bits ensures a stronger key but lowers performance.
Renegotiate every
Type the interval in minutes between IKE Phase-1 key negotiations. This is
the IKE Phase-1 SA lifetime.
A shorter interval ensures higher security, but impacts heavily on
performance. Therefore, it is recommended to keep the SA lifetime around
its default value.
The default value is 1440 minutes (one day).
Phase 2
Security Methods
Select the encryption and integrity algorithm to use for VPN traffic:

Automatic. The UTM-1 appliance automatically selects the best
security methods supported by the site. This is the default.

A specific algorithm
Perfect Forward
Specify whether to enable Perfect Forward Secrecy (PFS), by selecting one
Secrecy
of the following:

Enabled. PFS is enabled. The Diffie-Hellman group field is enabled.

Disabled. PFS is disabled. This is the default.
Enabling PFS will generate a new Diffie-Hellman key during IKE Phase 2
and renew the key for each key exchange.
PFS increases security but lowers performance. It is recommended to
enable PFS only in situations where extreme security is required.
Diffie-Hellman
Select the Diffie-Hellman group to use:
group

Automatic. The UTM-1 appliance automatically selects a group.
This is the default.

A specific group
614
Check Point UTM-1 Embedded NGX User Guide
Viewing and Deleting VPN Sites
In this field…
Do this…
A group with more bits ensures a stronger key but lowers performance.
Renegotiate every
Type the interval in seconds between IPSec SA key negotiations. This is the
IKE Phase-2 SA lifetime.
A shorter interval ensures higher security.
The default value is 3600 seconds (one hour).
Viewing and Deleting VPN Sites
To view or delete a VPN site
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears, with a list of all VPN sites.
2.
To delete a VPN site, do the following.
a.
b.
In the desired VPN site's row, click the Erase
A confirmation message appears.
Click OK.
The VPN site is deleted.
icon.
Enabling/Disabling a VPN Site
You can only connect to VPN sites that are enabled.
Chapter 19: Working with VPNs
615
Logging in to a Remote Access VPN Site
To enable/disable a VPN site
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears, with a list of VPN sites.
2.
To enable a VPN site, do the following:
a.
b.
3.
Click the
icon in the desired VPN site’s row.
A confirmation message appears.
Click OK.
The icon changes to
, and the VPN site is enabled.
To disable a VPN site, do the following:
Note: Disabling a VPN site eliminates the tunnel and erases the network topology.
a.
b.
Click the
icon in the desired VPN site’s row.
A confirmation message appears.
Click OK.
The icon changes to
, and the VPN site is disabled.
Logging in to a Remote Access VPN Site
You need to manually log in to Remote Access VPN Servers configured for Manual Login.
You do not need to manually log in to a Remote Access VPN Server configured for
Automatic Login or a Site-to-Site VPN Gateway: all the computers on your network have
constant access to it.
Manual Login can be done through either the UTM-1 Portal or the my.vpn page. When you
log in and traffic is sent to the VPN site, a VPN tunnel is established. Only the computer
from which you logged in can use the tunnel. To share the tunnel with other computers in
your home network, you must log in to the VPN site from those computers, using the same
user name and password.
616
Check Point UTM-1 Embedded NGX User Guide
Logging in to a Remote Access VPN Site
Note: You must use a single user name and password for each VPN destination
gateway.
Logging in through the UTM-1 Portal
Note: You can only log in to sites that are configured for Manual Login.
To manually log in to a VPN site through the UTM-1 Portal
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears.
2.
Next to the desired VPN site, click Login.
The VPN Status dialog box appears.
3.
Type your user name and password in the appropriate fields.
4.
Click Login.


If the UTM-1 appliance is configured to automatically download the network
configuration, the UTM-1 appliance downloads the network configuration.
If when adding the VPN site you specified a network configuration, the UTM-1
appliance attempts to create a tunnel to the VPN site.
Once the UTM-1 appliance has finished connecting, the dialog box displays
―Connected‖.
Chapter 19: Working with VPNs
617
Logging in to a Remote Access VPN Site

The VPN Status dialog box remains open until you manually log out of the VPN
site.
Logging in through the my.vpn page
To manually log in to a VPN site through the my.vpn page
1.
Direct your Web browser to http://my.vpn
The VPN Login screen appears.
2.
In the Site Name list, select the site to which you want to log in.
3.
Enter your user name and password in the appropriate fields.
4.
Click Login.




618
If the UTM-1 appliance is configured to automatically download the network
configuration, the UTM-1 appliance downloads the network configuration.
If when adding the VPN site you specified a network configuration, the UTM-1
appliance attempts to create a tunnel to the VPN site.
The VPN Login Status box appears. The Status field tracks the connection’s
progress.
Once the UTM-1 appliance has finished connecting, the Status field changes to
―Connected‖.
Check Point UTM-1 Embedded NGX User Guide
Logging Out of a Remote Access VPN Site

The VPN Login Status box remains open until you manually log out of the VPN
site.
Logging Out of a Remote Access VPN Site
You can manually log out of a VPN site, if it is a Remote Access VPN site configured for
Manual Login.
To log out of a VPN site

In the VPN Login Status box, click Logout.
All open tunnels from the UTM-1 appliance to the VPN site are closed, and the VPN
Login Status box closes.
Note: Closing the browser or dismissing the VPN Login Status box will also terminate the
VPN session within a short time.
Using Certificates
A digital certificate is a secure means of authenticating the UTM-1 appliance to other
Site-to-Site VPN Gateways. The certificate is issued by the Certificate Authority (CA) to
entities such as gateways, users, or computers. The entity then uses the certificate to identify
itself and provide verifiable information.
For instance, the certificate includes the Distinguished Name (DN) (identifying information)
of the entity, as well as the public key (information about itself). After two entities exchange
and validate each other's certificates, they can begin encrypting information between
themselves using the public keys in the certificates.
The certificate also includes a fingerprint, a unique text used to identify the certificate. You
can email your certificate's fingerprint to the remote user. Upon connecting to the UTM-1
VPN Server for the first time, the entity should check that the VPN peer's fingerprint
Chapter 19: Working with VPNs
619
Using Certificates
displayed in the SecuRemote/SecureClient VPN Client is identical to the fingerprint
received.
The UTM-1 appliance supports certificates encoded in the PKCS#12 (Personal Information
Exchange Syntax Standard) format.
Installing a Certificate
The UTM-1 appliance enables you to install PKCS#12 certificates in the following ways:

By generating a self-signed certificate.
See Generating a Self-Signed Certificate on page 620.

By importing a certificate.
The PKCS#12 file you import must have a ".p12" file extension. If you do not have such
a PKCS#12 file, obtain one from your network security administrator.
See Importing a Certificate on page 624.
Note: To use certificates authentication, each UTM-1 appliance should have a unique
certificate. Do not use the same certificate for more than one gateway.
Note: When the firewall is managed by SmartCenter, it automatically downloads a
certificate from SmartCenter, and therefore there is no need to install one.
Generating a Self-Signed Certificate
To generate a self-signed certificate
1.
620
Click VPN in the main menu, and click the Certificate tab.
Check Point UTM-1 Embedded NGX User Guide
Using Certificates
The Certificate page appears.
2.
Click Install Certificate.
The UTM-1 Certificate Wizard opens, with the Certificate Wizard dialog box displayed.
3.
Click Generate a self-signed security certificate for this gateway.
Chapter 19: Working with VPNs
621
Using Certificates
The Create Self-Signed Certificate dialog box appears.
4.
Complete the fields using the information in the following table.
5.
Click Next.
The UTM-1 appliance generates the certificate. This may take a few seconds.
The Done dialog box appears, displaying the certificate's details.
622
Check Point UTM-1 Embedded NGX User Guide
Using Certificates
6.
Click Finish.
The UTM-1 appliance installs the certificate. If a certificate is already installed, it is
overwritten.
The Certificate Wizard closes.
The Certificates page displays the following information:







The gateway's certificate
The gateway's name
The gateway certificate's fingerprint
The CA's certificate
The name of the CA that issued the certificate (in this case, the UTM-1
gateway)
The CA certificate's fingerprint
The starting and ending dates between which the gateway's certificate and the
CA's certificate are valid
Chapter 19: Working with VPNs
623
Using Certificates
Table 142: Certificate Fields
In this field…
Do this…
Country
Select your country from the drop-down list.
Organization Name
Type the name of your organization.
Organizational Unit
Type the name of your division.
Gateway Name
Type the gateway's name. This name will appear on the certificate, and will
be visible to remote users inspecting the certificate.
This field is filled in automatically with the gateway's MAC address. If
desired, you can change this to a more descriptive name.
Valid Until
Use the drop-down lists to specify the month, day, and year when this
certificate should expire.
Note: You must renew the certificate when it expires.
Importing a Certificate
To install a certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears.
2.
Click Install Certificate.
The UTM-1 Certificate Wizard opens, with the Certificate Wizard dialog box displayed.
3.
624
Click Import a security certificate in PKCS#12 format.
Check Point UTM-1 Embedded NGX User Guide
Using Certificates
The Import Certificate dialog box appears.
4.
Click Browse to open a file browser from which to locate and select the file.
The filename that you selected is displayed.
5.
Click Next.
The Import-Certificate Passphrase dialog box appears. This may take a few moments.
Chapter 19: Working with VPNs
625
Using Certificates
6.
Type the pass-phrase you received from the network security administrator.
7.
Click Next.
The Done dialog box appears, displaying the certificate's details.
8.
Click Finish.
The UTM-1 appliance installs the certificate. If a certificate is already installed, it is
overwritten.
The Certificate Wizard closes.
The Certificates page displays the following information:







The gateway's certificate
The gateway's name
The gateway certificate's fingerprint
The CA's certificate
The name of the CA that issued the certificate
The CA certificate's fingerprint
The starting and ending dates between which the gateway's certificate and the
CA's certificate are valid
Uninstalling a Certificate
If you uninstall the certificate, no certificate will exist on the UTM-1 appliance, and you will
not be able to connect to the VPN if a certificate is required.
You cannot uninstall the certificate if there is a VPN site currently defined to use certificate
authentication.
Note: If you want to replace a currently-installed certificate, there is no need to uninstall
the certificate first. When you install the new certificate, the old certificate will be
overwritten.
To uninstall a certificate
1.
626
Click VPN in the main menu, and click the Certificate tab.
Check Point UTM-1 Embedded NGX User Guide
Using Certificates
The Certificate page appears with the name of the currently installed certificate.
2.
Click Uninstall.
A confirmation message appears.
3.
Click OK.
The certificate is uninstalled.
A success message appears.
4.
Click OK.
Exporting Certificates
The UTM-1 appliance allows you to export the following certificates:

The device certificate
Exporting the device certificate is useful for backup purposes.
Note: If the firewall is managed by SmartCenter, there is no need to back up the device
certificate, as it can be downloaded from SmartCenter as needed.

The device Certificate Authority (CA) certificate
When using the UTM-1 EAP authenticator with WPA-Enterprise or 802.1x security
protocols, you must export the device CA certificate and send it to clients that need to
connect to the UTM-1 appliance. For information on the EAP authenticator, see Using
the EAP Authenticator on page 404.
The certificates are exported in PKCS#12 format (that is, as a *.p12 file).
Exporting the UTM-1 Appliance Certificate
To export the UTM-1 appliance certificate
1.
Click VPN in the main menu, and click the Certificate tab.
Chapter 19: Working with VPNs
627
Using Certificates
The Certificate page appears with the name of the currently installed certificate.
2.
Click Export Certificate.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the certificate file and click Save.
The certificate is exported as a *.p12 file and saved to the specified directory.
Note: This file contains the gateway's private key, which is confidential and must not be
passed to unauthorized users.
Exporting the CA Certificate
To export the CA certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears with the name of the currently installed certificate.
2.
Click Export CA Certificate.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the CA certificate file and click Save.
The CA certificate is exported as a *.p12 file and saved to the specified directory.
628
Check Point UTM-1 Embedded NGX User Guide
Viewing VPN Tunnels
Viewing VPN Tunnels
You can view a list of currently established VPN tunnels. VPN tunnels are created and
closed as follows:

Remote Access VPN sites configured for Automatic Login and Site-to-Site VPN
Gateways
A tunnel is created whenever your computer attempts any kind of communication with a
computer at the VPN site. The tunnel is closed when not in use for a period of time.
Note: Although the VPN tunnel is automatically closed, the site remains open, and if
you attempt to communicate with the site, the tunnel will be reestablished.

Remote Access VPN sites configured for Manual Login
A tunnel is created whenever your computer attempts any kind of communication with a
computer at the VPN site, after you have manually logged in to the site. All open tunnels
connecting to the site are closed when you manually log out.
To view VPN tunnels
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open VPN tunnels.
The VPN Tunnels page includes the information described in the following table.
Chapter 19: Working with VPNs
629
Viewing VPN Tunnels
2.
To resize a column, drag the relevant column divider right or left.
3.
To refresh the table, click Refresh.
Table 143: VPN Tunnels Page Fields
This field…
Type
Source
Displays…
The currently active security protocol (IPSEC).
The IP address or address range of the entity from which the tunnel originates.
The entity's type is indicated by an icon. See VPN Tunnel Icons on page 631.
Destination
The IP address or address range of the entity to which the tunnel is connected.
The entity's type is indicated by an icon. See VPN Tunnel Icons on page 631.
Security
The type of encryption used to secure the connection, and the type of Message
Authentication Code (MAC) used to verify the integrity of the message. This
information is presented in the following format: Encryption type/Authentication
type.
In addition, if IPSec compression is enabled for the tunnel, this field displays
the
icon.
Note: All VPN settings are automatically negotiated between the two sites. The
encryption and authentication schemes used for the connection are the
strongest of those used at the two sites.
Your UTM-1 appliance supports AES, 3DES, and DES encryption schemes,
and MD5 and SHA authentication schemes.
630
Check Point UTM-1 Embedded NGX User Guide
Viewing IKE Traces for VPN Connections
This field…
Displays…
Established
The time at which the tunnel was established.
This information is presented in the format hh:mm:ss, where:
hh=hours
mm=minutes
ss=seconds
Table 144: VPN Tunnels Icons
This icon…
Represents…
This gateway
A network for which an IKE Phase-2 tunnel was negotiated
A Remote Access VPN Server
A Site-to-Site VPN Gateway
A remote access VPN user
An L2TP user
Viewing IKE Traces for VPN Connections
If you are experiencing VPN connection problems, you can save a trace of IKE (Internet Key
Exchange) negotiations to a file, and then use the free IKE View tool to view the file.
The IKE View tool is available for the Windows platform.
Chapter 19: Working with VPNs
631
Viewing IKE Traces for VPN Connections
Note: Before viewing IKE traces, it is recommended to do the following:

The UTM-1 appliance stores traces for all recent IKE negotiations. If you
want to view only new IKE trace data, clear all IKE trace data currently
stored on the UTM-1 appliance.

Close all existing VPN tunnels except for the problematic tunnel, so as to
make it easier to locate the problematic tunnel's IKE negotiation trace in
the exported file.
To clear all currently-stored IKE traces
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
2.
Click Clear IKE Trace.
All IKE trace data currently stored on the UTM-1 appliance is cleared.
To view the IKE trace for a connection
1.
Establish a VPN tunnel to the VPN site with which you are experiencing
connection problems.
For information on when and how VPN tunnels are established, see Viewing VPN
Tunnels on page 629.
2.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
3.
Click Save IKE Trace.
A standard File Download dialog box appears.
4.
Click Save.
The Save As dialog box appears.
5.
Browse to a destination directory of your choice.
6.
Type a name for the *.elg file and click Save.
The *.elg file is created and saved to the specified directory. This file contains the IKE
traces of all currently-established VPN tunnels.
632
Check Point UTM-1 Embedded NGX User Guide
Viewing VPN Topology
7.
Use the IKE View tool to open and view the *.elg file, or send the file to
technical support.
Viewing VPN Topology
You can view the topology of VPN sites to which the UTM-1 appliance is currently
connected.
To view VPN topology
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
2.
Click View Topology.
The VPN Topology page appears displaying a tree of VPN sites to which the appliance is
connected.
3.
To view topology information for a VPN site, in the tree, click the VPN site's
name.
The right pane displays the information described in the following table.
Chapter 19: Working with VPNs
633
Viewing VPN Topology
Table 145: VPN Topology Page Fields
This field…
Displays…
Split DNS
The VPN site's split DNS mappings.
When split DNS is configured for a VPN site, certain domain suffixes are
mapped to corporate DNS servers. This means that requests for these domain
suffixes are sent to the specific DNS servers to which they are mapped, while
all other requests are sent to the ISP's DNS servers. For example, a VPN site's
split DNS mappings might indicate that all requests for the domain suffix
".acme.com" should be sent to the Acme company's corporate DNS servers.
Trusted CAs
A list of root CAs at the VPN site, whose certificates are trusted by this
gateway.
Sub-CAs
A list of second-level CAs at the VPN site, which are signed by a trusted root
CA.
634
Check Point UTM-1 Embedded NGX User Guide
Changing Your Login Credentials
Chapter 20
Managing Users
This chapter describes how to manage UTM-1 appliance users. You can define multiple
users, set their passwords, and assign them various permissions.
This chapter includes the following topics:
Changing Your Login Credentials ............................................................ 635
Adding and Editing Users.........................................................................637
Adding Quick Guest HotSpot Users ......................................................... 642
Viewing and Deleting Users .....................................................................643
Setting Up Remote VPN Access for Users ............................................... 644
Using RADIUS Authentication ................................................................ 645
Configuring RADIUS Attributes .............................................................. 650
Changing Your Login Credentials
You can change your username and password at any time.
To change your login credentials
1.
Click Users in the main menu, and click the Internal Users tab.
Chapter 20: Managing Users
635
Changing Your Login Credentials
The Internal Users page appears.
2.
In the row of your username, click Edit.
The Account Wizard opens displaying the Set User Details dialog box.
3.
Edit the Username field.
4.
Edit the Password and Confirm password fields.
636
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Users
Note: Use 5 to 25 characters (letters or numbers) for the new password.
5.
Click Next.
The Set User Permissions dialog box appears.
6.
Click Finish.
Your changes are saved.
Adding and Editing Users
This procedure explains how to add and edit users.
For information on quickly adding guest HotSpot users via a shortcut that the UTM-1
appliance provides, see Adding Quick Guest HotSpot Users on page 642.
To add or edit a user
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears.
Chapter 20: Managing Users
637
Adding and Editing Users
2.
Do one of the following:

To create a new user, click New User.
 To edit an existing user, click
next to the desired user.
The Account Wizard opens displaying the Set User Details dialog box.
3.
Complete the fields using the information in Set User Details Fields on page
639.
4.
Click Next.
638
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Users
The Set User Permissions dialog box appears.
The options that appear on the page are dependent on the software and services you are
using.
5.
Complete the fields using the information in Set User Permissions Fields on
page 640.
6.
Click Finish.
The user is saved.
Table 146: Set User Details Fields
In this field…
Do this…
Username
Enter a username for the user.
Password
Enter a password for the user. Use five to 25 characters (letters or
numbers) for the new password.
Confirm Password
Re-enter the user’s password.
Chapter 20: Managing Users
639
Adding and Editing Users
In this field…
Do this…
Expires On
To specify an expiration time for the user, select this option and specify
the expiration date and time in the fields provided.
When the user account expires, it is locked, and the user can no longer
log in to the UTM-1 appliance.
If you do not select this option, the user will not expire.
Table 147: Set User Permissions Fields
In this field...
Do this...
Administrator Level
Select the user’s level of access to the UTM-1 Portal.
The levels are:

No Access: The user cannot access the UTM-1 Portal.

Read Only: The user can log in to the UTM-1 Portal, but cannot
modify system settings or export the appliance configuration
via the Setup>Tools page. For example, you could assign this
administrator level to technical support personnel who need to
view the Event Log.

Read/Write: The user can log in to the UTM-1 Portal and modify
system settings.
The default level is No Access.
The ―admin‖ user’s Administrator Level (Read/Write) cannot be changed.
VPN Remote Access
Select this option to allow the user to connect to this UTM-1 appliance
using their VPN client.
For further information on setting up VPN remote access, see Setting Up
Remote VPN Access for Users on page 644
640
Check Point UTM-1 Embedded NGX User Guide
Adding and Editing Users
Web Filtering
Select this option to allow the user to override the Web Filtering service
Override
and Web rules.
This option cannot be changed for the ―admin‖ user.
HotSpot Access
Select this option to allow the user to log in to the My HotSpot page.
For information on Secure HotSpot, see Configuring Secure HotSpot
on page 391.
Remote Desktop
Select this option to allow the user to log in to the my.firewall portal, view
Access
the My Computers page, and remotely access computers' desktops, using
the Remote Desktop feature.
Note: The user can perform these actions, even if their level of
administrative access is "No Access".
For information on Remote Desktop, see Using Remote Desktop on
page 655.
Users Manager
Select this option to allow the user to log in to the UTM-1 Portal and add,
edit, or delete "No Access"-level users, but not modify other system
settings.
For example, you could assign this administrator level to clerks who need
to manage HotSpot users.
Network Access
Select this option to allow the user to connect to this UTM-1 appliance via
a wireless client or by connecting to the appliance's ports, when the
UTM-1 EAP authenticator is used.
For information on the UTM-1 EAP authenticator, see Using the UTM-1
EAP Authenticator on page 404.
Chapter 20: Managing Users
641
Adding Quick Guest HotSpot Users
Adding Quick Guest HotSpot Users
The UTM-1 appliance provides a shortcut for quickly adding a guest HotSpot user. This is
useful in situations where you want to grant temporary network access to guests, for
example in an Internet café. The shortcut also enables printing the guest user's details in one
click.
By default, the quick guest user has the following characteristics:

Username in the format guest<number>, where <number> is a unique
three-digit number.
For example: guest123

Randomly generated password

Expires in 24 hours

Administration Level: No Access

Permissions: HotSpot Access only
For information on configuring Secure HotSpot, see Using Secure HotSpot on page 391.
For information on changing the default expiration period, refer to the Embedded NGX CLI
Reference Guide.
To quickly create a guest user
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears.
2.
642
Click Quick Guest.
Check Point UTM-1 Embedded NGX User Guide
Viewing and Deleting Users
The Account Wizard opens displaying the Save Quick Guest dialog box.
3.
In the Expires field, click on the arrows to specify the expiration date and time.
4.
To print the user details, click Print.
5.
Click Finish.
The guest user is saved.
You can edit the guest user's details and permissions using the procedure Adding and
Editing Users on page 637.
Viewing and Deleting Users
To view or delete users
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears with a list of all users and their permissions.
The expiration time of expired users appears in red.
2.
To delete a user, do the following:
Chapter 20: Managing Users
643
Setting Up Remote VPN Access for Users
In the desired user’s row, click
.
A confirmation message appears.
b) Click OK.
The user is deleted.
To delete all expired users, do the following:
a)
3.
Click Clear Expired.
A confirmation message appears.
b) Click OK.
The expired users are deleted.
a)
Setting Up Remote VPN Access for Users
If you are using your UTM-1 appliance as a SecuRemote Remote Access VPN Server, as an
internal VPN Server, or as an L2TP VPN Server, you can allow users to access it remotely
through their Remote Access VPN Clients (a Check Point SecureClient, Check Point
SecuRemote, an L2TP VPN Client, an Endpoint Connect client, or another Embedded NGX
appliance).
To set up remote VPN access for a user
1.
Enable your VPN Server, using the procedure Setting Up Your UTM-1
Appliance as a VPN Server on page 570.
2.
Add or edit the user, using the procedure Adding and Editing Users on page
637.
You must select the VPN Remote Access option.
644
Check Point UTM-1 Embedded NGX User Guide
Using RADIUS Authentication
Using RADIUS Authentication
You can use Remote Authentication Dial-In User Service (RADIUS) to authenticate both
UTM-1 appliance users and Remote Access VPN Clients trying to connect to the UTM-1
appliance.
Note: When RADIUS authentication is in use, the UTM-1 appliance must have a
certificate.
When a user tries to log in to the UTM-1 Portal, the UTM-1 appliance sends the entered user
name and password to the RADIUS server. The server then checks whether the RADIUS
database contains a matching user name and password pair. If so, then the user is logged in.
By default, all RADIUS-authenticated users are assigned the set of permissions specified in
the UTM-1 Portal's RADIUS page. However, you can configure the RADIUS server to pass
the UTM-1 appliance a specific set of permissions to grant the authenticated user, instead of
these default permissions. This is done by configuring the RADIUS Vendor-Specific
Attribute (VSA) with a set of attributes containing permission information for specific users.
If the VSA is configured for a user, then the RADIUS server passes the VSA to the UTM-1
appliance as part of the response to the authentication request, and the gateway assigns the
user permissions as specified in the VSA. If the VSA is not returned by the RADIUS server
for a specific user, the gateway will use the default permission set for this user.
In addition, you can configure the RADIUS server to pass the UTM-1 appliance a Secure
HotSpot session timeout value. When the RADIUS server's Session-Timeout Attribute is
configured, HotSpot users will be logged out after the specified session timeout has elapsed.
Finally, you can track network usage, by configuring RADIUS accounting. When this
option is enabled, the UTM-1 appliance sends session information to the RADIUS server at
the beginning and end of a user session, including the unique session identifier, session
start/end time, and additional statistical data. This data can then be used to charge the user
for network usage and to compile performance reports. For example, when Secure HotSpot
is enabled, you can use RADIUS accounting to measure HotSpot sessions and bill HotSpot
users accordingly. You can also use third-party products with the RADIUS server to analyze
RADIUS accounting data and generate performance reports for Secure HotSpot usage.
Chapter 20: Managing Users
645
Using RADIUS Authentication
Note: You can configure the UTM-1 appliance to send accounting information to the
RADIUS server throughout the entire session. This allows for richer data collection.
For information, refer to the Embedded NGX CLI Reference Guide.
To use RADIUS authentication
1.
Click Users in the main menu, and click the RADIUS tab.
The RADIUS page appears.
2.
Complete the fields using the following table.
3.
Click Apply.
4.
To restore the default RADIUS settings, do the following:
646
Check Point UTM-1 Embedded NGX User Guide
Using RADIUS Authentication
Click Default.
A confirmation message appears.
b) Click OK.
The RADIUS settings are reset to their defaults. For information on the default
values, refer to the following table.
If desired, configure user permissions and/or the HotSpot session timeout on the
RADIUS server.
a)
5.
See Configuring RADIUS Attributes on page 650.
Table 148: RADIUS Page Fields
In this field…
Do this…
Primary/Secondary
Configure the primary and secondary RADIUS servers.
RADIUS Server
By default, the UTM-1 appliance sends a request to the primary RADIUS
server first. If the primary RADIUS server does not respond after three
attempts, the UTM-1 appliance will send the request to the secondary
RADIUS server.
Address
Type the IP address of the computer that will run the RADIUS service
(one of your network computers) or click the corresponding This Computer
button to allow your computer to host the service.
To clear the text box, click Clear.
Port
Type the port number on the RADIUS server’s host computer.
The default port number is 1812.
Shared Secret
Type the shared secret to use for secure communication with the RADIUS
server.
Chapter 20: Managing Users
647
Using RADIUS Authentication
In this field…
Do this…
Realm
If your organization uses RADIUS realms, type the realm to append to
RADIUS requests. The realm will be appended to the username as
follows: <username>@<realm>
For example, if you set the realm to ―myrealm‖, and the user "JohnS"
attempts to log in to the UTM-1 Portal, the UTM-1 appliance will send the
RADIUS server an authentication request with the username
―[email protected]‖.
This field is optional.
Timeout
Type the interval of time in seconds between attempts to communicate
with the RADIUS server.
The default value is 3 seconds.
RADIUS Accounting
Select this option to enabling RADIUS accounting on the server.
The Accounting Port field and the Advanced Accounting area appear.
Accounting Port
Type the port number on the RADIUS server's host computer to use for
RADIUS accounting purposes.
The default port number is 1813.
RADIUS User
If the RADIUS VSA (Vendor-Specific Attribute) is configured for a user,
Permissions
the fields in this area will have no effect, and the user will be granted the
permissions specified in the VSA.
If the VSA is not configured for the user, the permissions configured in this
area will be used.
Administrator Level
Select the level of access to the UTM-1 Portal to assign to all users
authenticated by the RADIUS server.
The levels are:
648
Check Point UTM-1 Embedded NGX User Guide
Using RADIUS Authentication
In this field…
Do this…

No Access: The user cannot access the UTM-1 Portal.

Read Only: The user can log in to the UTM-1 Portal, but cannot
modify system settings or export the appliance configuration
via the Setup>Tools page. For example, you could assign this
administrator level to technical support personnel who need to
view the Event Log.

Read/Write: The user can log in to the UTM-1 Portal and modify
system settings.
The default level is No Access.
VPN Remote Access
Select this option to allow all users authenticated by the RADIUS server to
connect to this UTM-1 appliance using their VPN client.
For further information on setting up VPN remote access, see Setting Up
Remote VPN Access for Users on page 644.
Web Filtering
Select this option to allow all users authenticated by the RADIUS server to
Override
override Web Filtering.
This option only appears if the Web Filtering service is defined.
HotSpot Access
Select this option to allow all users authenticated by the RADIUS server to
access the My HotSpot page.
For information on Secure HotSpot, see Configuring Secure HotSpot
on page 391.
Remote Desktop
Select this option to allow all users authenticated by the RADIUS server to
Access
log in to the my.firewall portal, view the Active Computers page, and
remotely access computers' desktops, using the Remote Desktop
feature.
Note: Authenticated users can perform these actions, even if their level of
administrative access is "No Access".
For information on Remote Desktop, see Using Remote Desktop on
Chapter 20: Managing Users
649
Configuring RADIUS Attributes
In this field…
Do this…
page 655.
Users Manager
Select this option to allow all users authenticated by the RADIUS server to
log in to the UTM-1 Portal and add, edit, or delete "No Access"-level
users, but not modify other system settings.
For example, you could assign this administrator level to clerks who need
to manage HotSpot users.
Advanced Accounting
If you enabled RADIUS accounting, this area appears.
Send Periodic
Select this option to specify that the UTM-1 appliance should send
Updates
accounting information to the RADIUS server throughout a user session.
If you do not select this option, the UTM-1 appliance will only send
accounting information to the RADIUS server at the beginning and end of
the session.
Update Interval
The interval of time in seconds, at which the UTM-1 appliance should
send accounting information to the RADIUS server during a session.
The default value is 0.
Configuring RADIUS Attributes
To configure a timeout for Secure HotSpot sessions

Set the Session-Timeout Attribute (attribute 27) to the number of seconds after
which users should be automatically logged out from the hotspot.
To assign permissions to specific RADIUS-authenticated users
1.
650
Create a remote access policy as follows:
Check Point UTM-1 Embedded NGX User Guide
Configuring RADIUS Attributes
a)
Assign the Check Point vendor code (6983) to the VSA (attribute 26) of the
policy.
b) For each permission you want to grant, configure the relevant attribute of
the VSA with the desired value, as described in the following table.
For example, to assign the user VPN access permissions, set attribute number 2 to
―true‖.
2.
Assign the policy to the desired user or user group.
For detailed instructions and examples, refer to the "Configuring the RADIUS
Vendor-Specific Attribute" white paper.
Chapter 20: Managing Users
651
Configuring RADIUS Attributes
Table 149: VSA Syntax
Permission
Admin
Description
Indicates the
Attribute
Attribute
Number
Format
1
String
Attribute Values
Notes
none. The user
administrator’s
cannot access the
level of access to
UTM-1 Portal.
the UTM-1 Portal
readonly. The user
can log in to the
UTM-1 Portal, but
cannot modify
system settings.
users-manager. The
user can log in to
the UTM-1 Portal
and add, edit, or
delete "No
Access"-level users.
However, the user
cannot modify other
system settings.
readwrite. The user
can log in to the
UTM-1 Portal and
modify system
settings.
652
Check Point UTM-1 Embedded NGX User Guide
Configuring RADIUS Attributes
Permission
VPN
Description
Attribute Values
Notes
true. The user can
This permission is
the user can
remotely access the
only relevant if the
access the network
network via VPN.
UTM-1 Remote
from a Remote
false. The user
Access VPN
Indicates whether
Attribute
Attribute
Number
Format
2
String
Access VPN
cannot remotely
Client.
access the network
via VPN.
Hotspot
Server is enabled.
The gateway must
have a certificate.
true. The user can
This permission is
the user can log in
access the Internet
only relevant if the
via the My HotSpot
via My HotSpot.
Secure HotSpot
page.
false. The user
feature is
Indicates whether
3
String
cannot access the
enabled.
Internet via My
HotSpot.
UFP
true. The user can
This permission is
the user can
override Web
only relevant if the
override Web
Filtering.
Web Filtering
Filtering.
false. The user
service is
Indicates whether
4
String
cannot override
enabled.
Web Filtering.
Chapter 20: Managing Users
653
Configuring RADIUS Attributes
Permission
Description
Attribute
Attribute
Number
Format
5
String
Attribute Values
Notes
true. The user can
This permission is
RemoteDe
Indicates whether
sktop
the user can
log in to the
only relevant if the
remotely access
my.firewall portal,
Remote Desktop
computers'
view the Active
feature is
desktops, using
Computers page, and enabled.
the Remote
remotely access
Desktop feature.
computers'
desktops
(irrespective of their
level of
administrative
access).
false. The user
cannot remotely
access computers'
desktops.
654
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 21
Using Remote Desktop
This chapter describes how to remotely access the desktop of each of your computers, using
the UTM-1 appliance's Remote Desktop feature.
This chapter includes the following topics:
Overview ..................................................................................................655
Workflow..................................................................................................656
Configuring Remote Desktop ...................................................................656
Configuring the Host Computer ............................................................... 659
Accessing a Remote Computer's Desktop ................................................ 661
Overview
Your UTM-1 appliance includes an integrated client for Microsoft Terminal Services,
allowing you to remotely access the desktop of each of your computers from anywhere, via
the UTM-1 Portal. You can even redirect your printers or ports to a remote computer, so that
you can print and transfer files with ease.
Remote Desktop sessions use the Microsoft Remote Desktop Protocol (RDP) on TCP port
3389. This port is opened dynamically between the Remote Desktop client and the Remote
Desktop server as needed, meaning that the port is not exposed to the Internet, and your
constant security is ensured.
Note: By default, the Microsoft RDP protocol is secured with 128-bit RC4 encryption.
For the strongest possible security, it is recommended to use Remote Desktop over an
IPSec VPN connection. For information on VPNs, see Working With VPNs on page
563.
Chapter 21: Using Remote Desktop
655
Workflow
Workflow
To use Remote Desktop
1.
Configure Remote Desktop.
See Configuring Remote Desktop on page 656.
2.
Enable the Remote Desktop server on computers that authorized users should be
allowed to remotely access.
See Configuring the Host Computer on page 659.
3.
Grant Remote Desktop Access permissions to users who should be allowed to
remotely access desktops.
See Adding and Editing Users on page 637.
4.
The authorized users can access remote computers' desktops as desired.
See Accessing a Remote Computer's Desktop on page 661.
Configuring Remote Desktop
To configure Remote Desktop
1.
656
Click Setup in the main menu, and click the Remote Desktop tab.
Check Point UTM-1 Embedded NGX User Guide
Configuring Remote Desktop
The Remote Desktop page appears.
2.
Do one of the following:

To enable Remote Desktop, select the Allow remote desktop access check box.
New fields appear.

To disable Remote Desktop, clear the Allow remote desktop access check box.
Fields disappear.
Chapter 21: Using Remote Desktop
657
Configuring the Host Computer
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Table 150: Remote Desktop Options
In this field…
Do this…
Sharing
Share local drives
Select this option to allow the host computer to access hard drives on the
client computer. This enables remote users to access their local hard
drives when logged in to the host computer.
Share local printers
Select this option to allow the host computer to access printers on the
client computer. This enables remote users to access their local printer
when logged in to the host computer.
Share local
Select this option to allow the host computer to access smartcards on the
smartcards
client computer. This enables remote users to access their local
smartcards when logged in to the host computer.
Share local COM
Select this option to allow the host computer to access COM ports on the
ports
client computer. This enables remote users to access their local COM
ports when logged in to the host computer.
Advanced
Full screen mode
Select this option to open Remote Desktop sessions on the whole screen.
Optimize performance
Select this option to optimize Remote Desktop sessions for slow links.
for slow links
Bandwidth-consuming options, such as wallpaper and menu animations,
will be disabled.
658
Check Point UTM-1 Embedded NGX User Guide
Configuring the Host Computer
Configuring the Host Computer
To enable remote users to connect to a computer, you must enable the Remote Desktop
server on that computer.
Note: The host computer must have one of the following operating systems installed:

Microsoft Windows Server 2003

Microsoft Windows XP Professional

Microsoft Windows XP Media Center

Microsoft Windows XP Tablet PC 2005
To enable users to remotely connect to a computer
1.
Log on to the desired computer as an administrator.
2.
For each remote user who should be allowed to access this computer, create a
user account with a password.
For information, refer to Microsoft documentation.
3.
On the desktop, right-click on My Computer, and select Properties in the pop-up
menu that appears.
The System Properties dialog box appears displaying the General tab.
4.
Click the Remote tab.
The Remote tab appears.
Chapter 21: Using Remote Desktop
659
Configuring the Host Computer
5.
Select the Allow users to connect remotely to this computer check box.
6.
Click Select Remote Users.
The Remote Desktop Users dialog box appears.
7.
Do the following for each remote user who should be allowed to access this
computer:
a.
Click Add.
The Select Users dialog box appears.
b.
Type the desired user's username in the text box.
The Check Names button is enabled.
Click Check Names.
Click OK.
c.
d.
660
Check Point UTM-1 Embedded NGX User Guide
Accessing a Remote Computer's Desktop
The Remote Desktop Users dialog box reappears with the desired user's username.
8.
Click OK.
9.
Click OK.
Accessing a Remote Computer's Desktop
Note: The client computer must meet the following requirements:

Microsoft Internet Explorer 6.0 or later

A working Internet connection
To access a remote computer's desktop
1.
Click Reports in the main menu, and click the My Computers tab.
Chapter 21: Using Remote Desktop
661
Accessing a Remote Computer's Desktop
The My Computers page appears.
2.
Next to the desired computer, click Remote Desktop.
The following things happen:


3.
If you are prompted to install the Remote Desktop Active X Control, then
install it.
The Remote Desktop Connection Security Warning dialog box appears.
Select the desired connection options.
The available options depend on your Remote Desktop configuration. See Configuring
Remote Desktop on page 656.
4.
662
Click OK.
Check Point UTM-1 Embedded NGX User Guide
Accessing a Remote Computer's Desktop
The Log On to Windows dialog box appears.
5.
Type your username and password for the remote computer.
These are the credentials configured for your user account in Enabling the Remote
Desktop Server on page 659.
6.
Click OK.
The remote computer's desktop appears onscreen.
Chapter 21: Using Remote Desktop
663
Accessing a Remote Computer's Desktop
You can use the following keyboard shortcuts during the Remote Desktop session:
Table 151: Remote Desktop Keyboard Shortcuts
This shortcut…
Does this…
ALT+INSERT
Cycles through running programs in the order that they were started
ALT+HOME
Displays the Start menu
CTRL+ALT+BREAK
Toggles between displaying the session in a window and on the full
screen
CTRL+ALT+END
664
Opens the Windows Security dialog box
Check Point UTM-1 Embedded NGX User Guide
Overview
Chapter 22
Controlling the Appliance via the
Command Line
This chapter describes various ways of controlling your UTM-1 appliance through the
command line.
This chapter includes the following topics:
Overview ..................................................................................................665
Using the UTM-1 Portal ...........................................................................666
Using the Serial Console ..........................................................................668
Configuring SSH ...................................................................................... 670
Overview
Depending on your UTM-1 model, you can control your appliance via the command line in
the following ways:

Using the UTM-1 Portal's command line interface.
See Using the UTM-1 Portal on page 666.

Using a console connected to the UTM-1 appliance.
For information, see Using the Serial Console on page 668.

Using an SSH client.
See Configuring SSH on page 670.
Chapter 22: Controlling the Appliance via the Command Line
665
Using the UTM-1 Portal
Using the UTM-1 Portal
You can control your appliance via the UTM-1 Portal's command line interface.
To control the appliance via the UTM-1 Portal
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
666
Click Command.
Check Point UTM-1 Embedded NGX User Guide
Using the UTM-1 Portal
The Command Line page appears.
3.
In the upper field, type a command.
You can view a list of supported commands using the command help.
For information on all commands, refer to the Embedded NGX CLI Reference Guide.
4.
Click Go.
The command is implemented.
Chapter 22: Controlling the Appliance via the Command Line
667
Using the Serial Console
Using the Serial Console
You can connect a console to the UTM-1 appliance, and use the console to control the
appliance via the command line.
Note: Your terminal emulation software and your UTM-1 appliance's Serial port must
be configured for the same speed.
By default, the appliance's Serial port's speed is 57600 bps. For information on
changing the Serial port's speed, refer to the Embedded NGX CLI Reference Guide.
To control the appliance via a console
1.
Connect the serial console to your UTM-1 appliance's Serial port, using an
RS-232 Null modem cable.
For information on locating the Serial port, see Rear Panel.
2.
668
Click Network in the main menu, and click the Ports tab.
Check Point UTM-1 Embedded NGX User Guide
Using the Serial Console
The Ports page appears.
3.
Next to the Serial port, click Edit.
The Port Setup page appears.
4.
In the Assign to drop-down list, select Console.
5.
In the Port Speed drop-down list, select the Serial port's speed (in bits per
second).
Chapter 22: Controlling the Appliance via the Command Line
669
Configuring SSH
The Serial port's speed must match that of the attached serial console. The default value
is 57600.
6.
7.
In the Flow Control drop-down list, select the method of flow control supported
by the attached device:
 RTS/CTS. Hardware-based flow control, using the Serial port's RTS/CTS lines.
 XON/XOFF. Software-based flow control, using XON/XOFF characters.
Click Apply.
You can now control the UTM-1 appliance from the serial console.
For information on all supported commands, refer to the Embedded NGX CLI Reference
Guide.
Configuring SSH
UTM-1 appliance users can control the appliance via the command line, using the SSH
(Secure Shell) management protocol. You can enable users to do so via the Internet, by
configuring remote SSH access. You can also integrate the UTM-1 appliance with
SSH-based management systems.
Note: The UTM-1 appliance supports SSHv2 clients only. The SSHv1 protocol contains
security vulnerabilities and is not supported.
Note: Configuring SSH is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for SSH, such as allowing
SSH connections from multiple IP address ranges, define Allow rules for TCP port 22,
with the destination This Gateway. For information, see Using Rules on page 374.
To configure SSH
1.
Click Setup in the main menu, and click the Management tab.
The Management page appears.
2.
670
Specify from where SSH access should be granted.
Check Point UTM-1 Embedded NGX User Guide
Configuring SSH
Refer to the following table.
Warning: If remote SSH is enabled, your UTM-1 appliance settings can be changed
remotely, so it is especially important to make sure all UTM-1 appliance users’
passwords are difficult to guess.
If you selected Internal Networks + IP Range, additional fields appear.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
Click Apply.
The SSH configuration is saved. If you configured remote SSH access, you can now
control the UTM-1 appliance from the Internet, using an SSHv2 client.
For information on all supported commands, refer to the Embedded NGX CLI Reference
Guide.
Table 152: SSH Access Options
Select this
To allow access from…
option…
Internal Networks
The internal network only.
This disables remote access capability. This is the default.
Chapter 22: Controlling the Appliance via the Command Line
671
Configuring SSH
Select this
To allow access from…
option…
Internal Networks +
The internal network and your VPN.
VPN
Internal Networks + IP
Range
A particular range of IP addresses.
Additional fields appear, in which you can enter the desired IP address
range.
ANY
Any IP address.
Disabled
Nowhere.
This disables both local and remote access capability.
This option is relevant to the SNMP protocol only.
672
Check Point UTM-1 Embedded NGX User Guide
Viewing Firmware Status
Chapter 23
Maintenance
This chapter describes the tasks required for maintenance and diagnosis of your UTM-1
appliance.
This chapter includes the following topics:
Viewing Firmware Status .........................................................................673
Upgrading Your License ..........................................................................675
Configuring a Gateway Hostname............................................................ 677
Configuring Syslog Logging ....................................................................678
Configuring HTTPS ................................................................................. 680
Configuring SNMP ................................................................................... 683
Setting the Time on the Appliance ........................................................... 687
Using Diagnostic Tools ............................................................................691
Backing Up and Restoring the UTM-1 Appliance Configuration ............706
Using Rapid Deployment .........................................................................712
Resetting the UTM-1 Appliance to Defaults ............................................715
Running Diagnostics ................................................................................ 717
Rebooting the UTM-1 Appliance ............................................................. 718
Viewing Firmware Status
The firmware is the software program embedded in the UTM-1 appliance.
You can view your current firmware version and additional details.
To view the firmware status

Click Setup in the main menu, and click the Firmware tab.
Chapter 23: Maintenance
673
Viewing Firmware Status
The Firmware page appears.
The Firmware page displays the following information:
Table 153: Firmware Status Fields
This field…
Displays…
For example…
WAN MAC Address
The MAC address used for
00:80:11:22:33:44
the Internet connection
Firmware Version
The current version of the
8.1
firmware
Installed Product
The licensed software and
UTM-1 Edge N (unlimited nodes)
the number of allowed nodes
Uptime
The time that elapsed from
01:21:15
the moment the unit was
turned on
Hardware Type
The type of the current
SBox-200-C
UTM-1 appliance hardware
674
Check Point UTM-1 Embedded NGX User Guide
Upgrading Your License
This field…
Displays…
For example…
Hardware Version
The current hardware
1.4
version of the UTM-1
appliance
Upgrading Your License
You can upgrade the UTM-1 product installed on your appliance, by purchasing a new
license. You will receive a new Product Key that enables you to use advanced features on the
same UTM-1 appliance you have today. There is no need to replace your hardware. You can
also purchase node upgrades, as needed.
For example, if you have UTM-1 Edge N32 and you need secure Internet access for more
than 32 computers, you can upgrade to UTM-1 Edge NU without changing your hardware.
Note: You can only upgrade within the same appliance hardware type.
Note: To purchase an upgrade, contact your UTM-1 appliance provider. Alternatively,
you can click Upgrades & Services in the Welcome page to view and purchase available
upgrades.
To upgrade your product, you must install the new Product Key.
To install a Product Key
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
Click Upgrade Product.
Chapter 23: Maintenance
675
Upgrading Your License
The UTM-1 Licensing Wizard opens, with the Install Product Key dialog box displayed.
3.
Click Enter a different Product Key.
4.
In the Product Key field, enter the new Product Key.
5.
Click Next.
The Installed New Product Key dialog box appears.
676
Check Point UTM-1 Embedded NGX User Guide
Configuring a Gateway Hostname
6.
Click Finish.
Configuring a Gateway Hostname
You can define a gateway hostname for the UTM-1 appliance. The gateway hostname is
used to identify the UTM-1 appliance and appears in the following places:

The UTM-1 Portal’s title bar

The UTM-1 appliance's SNMP hostname

Syslog messages sent by the UTM-1 appliance

The command line prompt
By default, the UTM-1 appliance's MAC address is used as the gateway hostname.
Note: Configuring the gateway hostname is only available if the UTM-1 appliance is not
subscribed to the Remote Management service. When remotely managed, the
gateway hostname is set by the Service Center.
To configure the gateway hostname
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
In the Gateway Name row, click Edit.
Chapter 23: Maintenance
677
Configuring Syslog Logging
The Gateway Name page appears.
3.
In the Gateway Name field, type the desired hostname.
4.
To reset the gateway hostname to the default value (the appliance's MAC
address), click Default.
5.
Click Apply.
Configuring Syslog Logging
You can configure the UTM-1 appliance to send event logs to a Syslog server residing in
your internal network or on the Internet. The logs detail the date and the time each event
occurred. If the event is a communication attempt that was rejected by the firewall, the event
details include the source and destination IP address, the destination port, and the protocol
used for the communication attempt (for example, TCP or UDP).
This same information is also available in the Event Log page (see Viewing the Event Log
on page 353). However, while the Event Log can display hundreds of logs, a Syslog server
can store an unlimited number of logs. Furthermore, Syslog servers can provide useful tools
for managing your logs.
678
Check Point UTM-1 Embedded NGX User Guide
Configuring Syslog Logging
Note: Kiwi Syslog Daemon is freeware and can be downloaded from
http://www.kiwisyslog.com. For technical support, contact Kiwi Enterprises.
Note: When managed by SmartCenter, the appliance automatically sends logs to the
SmartCenter Log Viewer using a secure protocol.
You can still configure Syslog logging if desired.
To configure Syslog logging
1.
Click Setup in the main menu, and click the Logging tab.
The Logging page appears.
2.
Complete the fields using the information in the following table.
3.
Click Apply.
Chapter 23: Maintenance
679
Configuring HTTPS
Table 154: Logging Page Fields
In this field…
Do this…
Syslog Server
Type the IP address of the computer that will run the Syslog service (one
of your network computers), or click This Computer to allow your computer
to host the service.
Clear
Click to clear the Syslog Server field.
Syslog Port
Type the port number of the Syslog server.
Default
Click to reset the Syslog Port field to the default (port 514 UDP).
Configuring HTTPS
You can enable UTM-1 appliance users to access the UTM-1 Portal from the Internet. To do
so, you must first configure HTTPS.
Note: Configuring HTTPS is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for HTTPS, such as allowing
HTTPS connections from multiple IP address ranges, define Allow rules for TCP port
443, with the destination This Gateway. For information, see Using Rules on page 374.
To configure HTTPS
1.
680
Click Setup in the main menu, and click the Management tab.
Check Point UTM-1 Embedded NGX User Guide
Configuring HTTPS
The Management page appears.
2.
Specify from where HTTPS access to the UTM-1 Portal should be granted.
See Access Options on page 682 for information.
Warning: If remote HTTPS is enabled, your UTM-1 appliance settings can be changed
remotely, so it is especially important to make sure all UTM-1 appliance users’
passwords are difficult to guess.
Note: You can use HTTPS to access the UTM-1 Portal from your internal network, by
surfing to https://my.firewall.
Chapter 23: Maintenance
681
Configuring HTTPS
If you selected Internal Networks + IP Range, additional fields appear.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
Click Apply.
The HTTPS configuration is saved. If you configured remote HTTPS, you can now
access the UTM-1 Portal through the Internet, using the procedure Accessing the
UTM-1 Portal Remotely on page 107.
Table 155: Access Options
Select this
To allow access from…
option…
Internal Networks
The internal network only.
This disables remote access capability. This is the default.
Internal Networks +
The internal network and your VPN.
VPN
682
Check Point UTM-1 Embedded NGX User Guide
Configuring SNMP
Select this
To allow access from…
option…
Internal Networks + IP
Range
A particular range of IP addresses.
Additional fields appear, in which you can enter the desired IP address
range.
ANY
Any IP address.
Disabled
Nowhere.
This disables both local and remote access capability.
This option is relevant to the SNMP protocol only.
Configuring SNMP
UTM-1 appliance users can monitor the UTM-1 appliance, using tools that support SNMP
(Simple Network Management Protocol). You can enable users to do so via the Internet, by
configuring remote SNMP access.
The UTM-1 appliance supports the following SNMP MIBs:

SNMPv2-MIB

RFC1213-MIB

IF-MIB

IP-MIB
All SNMP access is read-only.
Chapter 23: Maintenance
683
Configuring SNMP
Note: Configuring SNMP is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for SNMP, such as allowing
SNMP connections from multiple IP address ranges, define Allow rules for the relevant
port (by default, TCP port 161), with the destination This Gateway. For information, see
Using Rules on page 374.
To configure SNMP
1.
Click Setup in the main menu, and click the Management tab.
The Management page appears.
2.
Specify from where SNMP access should be granted.
See Access Options on page 682 for information.
If you selected Internal Networks + IP Range, additional fields appear.
The Community field and the Advanced link are enabled.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
In the Community field, type the name of the SNMP community string.
SNMP clients use the SNMP community string as a password, when connecting to the
UTM-1 appliance.
The default value is "public". It is recommended to change this string.
684
Check Point UTM-1 Embedded NGX User Guide
Configuring SNMP
5.
6.
To configure advanced SNMP settings, do the following:
a.
Click Advanced.
The SNMP Configuration page appears.
b.
Complete the fields using the following table.
If you selected the Send SNMP Traps check box, additional fields appear.
Click Apply.
The SNMP configuration is saved.
Chapter 23: Maintenance
685
Configuring SNMP
7.
Configure the SNMP clients with the SNMP community string.
Table 156: Advanced SNMP Settings
In this field...
Do this…
System Location
Type a description of the appliance's location.
This information will be visible to SNMP clients, and is useful for
administrative purposes.
System Contact
Type the name of the contact person.
This information will be visible to SNMP clients, and is useful for
administrative purposes.
SNMP Port
Type the port to use for SNMP.
The default port is 161.
Send SNMP Traps
Select this option to enable sending SNMP traps. An SNMP trap is a
notification sent from one application to another.
Send Traps On:
Indicates that SNMP traps will automatically be sent upon
Startup / Shutdown
startup/shutdown events.
This option is always selected.
Send Traps On:
Select this option to send an SNMP trap on each SNMP authentication
SNMP Authentication
failure event.
Failure
Send Traps On: Link
Select this option to send an SNMP trap on each link up/down event.
up/down
Trap Community
Type the SNMP community string of the trap receiver.
The default value is public.
686
Check Point UTM-1 Embedded NGX User Guide
Setting the Time on the Appliance
In this field...
Do this…
Trap Port
Type The UDP port of the trap receiver.
The default value is 162.
Trap Destination
Type the IP address or DNS name of the SNMP trap receiver agent.
Trap Type
Select the type of SNMP traps to use.
Setting the Time on the Appliance
You set the time displayed in the UTM-1 Portal during initial appliance setup. If desired, you
can change the date and time using the procedure below.
To set the time
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Set Time.
Chapter 23: Maintenance
687
Setting the Time on the Appliance
The UTM-1 Set Time Wizard opens displaying the Set the UTM-1 Time dialog box.
3.
Complete the fields using the information in Set Time Wizard Fields on page
690.
4.
Click Next.
The following things happen in the order below:
688
Check Point UTM-1 Embedded NGX User Guide
Setting the Time on the Appliance


If you selected Specify date and time, the Specify Date and Time dialog box
appears.
Set the date, time, and time zone in the fields provided, then click Next.
If you selected Use a Time Server, the Time Servers dialog box appears.
Complete the fields using the information in Time Servers Fields on page 691, then
click Next.
Chapter 23: Maintenance
689
Setting the Time on the Appliance

5.
The Date and Time Updated screen appears.
Click Finish.
Table 157: Set Time Wizard Fields
Select this option…
To do the following…
Your computer's clock
Set the appliance time to your computer’s system time.
Your computer’s system time is displayed to the right of this option.
Keep the current setting
Do not change the appliance’s time.
The current appliance time is displayed to the right of this option.
Use a Time Server
Synchronize the appliance time with a Network Time Protocol
(NTP) server.
Specify date and time
690
Set the appliance to a specific date and time.
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
Table 158: Time Servers Fields
In this field…
Do this…
Primary Server
Type the IP address of the Primary NTP server.
Secondary Server
Type the IP address of the Secondary NTP server.
This field is optional.
Clear
Clear the field.
Select your time zone
Select the time zone in which you are located.
Using Diagnostic Tools
The UTM-1 appliance is equipped with a set of diagnostic tools that are useful for
troubleshooting Internet connectivity.
Table 159: Diagnostic Tools
Use this tool…
To do this…
For information, see...
Ping
Check that a specific IP address or DNS
Using IP Tools on page 692
name can be reached via the Internet.
Traceroute
Display a list of all routers used to connect
Using IP Tools on page 692
from the UTM-1 appliance to a specific IP
address or DNS name.
WHOIS
Display the name and contact information
Using IP Tools on page 692
of the entity to which a specific IP address
or DNS name is registered. This
information is useful in tracking down
hackers.
Chapter 23: Maintenance
691
Using Diagnostic Tools
Use this tool…
To do this…
For information, see...
Packet Sniffer
Capture network traffic. This information is
Using Packet Sniffer on page
useful troubleshooting network problems.
694
Using IP Tools
To use an IP tool
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
In the IP Tools area, complete the fields using the information in the following
table.
3.
Click Go.
692

If you selected Ping, the following things happen:
The UTM-1 appliance sends packets to the specified the IP address or DNS name.
The IP Tools window opens and displays the percentage of packet loss and the
amount of time it took each packet to reach the specified host and return
(round-trip) in milliseconds.

If you selected Traceroute, the following things happen:
The UTM-1 appliance connects to the specified IP address or DNS name.
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
The IP Tools window opens and displays a list of routers used to make the
connection.

If you selected WHOIS, the following things happen:
The UTM-1 appliance queries the Internet WHOIS server.
A window displays the name of the entity to which the IP address or DNS name is
registered and their contact information.
Chapter 23: Maintenance
693
Using Diagnostic Tools
Table 160: IP Tools Fields
In this field…
Do this…
Tool
Select the desired tool.
Source Address
Select the IP address from which the packets should originate. This can
be any of the following:

Auto. Automatically select a connected or enabled interface
form which to send the packets.

A connected Internet connection

An enabled internal network
This field is only enabled if you selected the Ping or Traceroute tools.
Address
Type the IP address or DNS name for which to run the tool.
Using Packet Sniffer
.
The UTM-1 appliance includes the Packet Sniffer tool, which enables you to capture packets
from any internal network or UTM-1 port. This is useful for troubleshooting network
problems and for collecting data about network behavior.
If desired, you can configure Packet Sniffer to capture each packet twice: once before
firewall processing and once after firewall processing. This allows you to observe exactly
what the UTM-1 firewall does to your packets.
The UTM-1 appliance saves the captured packets to a file on your computer. You can use a
free protocol analyzer, such as Ethereal or Wireshark, to analyze the file, or you can send it
to technical support. Wireshark runs on all popular computing platforms and can be
downloaded from http://www.wireshark.org. Ethereal can be downloaded from
http://www.ethereal.com.
Note: If you enabled the Packet Sniffer's Firewall Monitor option, and you would like to
view the results in Ethereal/Wireshark, you must do the following: open the capture
file, click Edit > Preferences, in the left pane click Protocols > Ethernet, and select the
Attempt to interpret as Firewall-1 monitor file check box. The capture file will display the
694
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
interface name on which the packet was captured, and the packet’s processing
direction will be indicated by i (input) or o (output).
To use Packet Sniffer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Sniffer.
The Packet Sniffer window opens.
3.
Complete the fields using the information in the following table.
4.
Click Start.
The Packet Sniffer window displays the name of the interface, the number of packets
collected, and the percentage of storage space remaining on the appliance for storing the
packets.
5.
Click Stop to stop collecting packets.
A standard File Download dialog box appears.
6.
Click Save.
Chapter 23: Maintenance
695
Using Diagnostic Tools
The Save As dialog box appears.
7.
Browse to a destination directory of your choice.
8.
Type a name for the configuration file and click Save.
The *.cap file is created and saved to the specified directory.
9.
Click Cancel to close the Packet Sniffer window.
Table 161: Packet Sniffer Fields
In this field…
Do this…
Interface
Select the interface from which to collect packets.
The list includes the primary Internet connection, the UTM-1 appliance
ports, and all defined networks.
Filter String
Type the filter string to use for filtering the captured packets. Only packets
that match the filter condition will be saved.
For a list of basic filter strings elements, see Filter String Syntax on page
698.
For detailed information on filter syntax, go to
http://www.tcpdump.org/tcpdump_man.html.
Note: Do not enclose the filter string in quotation marks.
If you do not specify a filter string, Packet Sniffer will save all packets on
the selected interface.
Capture only traffic
Select this option to capture incoming and outgoing packets for this
to/from this gateway
gateway only.
If this option is not selected, Packet Sniffer will collect packets for all traffic
on the interface.
696
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
In this field…
Do this…
Firewall Monitor
Select this option to capture each packet both before and after firewall
processing, and to record the name of the interface on which the packet
was captured.
Chapter 23: Maintenance
697
Using Diagnostic Tools
Filter String Syntax
The following represents a list of basic filter string elements:

and on page 698

dst on page 699

dst port on page 699

ether proto on page 700

host on page 700

not on page 701

or on page 701

port on page 702

src on page 703

src port on page 703

tcp on page 704

udp on page 705
For detailed information on filter syntax, refer to http://www.tcpdump.org.
and
PURPOSE
The and element is used to concatenate filter string elements. The filtered packets must
match all concatenated filter string elements.
SYNTAX
element and element [and element...]
element && element [&& element...]
PARAMETERS
element
698
String. A filter string element.
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
EXAMPLE
The following filter string saves packets that both originate from IP address is 192.168.10.1
and are destined for port 80:
src 192.168.10.1 and dst port 80
dst
PURPOSE
The dst element captures all packets with a specific destination.
SYNTAX
dst destination
PARAMETERS
destination
IP Address or String. The computer to which the packet is sent.
This can be the following:

An IP address

A host name
EXAMPLE
The following filter string saves packets that are destined for the IP address 192.168.10.1:
dst 192.168.10.1
dst port
PURPOSE
The dst port element captures all packets destined for a specific port.
SYNTAX
dst port port
Note: This element can be prepended by tcp or udp. For information, see tcp on page
704 and udp on page 705.
Chapter 23: Maintenance
699
Using Diagnostic Tools
PARAMETERS
port
Integer. The port to which the packet is sent.
EXAMPLE
The following filter string saves packets that are destined for port 80:
dst port 80
ether proto
PURPOSE
The ether proto element is used to capture packets of a specific ether protocol type.
SYNTAX
ether proto \protocol
PARAMETERS
protocol
String. The protocol type of the packet.
This can be the following: ip,
ip6, arp, rarp,
atalk, aarp, dec net, sca, lat,
mopdl, moprc, iso, stp, ipx, or netbeui.
EXAMPLE
The following filter string saves ARP packets:
ether proto arp
host
PURPOSE
The host element captures all incoming and outgoing packets for a specific computer.
700
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
SYNTAX
host host
PARAMETERS
host
IP Address or String. The computer to/from which the packet is
sent. This can be the following:

An IP address

A host name
EXAMPLE
The following filter string saves all packets that either originated from IP address
192.168.10.1, or are destined for that same IP address:
host 192.168.10.1
not
PURPOSE
The not element is used to negate filter string elements.
SYNTAX
not element
! element
PARAMETERS
element
String. A filter string element.
EXAMPLE
The following filter string saves packets that are not destined for port 80:
not dst port 80
or
PURPOSE
The or element is used to alternate between string elements. The filtered packets must
match at least one of the filter string elements.
Chapter 23: Maintenance
701
Using Diagnostic Tools
SYNTAX
element or element [or element...]
element || element [|| element...]
PARAMETERS
element
String. A filter string element.
EXAMPLE
The following filter string saves packets that either originate from IP address 192.168.10.1
or IP address 192.168.10.10:
src 192.168.10.1 or src 192.168.10.10
port
PURPOSE
The port element captures all packets originating from or destined for a specific port.
SYNTAX
port port
Note: This element can be prepended by tcp or udp. For information, see tcp on page
704 and udp on page 705.
PARAMETERS
port
702
Integer. The port from/to which the packet is sent.
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
EXAMPLE
The following filter string saves all packets that either originated from port 80, or are
destined for port 80:
port 80
src
PURPOSE
The src element captures all packets with a specific source.
SYNTAX
src source
PARAMETERS
source
IP Address or String. The computer from which the packet is
sent. This can be the following:

An IP address

A host name
EXAMPLE
The following filter string saves packets that originated from IP address 192.168.10.1:
src 192.168.10.1
src port
PURPOSE
The src port element captures all packets originating from a specific port.
SYNTAX
src port port
Note: This element can be prepended by tcp or udp. For information, see tcp on page
704 and udp on page 705.
Chapter 23: Maintenance
703
Using Diagnostic Tools
PARAMETERS
port
Integer. The port from which the packet is sent.
EXAMPLE
The following filter string saves packets that originated from port 80:
src port 80
tcp
PURPOSE
The tcp element captures all TCP packets. This element can be prepended to port-related
elements.
Note: When not prepended to other elements, the
ip proto tcp.
tcp element is the equivalent of
SYNTAX
tcp
tcp element
PARAMETERS
element
String. A port-related filter string element that should be
restricted to saving only TCP packets. This can be the
following:

dst port - Capture all TCP packets destined for
a specific port.

port - Capture all TCP packets originating from
or destined for a specific port.

src port - Capture all TCP packets originating
from a specific port.
704
Check Point UTM-1 Embedded NGX User Guide
Using Diagnostic Tools
EXAMPLE 1
The following filter string captures all TCP packets:
tcp
EXAMPLE 2
The following filter string captures all TCP packets destined for port 80:
tcp dst port 80
udp
PURPOSE
The udp element captures all UDP packets. This element can be prepended to port-related
elements.
Note: When not prepended to other elements, the
ip proto udp.
udp element is the equivalent of
SYNTAX
udp
udp element
PARAMETERS
element
String. A port-related filter string element that should be
restricted to saving only UDP packets. This can be the
following:

dst port - Capture all UDP packets destined for
a specific port.

port - Captures all UDP packets originating from
or destined for a specific port.

src port - Capture all UDP packets originating
from a specific port.
Chapter 23: Maintenance
705
Backing Up and Restoring the UTM-1 Appliance Configuration
EXAMPLE 1
The following filter string captures all UDP packets:
udp
EXAMPLE 2
The following filter string captures all UDP packets destined for port 80:
udp dst port 80
Backing Up and Restoring the UTM-1 Appliance
Configuration
The UTM-1 appliance provides the following ways of backing up and restoring its
configuration:

Backup and restore on your computer
You can export the UTM-1 appliance configuration to a *.cfg file on your computer,
and use this file to backup and restore UTM-1 appliance settings, as needed.
The file includes all of your settings, except for the security policy and certificate.

Backup and restore on a USB flash drive
You can back up the appliance configuration and device certificate to a USB flash drive.
You can then restore the UTM-1 appliance settings from the USB flash drive as needed.
This method requires a USB port on your appliance.
Note: In both cases, the configuration file is saved as a textual CLI script. If desired, you
can edit the file. For a full explanation of the CLI script format and the supported CLI
commands, see the Embedded NGX CLI Reference Guide.
706
Check Point UTM-1 Embedded NGX User Guide
Backing Up and Restoring the UTM-1 Appliance Configuration
Backing Up the Appliance Configuration
Exporting the Appliance Configuration to Your Computer
To export the UTM-1 appliance configuration to your computer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Export.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the configuration file and click Save.
The *.cfg configuration file is created and saved to the specified directory.
You can now import the configuration file as needed. See Importing the Appliance
Configuration from Your Computer on page 709.
Backing Up the Appliance Configuration to a USB Flash Drive
The USB flash drive must have at least 64MB of free space.
Note: Some USB flash drives may not be supported by the appliance.
To backup the appliance configuration to a USB flash drive
1.
Connect a USB flash drive to one of your UTM-1 appliance's USB ports.
For information on locating the USB ports, see Introduction on page 1.
Chapter 23: Maintenance
707
Backing Up and Restoring the UTM-1 Appliance Configuration
2.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
3.
Click Backup/Restore.
The Backup/Restore Wizard opens displaying the Step 1: Select Action dialog box.
4.
Click Backup this gateway to a storage device.
5.
Click Next.
The UTM-1 appliance creates the folder <MACAddress> on the USB flash drive,
where <MACAddress> is the appliance's MAC address, and writes the following files
to this folder:
708

embeddedngx.cfg

embeddedngx.p12
Check Point UTM-1 Embedded NGX User Guide
Backing Up and Restoring the UTM-1 Appliance Configuration
The Step 2: Backup Complete screen appears.
6.
Click Finish.
You can now restore the configuration from the USB flash drive as needed. See
Restoring the Appliance Configuration from a USB Flash Drive on page 711.
Restoring the Appliance Configuration
Importing the Appliance Configuration from Your Computer
To import the appliance configuration from your computer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Import.
Chapter 23: Maintenance
709
Backing Up and Restoring the UTM-1 Appliance Configuration
The Import Settings page appears.
3.
Do one of the following:
 In the Import Settings field, type the full path to the configuration file.
Or
4.
 Click Browse, and browse to the configuration file.
Click Upload.
A confirmation message appears.
5.
Click OK.
The UTM-1 appliance settings are imported.
710
Check Point UTM-1 Embedded NGX User Guide
Backing Up and Restoring the UTM-1 Appliance Configuration
The Import Settings page displays the configuration file's content and the result of
implementing each configuration command.
Note: If the appliance's IP address changed as a result of the configuration import, your
computer may be disconnected from the network; therefore you may not be able to
see the results.
Restoring the Appliance Configuration from a USB Flash Drive
To restore the appliance configuration from a USB flash drive
1.
Connect a USB flash drive to one of your UTM-1 appliance's USB ports.
For information on locating the USB ports, see Introduction on page 1.
2.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
3.
Click Backup/Restore.
The Backup/Restore Wizard opens displaying the Step 1: Select Action dialog box.
4.
Click Restore this gateway from a storage device.
5.
Click Next.
Chapter 23: Maintenance
711
Using Rapid Deployment
The UTM-1 appliance is restored from the <MACAddress> folder on the USB flash
drive, where <MACAddress> is the appliance's MAC address. This may take some
time.
The Step 2: Restore Complete screen appears displaying the configuration file's content
and the result of implementing each configuration command.
Note: If the appliance's IP address changed as a result of the configuration import, your
computer may be disconnected from the network; therefore you may not be able to
see the results.
6.
Click Finish.
Using Rapid Deployment
UTM-1 appliances are shipped with a specific firmware and group of settings that represent
the appliance's default state. When installing a new appliance, you can configure different
settings and install new firmware versions as needed; however, this can be time-consuming.
Rapid deployment avoids this hassle, by allowing you to load the following settings from a
USB flash drive during product initialization:

712
The primary firmware
Check Point UTM-1 Embedded NGX User Guide
Using Rapid Deployment

The backup firmware

The configuration file

The default configuration file
The default configuration file contains settings that represent the desired appliance
default state. The settings in the default configuration file become the appliance's new
default settings and are retained even after a reset to defaults operation.
Important: The default configuration file cannot be cleared by performing a Reset to
Defaults operation. It can only be cleared by loading an empty default configuration
file.

The certificate
Rapid deployment can be used to configure several appliances in succession. If multiple
appliances share a group of settings, you can use rapid deployment to configure each
appliance with both the shared settings and the appliance-specific settings, all in one action.
For example, before shipping appliances to your company’s branch offices, you can quickly
configure all of the appliances with the corporate security policy and VPN settings, as well
as with branch-specific settings.
Preparing the USB Flash Drive for Rapid Deployment
Before performing a rapid deployment, you must load the USB flash drive with the files you
want to install on the appliance(s).
To prepare the USB flash drive
1.
For each appliance you want to deploy, create a folder named
<MACAddress>, where <MACAddress> is the appliance’s MAC address,
and the colons are replaced by underscores.
For example, if the appliance's MAC address is 00:11:22:33:44:55, the folder name
should be 00_11_22_33_44_55.
2.
If you would like to deploy multiple appliances that share settings, create a
folder named deploy.
3.
Prepare the files that you want to install on the appliances.
Chapter 23: Maintenance
713
Using Rapid Deployment
The files must be named according to the following table.
4.
Add files containing settings that should be shared by all of the appliances to the
deploy folder.
5.
For each appliance, add files containing settings that are specific to the
appliance to the folder named after the appliance's MAC address.
For example, if you want two UTM-1 appliances to share the same primary firmware but to
have different configuration files, you must prepare a single primary.firm file and add it
to the deploy folder. Then you must prepare two different embeddedngx.cfg
configuration files, and add one to each appliance's folder.
Table 162: Rapid Deployment File Names
This file...
Should be named...
The primary firmware
primary.firm / primary.img
The backup firmware
secondary.firm / secondary.img
The configuration file
embeddedngx.cfg
The default configuration file
preset.cfg
The certificate
embeddedngx.p12
Performing a Rapid Deployment
You must perform the following procedure on each UTM-1 appliance you want to deploy.
To perform a rapid deployment
1.
Reset the UTM-1 appliance to its default settings.
See Resetting the UTM-1 Appliance to Defaults on page 715.
2.
Disconnect the UTM-1 appliance from its power adapter.
3.
Insert the USB flash drive into the appliance’s USB port.
714
Check Point UTM-1 Embedded NGX User Guide
Resetting the UTM-1 Appliance to Defaults
For information on locating the USB ports, see Introduction on page 1.
4.
Reconnect the Embedded NGX appliance to its power adapter.
The following things happen:

The PWR/SEC LED flashes quickly in green, signaling that rapid deployment is
in progress.

The file results-<MACAddress>.log is created in the USB flash drive's
root folder, where <MACAddress> is the appliance's MAC address.

If the deploy folder exists, the appliance loads shared settings from it. The
appliance then loads its private settings from the folder named after its MAC
address.
Note: If the appliance loads an updated firmware file, the appliance restarts and
then continues the rapid deployment process. Do not disconnect the USB flash
drive until the process is complete.

5.
If an error occurs during the rapid deployment process, the PWR/SEC LED
blinks quickly in red, the errors are logged to the Event Log, and rapid
deployment continues.
 When rapid deployment is complete, the PWR/SEC LED is a constant green.
To check the results of rapid deployment, in the USB flash drive's root folder,
open the file results-<MACAddress>.log.
Settings that loaded successfully are marked as "ok", and settings that failed to load are
marked as "failed".
Resetting the UTM-1 Appliance to Defaults
You can reset the UTM-1 appliance to its default settings. When you reset your UTM-1
appliance, it reverts to the state it was originally in when you purchased it.
Chapter 23: Maintenance
715
Resetting the UTM-1 Appliance to Defaults
Warning: This operation erases all your settings and password information. You will have
to set a new password and reconfigure your UTM-1 appliance for Internet connection.
For information on performing these tasks, see Setting Up the UTM-1 Appliance on
page 99.
This operation also resets your appliance to its default Product Key. Therefore, if you
upgraded your license, you should save your Product Key before resetting to defaults.
You can view the installed Product Key by in the UTM-1 Licensing Wizard. For information
on accessing this wizard, see Upgrading Your License on page 675.
You can reset the UTM-1 appliance to defaults via the Web management interface
(software) or by manually pressing the Reset button (hardware) located at the back of the
UTM-1 appliance.
When resetting the appliance via the UTM-1 Portal, you can choose to keep the current
firmware or to revert to the firmware version that shipped with the UTM-1 appliance. In
contrast, using the Reset button automatically reverts the firmware version.
To reset the UTM-1 appliance to factory defaults via the Web interface
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Factory Settings.
A confirmation message appears.
716
Check Point UTM-1 Embedded NGX User Guide
Running Diagnostics
3.
To revert to the firmware version that shipped with the appliance, select the
check box.
4.
Click OK.

The Please Wait screen appears.


The UTM-1 appliance returns to its factory defaults.
The UTM-1 appliance is restarted.
This may take a few minutes.
The Login page appears.

To reset the UTM-1 appliance to factory defaults using the Reset button
1.
Make sure the UTM-1 appliance is powered on.
2.
Using a pointed object, press the RESET button on the back of the UTM-1
appliance steadily for seven seconds and then release it.
3.
Allow the UTM-1 appliance to boot-up until the system is ready.
For information on the appliance's front and rear panels, see the Getting to Know Your
Appliance section in Introduction on page 1.
Warning: If you choose to reset the UTM-1 appliance by disconnecting the power cable
and then reconnecting it, be sure to leave the UTM-1 appliance disconnected for at
least three seconds. Disconnecting and reconnecting the power without waiting might
cause permanent damage.
Running Diagnostics
You can view technical information about your UTM-1 appliance’s hardware, firmware,
license, network status, and Service Center.
Chapter 23: Maintenance
717
Rebooting the UTM-1 Appliance
This information is useful for troubleshooting. You can export it to an *.html file and send it
to technical support.
To view diagnostic information
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Diagnostics.
Technical information about your UTM-1 appliance appears in a new window.
3.
To save the displayed information to an *.html file:
Click Save.
A standard File Download dialog box appears.
b. Click Save.
The Save As dialog box appears.
c. Browse to a destination directory of your choice.
d. Type a name for the configuration file and click Save.
The *.html file is created and saved to the specified directory.
To refresh the contents of the window, click Refresh.
a.
4.
The contents are refreshed.
5.
To close the window, click Close.
Rebooting the UTM-1 Appliance
If your UTM-1 appliance is not functioning properly, rebooting it may solve the problem.
To reboot the UTM-1 appliance
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
718
Click Restart.
Check Point UTM-1 Embedded NGX User Guide
Rebooting the UTM-1 Appliance
A confirmation message appears.
3.
Click OK.

The Please Wait screen appears.

The UTM-1 appliance is restarted.
This may take a few minutes.
The Login page appears.

Chapter 23: Maintenance
719
Overview
Chapter 24
Using Network Printers
This chapter describes how to set up and use network printers.
This chapter includes the following topics:
Overview ..................................................................................................721
Setting Up Network Printers .....................................................................722
Configuring Computers to Use Network Printers .....................................724
Viewing Network Printers ........................................................................741
Changing Network Printer Ports ............................................................... 741
Resetting Network Printers .......................................................................743
Overview
Some UTM-1 models include a built-in print server, enabling you to connect USB-based
printers to the appliance and share them across the network.
Note: When using computers with a Windows 2000/XP/Vista operating system, the
UTM-1 appliance supports connecting up to four USB-based printers to the appliance.
When using computers with a MAC OS-X operating system, the UTM-1 appliance
supports connecting one printer.
The appliance automatically detects printers as they are plugged in, and they immediately
become available for printing. Usually, no special configuration is required on the UTM-1
appliance.
Note: The UTM-1 print server supports printing via "all-in-one" printers. Copying and
scanning functions are not supported.
Chapter 24: Using Network Printers
721
Setting Up Network Printers
Setting Up Network Printers
To set up a network printer
1.
Connect the network printer to the UTM-1 appliance.
See Connecting the Appliance to Network Printers on page 98.
2.
Turn the printer on.
3.
In the UTM-1 Portal, click Network in the main menu, and click the Ports tab.
The Ports page appears.
4.
722
Next to USB, click Edit.
Check Point UTM-1 Embedded NGX User Guide
Setting Up Network Printers
The USB Devices page appears. If the UTM-1 appliance detected the printer, the printer
is listed on the page.
If the printer is not listed, check that you connected the printer correctly, then click
Refresh to refresh the page.
5.
Next to the printer, click Edit.
The Printer Setup page appears.
6.
Write down the port number allocated to the printer.
The port number appears in the Printer Server TCP Port field. You will need this number
later, when configuring computers to use the network printer.
Chapter 24: Using Network Printers
723
Configuring Computers to Use Network Printers
7.
To change the port number, do the following:
a.
Type the desired port number in the Printer Server TCP Port field.
Note: Printer port numbers may not overlap, and must be high ports.
b. Click Apply.
You may want to change the port number if, for example, the printer you are setting up
is intended to replace another printer. In this case, you should change the replacement
printer's port number to the old printer's port number, and you can skip the next step.
8.
Configure each computer from which you want to enable printing to the
network printer.
See Configuring Computers to Use Network Printers on page 724.
Configuring Computers to Use Network Printers
Perform the relevant procedure on each computer from which you want to enable printing
via the UTM-1 print server to a network printer.
Windows Vista
This procedure is relevant for computers with a Windows Vista operating system.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 377.
2.
724
Click Start > Control Panel.
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
The Control Panel window opens.
3.
Under Hardware and Sound, click Printer.
Chapter 24: Using Network Printers
725
Configuring Computers to Use Network Printers
The Printers screen appears.
4.
Click Add a printer.
The Add Printer wizard opens displaying the Choose a local or network printer screen.
5.
Click Add a local printer.
6.
Click Next.
726
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
The Choose a printer port dialog box appears.
7.
Click Create a new port.
8.
In the Type of port drop-down list, select Standard TCP/IP Port.
9.
Click Next.
The Type a printer hostname or IP address dialog box appears.
10. In the Device type drop-down list, select Autodetect.
11. In the Hostname or IP address field, type the UTM-1 appliance's LAN IP
address, or "my.firewall".
You can find the LAN IP address in the UTM-1 Portal, under Network > My Network.
12. In the Port name field, type the port name.
Chapter 24: Using Network Printers
727
Configuring Computers to Use Network Printers
13. Select the Query the printer and automatically select the driver to use check box.
14. Click Next.
The following things happen:

If Windows cannot identify your printer, the Additional Port Information
Required dialog box appears.
Do the following:
1) Click Custom.
2) Click Settings.
The Configure Standard TCP/IP Port Monitor dialog box opens.
3) In the Protocol area, make sure that Raw is selected.
728
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers

4) In the Port Number field, type the printer's port number, as shown in
the Printers page.
5) Click OK.
6) Click Next.
The Install the printer driver dialog box displayed.
15. Do one of the following:


Use the lists to select the printer's manufacturer and model.
If your printer does not appear in the lists, insert the CD that came with your
printer in the computer's CD-ROM drive, and click Have Disk.
16. Click Next.
17. Complete the remaining dialog boxes in the wizard as desired, and click Finish.
The printer appears in the Printers and Faxes window.
18. Right-click the printer and click Properties in the popup menu.
The printer's Properties dialog box opens.
19. In the Ports tab, in the list box, select the port you added.
Chapter 24: Using Network Printers
729
Configuring Computers to Use Network Printers
The port's name is IP_<LAN IP address>.
20. Click OK.
730
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
Windows 2000/XP
This procedure is relevant for computers with a Windows 2000/XP operating system.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 377.
2.
Click Start > Settings > Control Panel.
The Control Panel window opens.
3.
Click Printers and Faxes.
The Printers and Faxes window opens.
4.
Right-click in the window, and click Add Printer in the popup menu.
The Add Printer Wizard opens with the Welcome dialog box displayed.
5.
Click Next.
Chapter 24: Using Network Printers
731
Configuring Computers to Use Network Printers
The Local or Network Printer dialog box appears.
6.
Click Local printer attached to this computer.
Note: Do not select the Automatically detect and install my Plug and Play printer check box.
7.
Click Next.
The Select a Printer Port dialog box appears.
8.
Click Create a new port.
9.
In the Type of port drop-down list, select Standard TCP/IP Port.
10. Click Next.
732
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
The Add Standard TCP/IP Port Wizard opens with the Welcome dialog box displayed.
11. Click Next.
The Add Port dialog box appears.
12. In the Printer Name or IP Address field, type the UTM-1 appliance's LAN IP
address, or "my.firewall".
You can find the LAN IP address in the UTM-1 Portal, under Network > My Network.
The Port Name field is filled in automatically.
13. Click Next.
Chapter 24: Using Network Printers
733
Configuring Computers to Use Network Printers
The Add Standard TCP/IP Printer Port Wizard opens, with the Additional Port Information
Required dialog box displayed.
14. Click Custom.
15. Click Settings.
The Configure Standard TCP/IP Port Monitor dialog box opens.
16. In the Port Number field, type the printer's port number, as shown in the Printers
page.
17. In the Protocol area, make sure that Raw is selected.
18. Click OK.
The Add Standard TCP/IP Printer Port Wizard reappears.
734
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
19. Click Next.
The Completing the Add Standard TCP/IP Printer Port Wizard dialog box appears.
20. Click Finish.
The Add Printer Wizard reappears, with the Install Printer Software dialog box displayed.
21. Do one of the following:


Use the lists to select the printer's manufacturer and model.
If your printer does not appear in the lists, insert the CD that came with your
printer in the computer's CD-ROM drive, and click Have Disk.
22. Click Next.
23. Complete the remaining dialog boxes in the wizard as desired, and click Finish.
The printer appears in the Printers and Faxes window.
Chapter 24: Using Network Printers
735
Configuring Computers to Use Network Printers
24. Right-click the printer and click Properties in the popup menu.
The printer's Properties dialog box opens.
25. In the Ports tab, in the list box, select the port you added.
The port's name is IP_<LAN IP address>.
26. Click OK.
736
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
MAC OS-X
This procedure is relevant for computers with the latest version of the MAC OS-X operating
system.
Note: This procedure may not apply to earlier MAC OS-X versions.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 377.
2.
Choose Apple -> System Preferences.
The System Preferences window appears.
3.
Click Show All to display all categories.
4.
In the Hardware area, click Print & Fax.
Chapter 24: Using Network Printers
737
Configuring Computers to Use Network Printers
The Print & Fax window appears.
5.
In the Printing tab, click Set Up Printers.
The Printer List window appears.
6.
738
Click Add.
Check Point UTM-1 Embedded NGX User Guide
Configuring Computers to Use Network Printers
New fields appear.
7.
In the first drop-down list, select IP Printing.
8.
In the Printer Type drop-down list, select Socket/HP Jet Direct.
9.
In the Printer Address field, type the UTM-1 appliance's LAN IP address, or
"my.firewall".
You can find the LAN IP address in the UTM-1 Portal, under Network > My Network.
10. In the Queue Name field, type the name of the required printer queue.
For example, the printer queue name for HP printers is RAW.
11. In the Printer Model list, select the desired printer type.
Chapter 24: Using Network Printers
739
Configuring Computers to Use Network Printers
A list of models appears.
12. In the Model Name list, select the desired model.
13. Click Add.
The new printer appears in the Printer List window.
14. In the Printer List window, select the newly added printer, and click Make
Default.
740
Check Point UTM-1 Embedded NGX User Guide
Viewing Network Printers
Viewing Network Printers
To view network printers
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
For each printer, the model, serial number, and status are displayed.
A printer can have the following statuses:






3.
Initialize. The printer is initializing.
Ready. The printer is ready.
Not Ready. The printer is not ready. For example, it may be out of paper.
Printing. The printer is processing a print job.
Restarting. The printer server is restarting.
Fail. An error occurred. See the Event Log for details (Viewing the Event Log
on page 353).
To refresh the display, click Refresh.
Changing Network Printer Ports
When you set up a new network printer, the UTM-1 appliance automatically assigns a port
number to the printer. If you want to use a different port number, you can easily change it, as
described in Setting Up Network Printers on page 722.
However, you may sometimes need to change the port number after completing printer
setup. For example, you may want to replace a malfunctioning network printer, with another
existing network printer, without reconfiguring the client computers. To do this, you must
Chapter 24: Using Network Printers
741
Changing Network Printer Ports
change the replacement printer's port number to the malfunctioning printer's port number, as
described below.
Note: Each printer port number must be different, and must be a high port.
To change a printer's port
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
3.
Next to the desired printer, click Edit.
The Printer Setup page appears.
4.
In the printer's Printer Server TCP Port field, type the desired port number.
5.
Click Apply.
742
Check Point UTM-1 Embedded NGX User Guide
Resetting Network Printers
Resetting Network Printers
You can cause a network printer to restart the current print job, by resetting the network
printer. You may want to do this if the print job has stalled.
To reset a network printer
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
3.
Next to the desired printer, click Reset Server.
The network printer's current print job is restarted.
Chapter 24: Using Network Printers
743
Connectivity
Chapter 25
Troubleshooting
This chapter provides solutions to common problems you may encounter while using the
UTM-1 appliance.
Note: For information on troubleshooting wireless connectivity, see
Troubleshooting Wireless Connectivity on page 321.
This chapter includes the following topics:
Connectivity ............................................................................................ 745
Service Center and Upgrades ................................................................... 749
Other Problems ........................................................................................ 749
Connectivity
I cannot access the Internet. What should I do?
 Verify that the UTM-1 appliance is operating. If not, check the power connection
to the UTM-1 appliance.

Check if the LED for the WAN port is green. If not, check the network cable to the
modem and make sure the modem is turned on.

Check if the LED for the LAN port used by your computer is green. If not, check
if the network cable linking your computer to the UTM-1 appliance is connected
properly. Try replacing the cable or connecting it to a different LAN port.

Using your Web browser, go to http://my.firewall and see whether "Connected"
appears on the Status Bar. Make sure that your UTM-1 appliance network settings
are configured as per your ISP directions.

Check your TCP/IP configuration according to Installing and Setting up the
UTM-1 Appliance on page 69.

If Web Filtering or Email Filtering are on, try turning them off.

Check if you have defined firewall rules which block your Internet connectivity.
Chapter 25: Troubleshooting
745
Connectivity

Check with your ISP for possible service outage.

Check whether you are exceeding the maximum number of computers allowed by
your license, by viewing the My Computers page.
I cannot access my DSL broadband connection. What should I do?
DSL equipment comes in two flavors: bridges (commonly known as DSL modems) and
routers. Some DSL equipment can be configured to work both ways.

If you connect to your ISP using a PPPoE or PPTP dialer defined in your
operating system, your equipment is most likely configured as a DSL bridge.
Configure a PPPoE or PPTP type DSL connection.

If you were not instructed to configure a dialer in your operating system, your
equipment is most likely configured as a DSL router. Configure a LAN
connection, even if you are using a DSL connection.
For instructions, see Configuring the Internet Connection on page 115.
I cannot access my Cable broadband connection. What should I do?
 Some cable ISPs require you to register the MAC address of the device behind the
cable modem. You may need to clone your Ethernet adapter MAC address onto
the UTM-1 appliance. For instructions, see Configuring the Internet Connection
on page 115.

Some cable ISPs require using a hostname for the connection. Try reconfiguring
your Internet connection and specifying a hostname. For further information, see
Configuring the Internet Connection on page 115.
I cannot access my ADSL connection from an ADSL appliance. What should I do?
 Check that a micro-filter is used on all the phone sockets on the line (required in
most locations).

Check that the DSL Standard setting configured for your appliance is compatible
with your service provider. You can view this setting in the Network > Internet
Setup page.

Advanced ADSL configuration fine tuning options are available via the CLI. For
information, refer to the Embedded NGX CLI Reference Guide.
I cannot access http://my.firewall or http://my.vpn. What should I do?
 Verify that the UTM-1 appliance is operating.
746
Check Point UTM-1 Embedded NGX User Guide
Connectivity

Check if the LED for the LAN port used by your computer is green. If not, check
if the network cable linking your computer to the UTM-1 appliance is connected
properly.

By default, unencrypted HTTP access is not allowed from the wireless LAN to
http://my.firewall or http://my.vpn. Therefore, if you are connecting from the
wireless LAN, try connecting to https://my.firewall instead.

Try surfing to 192.168.10.1 instead of to my.firewall.
Note: 192.168.10 is the default value, and it may vary if you changed it in the My Network
page.

Check your TCP/IP configuration according to Installing and Setting up the
UTM-1 Appliance on page 69.

Restart your UTM-1 appliance and your broadband modem by disconnecting the
power and reconnecting after 5 seconds.

If your Web browser is configured to use an HTTP proxy to access the
Internet, add my.firewall or my.vpn to your proxy exceptions list.
My network seems extremely slow. What should I do?
 The Ethernet cables may be faulty. For proper operation, the UTM-1 appliance
requires STP CAT5 (Shielded Twisted Pair Category 5) Ethernet cables. Make
sure that this specification is printed on your cables.

Your Ethernet card may be faulty or incorrectly configured. Try replacing your
Ethernet card.

There may be an IP address conflict in your network. Check that the TCP/IP
settings of all your computers are configured to obtain an IP address
automatically.
I changed the network settings to incorrect values and am unable to correct my error. What
should I do?
Reset the network to its default settings using the button on the back of the UTM-1 appliance
unit. See Resetting the UTM-1 Appliance to Defaults on page 715.
I am using the UTM-1 appliance behind another NAT device, and I am having problems with
some applications. What should I do?
By default, the UTM-1 appliance performs Network Address Translation (NAT). It is
possible to use the UTM-1 appliance behind another device that performs NAT, such as a
Chapter 25: Troubleshooting
747
Connectivity
DSL router or Wireless router, but the device will block all incoming connections from
reaching your UTM-1 appliance.
To fix this problem, do ONE of the following. (The solutions are listed in order of
preference.)

Consider whether you really need the router. The UTM-1 appliance can be used as
a replacement for your router, unless you need it for some additional functionality
that it provides.

If possible, disable NAT in the router. Refer to the router’s documentation for
instructions on how to do this.

If the router has a ―DMZ Computer‖ or ―Exposed Host‖ option, set it to the
UTM-1 appliance’s external IP address.

Open the following ports in the NAT device:







UDP 9281/9282
UDP 500
UDP 2746
TCP 256
TCP 264
ESP IP protocol 50
TCP 981
I cannot receive audio or video calls through the UTM-1 appliance. What should I do?
To enable audio/video, you must configure an IP Telephony (H.323) virtual server. For
instructions, see Configuring Servers on page 371.
I run a public Web server at home but it cannot be accessed from the Internet. What should I
do?
Configure a virtual Web Server. For instructions, see Configuring Servers on page 371.
I cannot connect to the LAN network from the DMZ or primary WLAN network. What should I
do?
By default, connections from the DMZ or primary WLAN network to the LAN network are
blocked. To allow traffic from the DMZ or primary WLAN to the LAN, configure
appropriate firewall rules. For instructions, see Using Rules on page 374.
748
Check Point UTM-1 Embedded NGX User Guide
Service Center and Upgrades
Service Center and Upgrades
I have exceeded my node limit. What does this mean? What should I do?
Your Product Key specifies a maximum number of nodes that you may connect to the
UTM-1 appliance.
The UTM-1 appliance tracks the cumulative number of nodes on the internal network that
have communicated through the firewall. When the UTM-1 appliance encounters an IP
address that exceeds the licensed node limit, the My Computers page displays a warning
message and marks nodes over the node limit in red. These nodes will not be able to access
the Internet through the UTM-1 appliance, but will be protected. The Event Log page also
warns you that you have exceeded the node limit.
To upgrade your UTM-1 appliance to support more nodes, purchase a new Product Key.
Contact your reseller for upgrade information.
While trying to connect to a Service Center, I received the message “The Service Center did not
respond”. What should I do?
 If you are using a Service Center other than the Check Point Service Center, check
that the Service Center IP address is typed correctly.

The UTM-1 appliance connects to the Service Center using UDP ports
9281/9282. If the UTM-1 appliance is installed behind another firewall, make
sure that these ports are open.
I purchased an advanced UTM-1 model, but I only have the functionality of a simpler UTM-1
model. What should I do?
You have not installed your product key. For further information, see Upgrading Your
Software Product on page 675.
Other Problems
I have forgotten my password. What should I do?
Reset your UTM-1 appliance to factory defaults using the Reset button as detailed in
Resetting the UTM-1 Appliance to Defaults on page 715.
Why are the date and time displayed incorrectly?
You can adjust the time on the Setup page's Tools tab. For information, see Setting the Time
on the Appliance on page 687.
Chapter 25: Troubleshooting
749
Other Problems
I cannot use a certain network application. What should I do?
Look at the Event Log page. If it lists blocked attacks, do the following:

Set the UTM-1 appliance's firewall level to Low and try again.

If the application still does not work, set the computer on which you want to use
the application to be the exposed host.
For instructions, see Defining an Exposed Host.
When you have finished using the application, make sure to clear the exposed host setting,
otherwise your security might be compromised.
In the UTM-1 Portal, I do not see the pop-up windows that the guide describes. What should I
do?
Disable any pop-up blockers for http://my.firewall.
750
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
Chapter 26
Specifications
This chapter includes the following topics:
Technical Specifications .......................................................................... 751
CE Declaration of Conformity ................................................................. 762
Technical Specifications
UTM-1 Edge N and Edge NW
ADSL Model Attributes
Table 163: UTM-1 ADSL Model Attributes
Attribute
UTM-1 Edge N ADSL
UTM-1 Edge NW ADSL
SBXN-100-2
SBXNW-100-2
20 x 3.1 x 12.8 cm
20 x 3.1 x 12.8 cm
Weight
805g. (full / packaged 1560g)
850g. (full / packaged 1625g)
Retail Box Dimensions
290 x 250 x 80 mm
290 x 250 x 80 mm
In: 100~240VAC @ 0.65A
In: 100~240VAC @ 0.65A
Physical Attributes
Dimensions
(width x height x depth)
(width x height x depth)
Power Adapter Unit
Power Adapter Nominal
Input
Chapter 26: Specifications
751
Technical Specifications
Power Adapter Nominal
12VDC @ 2 A
12VDC @ 2 A
15W
18W
20W (including USB devices)
23W (including USB devices)
-20ºC ~ 70ºC
-20ºC ~ 70ºC
Temperature: Operation
0ºC ~ 35ºC
0ºC ~ 35ºC
Humidity:
10 ~ 90% / 10 ~ 90%
10 ~ 90% / 10 ~ 90%
(non-condensed)
(non-condensed)
Safety
UL/cUL, CB, CE, LVD
UL/cUL, CB, CE, LVD
Quality
ISO9001, ISO14001
ISO9001, ISO14001
EMC
CE, FCC Part 15B, ICES-003
CE, FCC Part 15B, ICES-003
Reliability
EN 300 019 - 1, 2, 3
EN 300 019 - 1, 2, 3
IEC 60068-2
IEC 60068-2
Environment
RoHS & WEEE, China RoHS
RoHS & WEEE, China RoHS
MTBF (hours)
100,000 hours at 25ºC
100,000 hours at 25ºC
RF
N/A
CE R&TTE, FCC Part 15C
Telecom
TBR21, FCC Part 68, IC CS03
TBR21, FCC Part 68, IC CS03
Output
Max. Power
Consumption
Environmental
Conditions
Temperature:
Storage/Transport
Storage/Operation
Applicable Standards
752
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
Non-ADSL Model Attributes
Table 164: UTM-1 Non-ADSL Model Attributes
Attribute
UTM-1 Edge N SBXN-100-1
UTM-1 Edge NW
SBXNW-100-1
Physical Attributes
Dimensions
(width x height x depth)
20 x 3.1 x 12.8 cm
20 x 3.1 x 12.8 cm
(7.87 x 1.22 x 5.04 inches)
(7.87 x 1.22 x 5.04 inches)
(excluding antenna connectors)
Weight
750g. (full / packaged 1505g)
770g. (full / packaged 1545g)
Retail Box Dimensions
290 x 250 x 80 mm
290 x 250 x 80 mm
(width x height x depth)
(11.42 x 9.84 x 3.15 inches)
(11.42 x 9.84 x 3.15 inches)
In: 100~240VAC @ 0.65A
In: 100~240VAC @ 0.65A
12VDC @ 2 A
12VDC @ 2 A
12W
16W
Power Adapter Unit
Power Adapter Nominal
Input
Power Adapter Nominal
Output
Max. Power
Consumption
21W (including USB devices)
Environmental
Conditions
Temperature:
-20ºC ~ 70ºC
-20ºC ~ 70ºC
0ºC ~ 35ºC
0ºC ~ 35ºC
Storage/Transport
Temperature: Operation
Chapter 26: Specifications
753
Technical Specifications
Humidity:
10 ~ 90% / 10 ~ 90%
10 ~ 90% / 10 ~ 90%
(non-condensed)
(non-condensed)
Safety
cULus, CB, CE, LVD
cULus, CB, CE, LVD
Quality
ISO9001, ISO 14001, TL9000
ISO9001, ISO 14001, TL9000
EMC
CE, FCC 15B
CE, FCC 15B
Reliability
EN 300 019 - 1, 2, 3
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE, China RoHS
RoHS & WEEE, China RoHS
MTBF (hours)
100,000 hours at 25ºC
100,000 hours at 25ºC
RF
N/A
CE R&TTE .FCC15C,TELCO
Storage/Operation
Applicable Standards
Table 165: UTM-1 Edge N Industrial Attributes
Attribute
UTM-1 Edge N Industrial
IEDGE-N
Physical Attributes
Dimensions
200 x 32 x 128 mm (7.87 x 1.26 x 5.04 inches)
(width x height x depth)
Weight
Without DIN rail adapter: 678 g (1.49 lbs)
With DIN rail adapter: 778 g (1.71 lbs)
Retail box dimensions
290 x 250 x 76 mm (11.42 x 3.14 x 9.84 inches)
(width x height x depth)
Retail box weight
754
1.5 kg (3.3 lbs)
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
Industrial DC Power
Input
Power Input
+12V [email protected]
+60V [email protected]
-48V [email protected]
Max. Power
Consumption
9W
11.5W (including USB devices)
12V Power Adapter Unit
Power Adapter Nominal
100 ~ 240 VAC; 50 ~ 60Hz
Input
Power Adapter Nominal
+12V DC @ 2A
Output
Max. Power
Consumption
9W
11.5W (including USB devices)
Environmental
Conditions
Temperature:
-40ºC ~ 70ºC
Storage/Transport
Temperature: Operation
Industrial DC Input: -5ºC ~ 55ºC *
Power Adapter DC Input: -5ºC ~ 40ºC *
Humidity:
50% ~ 95%
Storage/Operation
(non-condensed)
* Extended operating temperature range of -20°C~+55°C was tested (see Extended
Temperatures Test in UTM-1 Edge N Industrial on page 764)
Chapter 26: Specifications
755
Technical Specifications
Wireless Attributes
Table 166: UTM-1 Wireless Attributes
Attribute
UTM-1 Edge NW SBXNW-100-1
UTM-1 Edge NW ADSL SBXNW-100-2
Operation Frequency
Transmission Power
2.412-2.484 MHz
Mode
dBm
mW
802.11b
16
40mW
802.11g
11 (54Mbps), 16
13mW (54Mbps),
(6Mbps)
40mW (6Mbps)
9 (MCS7, MCS15),
8mW (MCS7,
16 (MCS0)
MCS15), 40mW
802.11n (HT20)
(MCS0)
802.11n (HT40)
8 (MCS7, MCS15),
6.3mW (MCS7,
16 (MCS0)
MCS15), 40mW
(MCS0)
50mW Max
Modulation
OFDM, DSSS, 64QAM, 16QAM, QPSK, BPSK, CCK, DQPSK, DBPSK
WPA Authentication
EAP-TLS, EAP-TTLS, PEAP (EAP-GTC), PEAP (EAP-MSCHAP V2)
Modes
756
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
UTM-1 Edge W
Table 167: UTM-1 ADSL Models Attributes
Attribute
UTM-1 Edge W ADSL
SBXWD-166LHGE-5
Physical Attributes
Dimensions
200 x 33 x 130 mm (7.87 x 1.3 x 5.12 inches) (incl. antenna
(width x height x depth)
connectors)
Weight
694 g (1.53 lbs)
Retail Box Dimensions
290 x 250 x 80 mm (11.42 x 9.84 x 3.15 inches)
(width x height x depth)
5V Power Adapter Unit
Power Adapter Nominal
In: 100~240VAC @ 0.5A
Input
Power Adapter Nominal
5V DC @ 3.3A
Output
Max. Power
Consumption
10.5W
15.5W (including USB devices)
Environmental
Conditions
Temperature:
-5ºC ~ 80ºC
Storage/Transport
Temperature: Operation
0ºC ~ 40ºC
Humidity:
10 ~ 95% / 10 ~ 90% (non-condensed)
Chapter 26: Specifications
757
Technical Specifications
Storage/Operation
Applicable Standards
Safety
cULus, CB, LVD
Quality
ISO9001, ISO 14001, TL9000
EMC
CE . FCC 15B.VCCI
Reliability
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
ADSL
FCC Part 68.CS03
RF
FCC15C, TELCO
Table 168: UTM-1 Non-ADSL Models Attributes
Attribute
UTM-1 Edge W SBXW-166LHGE-5
Physical Attributes
Dimensions
200 x 33 x 130 mm (7.87 x 1.3 x 5.12 inches) (incl. antenna
(width x height x depth)
connectors)
Weight
635 g (1.40 lbs)
Retail Box Dimensions
290 x 250 x 80 mm (11.42 x 9.84 x 3.15 inches)
(width x height x depth)
5V Power Adapter Unit
Power Adapter Nominal
In: 100~240VAC @ 0.5A
Input
758
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
Power Adapter Nominal
12VDC @ 1.5 A
Output
Max. Power
Consumption
6.5W
11.5W (including USB devices)
Environmental
Conditions
Temperature:
-5ºC ~ 80ºC
Storage/Transport
Temperature: Operation
0ºC ~ 40ºC
Humidity:
10 ~ 95% / 10 ~ 90% (non-condensed)
Storage/Operation
Applicable Standards
Safety
cULus, CB, LVD
Quality
ISO9001, ISO 14001, TL9000
EMC
CE . FCC 15B.VCCI
Reliability
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
MTBF (hours)
68,000 hours at 30ºC
RF
FCC15C,TELCO
Chapter 26: Specifications
759
Technical Specifications
Table 169:
Table 170: UTM-1 Non-ADSL Models Attributes
Attribute
UTM-1 Edge W SBXW-166LHGE-6
Physical Attributes
Dimensions
200 x 32 x 128 mm
(width x height x depth)
(7.87 x 1.26 x 5.04 inches)
Weight
685 g (1.51 lbs)
Retail box dimensions
290 x 250 x 80 mm
(width x height x depth)
(11.42 x 9.84 x 3.15 inches)
Retail box weight
1.38 kg (3.04 lbs)
5V Power Adapter Unit
Power Adapter Nominal
100 ~ 240 VAC
Input
50 ~ 60 Hz
Power Adapter Nominal
+5V DC @ 3A
Output
Max. Power Consumption
15W
20W (including USB devices)
Environmental Conditions
Temperature:
-20ºC ~ 65ºC
Storage/Transport
Temperature: Operation
760
0ºC ~ 40ºC
Check Point UTM-1 Embedded NGX User Guide
Technical Specifications
Humidity:
10% ~ 85%
Storage/Operation
(non-condensed)
Applicable Standards
Safety
IEC 60950, EN 60950
Quality
ISO 9001, 9002, 14001
EMC
FCC Part 15 B & C
AS/NZS 4268: 2003 A1
DGT
Reliability
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
MTBF (hours)
68,000 hours at 30ºC
RF
CE, FCC15C, TELCO
Wireless Attributes
Table 171: UTM-1 Wireless Attributes
Attribute
All Wireless Models
Operation Frequency
2.412-2.484 MHz
Transmission Power
79.4 mW
Modulation
OFDM, DSSS, 64QAM, 16QAM, QPSK, BPSK, CCK, DQPSK, DBPSK
WPA Authentication
EAP-TLS, EAP-TTLS, PEAP (EAP-GTC), PEAP (EAP-MSCHAP V2)
Modes
Chapter 26: Specifications
761
CE Declaration of Conformity
CE Declaration of Conformity
CE
Check Point is committed to protecting the environment. UTM-1 unified threat management
appliances are compliant with the RoHS Directive, meeting the European Union's strict
restrictions on hazardous substances.
RoHS & WEEE Declaration and Certification
The UTM-1 appliance has been verified to comply with the following directives, throughout
the design, development, and supply chain stages:

Directive of the European Parliament and of the Council, of 27 January 2003, on
the Restriction of the Use of Certain Hazardous Substances in Electrical and
Electronic Equipment (RoHS – 2002/95/EC)

Directive of the European Parliament and of the Council, of 27 January 2003, on
Waste Electrical and Electronic Equipment (WEEE – 2002/96/CE)
For a copy of the original signed declaration (in full conformance with EN45014), visit the
Check Point Support Center (http://supportcenter.checkpoint.com).
Check Point Technologies Ltd., 5 Ha'Solelim Street Tel Aviv Israel, hereby declares that this
equipment is in conformity with the essential requirements specified in Article 3.1 (a) and
3.1 (b) of:

Directive 89/336/EEC (EMC Directive)

Directive 73/23/EEC (Low Voltage Directive – LVD)

Directive 99/05/EEC (Radio Equipment and Telecommunications Terminal
Equipment Directive)
In accordance with the following standards:
Table 172: UTM-1 CE Compliance Standards
Attribute
Edge N
Edge NW
Edge N ADSL
Edge NW ADSL
H/W Model
SBXN-100-1
SBXNW-100-1
SBXNDEF-100-2
SBXNWDE-100-2
762
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity
Attribute
Edge N
Edge NW
Edge N ADSL
Edge NW ADSL
EN 55022
V
V
V
V
EN
V
V
V
V
V
V
V
V
EN 55024
V
V
V
V
CISPR 22
V
V
V
V
EN 60950
V
V
V
V
IEC 60950
V
V
V
V
TBR21
V
V
ITU-T
V
V
V
V
V
V
EMC:
61000-3-2
EN
61000-3-3
Safety:
Telecom:
G.992.1, .2,
.3*, .4*
ETSI TS 101
388
ITU-T G.703
Chapter 26: Specifications
763
CE Declaration of Conformity
Attribute
Edge N
Edge NW
ITU-T G.704
Edge N ADSL
Edge NW ADSL
V
V
RF:
EN 300 328
V
V
EN 301
V
V
V
V
V
V
489-1
EN 301
489-17
EN 50385
The "CE" mark is affixed to this product to demonstrate conformance to the R&TTE
Directive 99/05/EEC (Radio Equipment and Telecommunications Terminal Equipment
Directive) and FCC Part 15 Class B.
The product has been tested in a typical configuration. For a copy of the Original Signed
Declaration (in full conformance with EN45014), please contact Check Point at the above
address.
Table 173: UTM-1 Edge N Industrial CE Compliance Standards
Standard
Description
Comments
Radiated and Conducted
Class B
EMI
CISPR 22
EN 55022
EN 61000-3-2
764
EMI Limits
Harmonic current emission
Class A
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity
EN 61000-3-3
Voltage fluctuations &
flicker
Pst Measurement: 0.001, Limit: 1.0
Plt Measurement: 0.001, Limit: 0.65
Tdt (ms) Measurement: 0, Limit: 500
dmax (%) Measurement: 0, Limit: 4%
dc (%)Measurement: 0, Limit: 3.3%
EN 55024
Immunity
IEC 61000-4-2
Electrostatic Discharge
(ESD)
IEC 61000-4-3
Radiated, radio-frequency,
electromagnetic field
8 kV Air Discharge, 4 kV Contact Discharge
Performance Criterion B
80-1000 MHz, 3 V/m, 80% AM (1 kHz)
Performance Criterion A
immunity
IEC 61000-4-4
Electrical fast transient /
burst immunity
AC Power Line: 1 kV
DC Power Line: 0.5 kV
Signal Line: 0.5 kV
Performance Criterion B
IEC 61000-4-5
Surge immunity
1.2/50 us Open Circuit Voltage, 8/20 us Short
Circuit Current
AC Power Line: line to line 1 kV, line to earth 2
kV
DC Power Line: line to earth 0.5 kV
Signal Line: 1 kV
Performance Criterion B
Chapter 26: Specifications
765
CE Declaration of Conformity
IEC 61000-4-6
Immunity to conducted
disturbances, induced by
0.15-80 MHz, 3 Vrms, 80% AM, 1 kHz
Performance Criterion A
radio-frequency fields
IEC 61000-4-8
Power frequency magnetic
field immunity
IEC 61000-4-11
50 Hz, 1 A/m
Performance Criterion A
Voltage dips, short
i) >95% reduction -0.5 period, Performance
interruptions and voltage
Criterion B
variations immunity
ii) 30% reduction – 25 period, Performance
Criterion C
Voltage Interruptions:
i) >95% reduction – 250 period, Performance
Criterion C
IEC 61850-3
Comply With Electrical
Substation Environments
IEEE 1613
Comply with Networking
Devices in Electric Power
Substations
766
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity
Safety
EN 60950-1
IEC 60950-1
Safety of Information
Technology Equipment
UL 60950-1
CAN/CSA-C22.2 No.
60950-1
AS/NZS 3260
Quality
ISO 9001, 9002,
14001
Reliability
EN 300 019-2-1 T1.2
Environment (Storage)
Low Temperature: -5°C, 72 hours
High Temperature: 55°C, 72 hours
Humidity: 30°C, 93%, 96 hours
Sine Vibration: 5-62-200Hz/5?/s,2g,1
octave/minute, 5 cycles/axis, 96 hours
Random Vibration:
5-10-50-100Hz/+12dB-0.0002g2/Hz - 12dB,
30 minutes/axis, 3 hours
Chapter 26: Specifications
767
CE Declaration of Conformity
EN 300 019-2-2 T2.3
Environment
(Transportation)
Low Temperature: -40°C, 72 hours
High Temperature: 70°C, 72 hours
Temperature Change: -40°C~+30°C, 3 hours
dwell, 5 cycles, 1°C/minute
Humidity: 40°C, 93%, 96 hours
Humidity Cycling: 40°C, 95%, 2 cycles
Water: 0.01m3/minute, 90 Kpa, 15 minutes
Random Vibration: 5-20-200Hz/0.01g2/Hz 3dB, 30 minutes/axis, 1.5 hours
Bump: 6ms, 18g, 100 bumps per face
Drop: 100 cm, 1 corner, 3 edges and 6 face
768
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity
EN 300 019-2-3 T3.2
Environment (Operational)
Low Temperature: -5°C, 16 hours (with cold
start test)
High Temperature: 55°C, 16 hours (with hot
start test)
Temperature change: 25°C~+55°C, 3 hours
dwell, 5 cycles, 0.5°C/minute, 30 hours
Humidity: 30°C, 93%, 96 hours
Humidity Cycling: 55°C, 50~95%, 1 cycles
Sine Vibration: 5-62-200Hz/5?/s-0.2g, 1
octave/minute, 5 cycles/axis, X, Y, and Z axes,
6 hours
Random Vibration:
5-10-50-100Hz/+12dB-0.0002g2/Hz - 12dB,
30 minutes/axis, X, Y, and X axes, 1.5 hours
Shock: Half-sine, 11ms, 3g, 6 shocks per axis
Extended
Extended Temperatures
Temperature change: -20°C~+ 55°C, 12
Temperatures
Test
cycles, 72 hours, with cold start / hot start test
Low temperature: -20°C, 24 hours
High temperature: 55°C, 24 hours
MTBF
370,000 hours
Telcordia (Bellcore) model, SR-332, with
Hirschmann RPS30 Industrial 24V DC power
adapter
Environment
RoHS
EC Directive on Restriction
MTBF (hours) 300,129 at 30°
of Hazardous Substances
Chapter 26: Specifications
769
CE Declaration of Conformity
WEEE
EC Directive on Waste
MTBF (hours) 300,129 at 30°
Electrical and Electronic
Equipment (WEEE)
North America
Federal Communications Commission Radio Frequency Interference Statement
This equipment complies with the limits for a Class B digital device, pursuant to Part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy and, if not installed and used in
accordance with the instruction manual, may cause harmful interference to radio
communications.
Shielded cables must be used with this equipment to maintain compliance with FCC
regulations.
Any changes or modifications to this product not explicitly approved by the manufacturer
could void the user’s authority to operate the equipment and any assurances of Safety or
Performance, and could result in violation of Part 15 of the FCC Rules.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following
two conditions: (1) this device may not cause harmful interference, and (2) this device must
accept any interference received, including interference that may cause undesired operation.
This Class B digital apparatus complies with Canadian ICES-003.
FCC Radiation Exposure Statement for Wireless Models
This equipment complies with FCC radiation exposure limits set forth for an uncontrolled
environment. The antenna(s) used for this equipment must be installed to provide a
separation distance of at least eight inches (20 cm) from all persons. This equipment must
not be operated in conjunction with any other antenna.
Table 174: UTM-1 North America Compliance Standards
Attribute
Edge N
Edge NW
Edge N ADSL
Edge NW ADSL
H/W Model
SBXN-100-1
SBXNW-100-1
SBXNDEF-100-2
SBXNWDE-100-2
770
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity
Attribute
Edge N
Edge NW
Edge N ADSL
Edge NW ADSL
V
V
V
V
CISPR 22
V
V
V
V
ICES-003
V
V
V
V
ANSI C63.4
V
V
V
V
UL 60950
V
V
V
V
C22.2 No.
V
V
V
V
FCC Part 68
V
V
CS-03 Part I
V
V
EMC:
FCC Part
15, Class B
Safety:
60950
Telecom:
& VIII Issue
8
RF:
FCC Part
V
V
V
V
15, Subpart
C
IEEE C95.1
Chapter 26: Specifications
771
CE Declaration of Conformity
China
China RoHS, RoHS & WEEE Declaration and Certification
These systems have been verified to comply with the China RoHS and EU RoHS & WEEE
Directives throughout the design, development and supply chain definition.
China RoHS, RoHS & WEEE
(Environmental Data – Product's Materials Information Restricted Substances)
Check Point's products do NOT contain any of the following substances (in concentrations
exceeding legal threshold limits):

Asbestos

Colorants in components that come into direct contact with human skin

Cadmium and its compounds (except for use in applications exempted by the EU
RoHS Directive)

Class I and Class II CFCs (chlorofluorocarbons) and HCFCs (hydro
fluorocarbons)

Chloroparaffins, short chained (10-13 carbon chain)

Chromium VI and its compounds (except for use in applications exempted by the
EU RoHS Directive)

Halogenated dioxins or furans (i.e. polychlorinated dibenzodioxines,
polychlorinated dibenzofurans)

Lead and its compounds (except for use in applications exempted by the EU
RoHS Directive)

Mercury (except for use in applications exempted by the EU RoHS Directive)

Nickel and its compounds in components that are likely to result in prolonged skin
exposure

PCBs (polychlorobiphenyls) or PCTs (polychloroterphenyls)

PBBs (polybromobiphenyls) or PBDEs (polybrominated diphenylethers)

PVC (polyvinyl chloride) in plastic parts greater than 25 grams

Polychlorinated naphthalenes (PCNs)
772
Check Point UTM-1 Embedded NGX User Guide
CE Declaration of Conformity

Tributyl tin (TBT) and triphenyl tin (TPT) compounds
Additional Materials Information

The cables may use PVC as an insulating material to ensure product safety

The case material is sheet metal

Product may contain post-industrial recycled content (plastics, metal, glass)
No CFCs (chlorofluorocarbons), HCFCs (hydrofluorocarbons) or other ozone depleting
substances are used in packaging material. Chromium, lead, mercury, or cadmium are not
intentionally added to packaging materials and are not present in a cumulative concentration
greater than 100 ppm as incidental impurities. No halogenated plastics or polymers are used
for packaging material. The System fully complies with the EU Directive 94/62/EEC.
Table 175: Hazardous Substances in Components
Component Lead
Mercury
Cadmium Chromium VI Polybrominated Polybrominated
Name
(Hg)
(Cd)
(Pb)
Compounds
Biphenyls (PBB)
(Cr 6+ )
Diphenyl Ethers
(PBDE)
PCB
O
O
O
O
O
O
Components
See the
O
O
O
O
O
onboard
following
table
Main Chassis
O
O
O
O
O
O
AC Mains
O
O
O
O
O
O
Accessories
O
O
O
O
O
O
Cables
O
O
O
O
O
O
Chapter 26: Specifications
773
CE Declaration of Conformity
Table 176: Onboard Components - Lead (Pb)
Component Part
Hazardous
Name
Substances (ppm)
DC Jack
Lead (Pb)
Concentration RoHS Exemptions
36050
Lead as an alloying element
Quantity
1
in steel containing up to 0,35
% lead by weight, aluminium
containing up to 0,4 % lead
by weight and as a copper
alloy containing up to 4 %
lead by weight. (2002/95/EC)
Components
Crystal
Lead (Pb)
11800
on board
Lead in high melting
1
temperature type solders (i.e.
lead-based alloys containing
85 % by weight or more lead).
(2005/747/EC)
CAPACITOR
Lead (Pb)
6551
Lead in electronic ceramic
2
parts (e.g. piezoelectronic
devices) (2002/95/EC)
CAPACITOR
Lead (Pb)
6981
Lead in electronic ceramic
1
parts (e.g. piezoelectronic
devices) (2002/95/EC)
774
Check Point UTM-1 Embedded NGX User Guide
Glossary of Terms
Glossary of Terms
A
ADSL Modem
A device connecting a computer to the
Internet via an existing phone line.
ADSL (Asymmetric Digital Subscriber
Line) modems offer a high-speed
'always-on' connection.
C
CA
The Certificate Authority (CA) issues
certificates to entities such as gateways,
users, or computers. The entity later uses
the certificate to identify itself and
provide verifiable information. For
instance, the certificate includes the
Distinguished Name (DN) (identifying
information) of the entity, as well as the
public key (information about itself), and
possibly the IP address.
After two entities exchange and validate
each other's certificates, they can begin
encrypting information between
themselves using the public keys in the
certificates.
Cable Modem
A device connecting a computer to the
Internet via the cable television network.
Cable modems offer a high-speed
'always-on' connection.
Glossary of Terms
Certificate Authority
The Certificate Authority (CA) issues
certificates to entities such as gateways,
users, or computers. The entity later uses
the certificate to identify itself and
provide verifiable information. For
instance, the certificate includes the
Distinguished Name (DN) (identifying
information) of the entity, as well as the
public key (information about itself), and
possibly the IP address.
After two entities exchange and validate
each other's certificates, they can begin
encrypting information between
themselves using the public keys in the
certificates.
Cracking
An activity in which someone breaks
into someone else's computer system,
bypasses passwords or licenses in
computer programs; or in other ways
intentionally breaches computer
security. The end result is that whatever
resides on the computer can be viewed
and sensitive data can be stolen without
anyone knowing about it. Sometimes,
tiny programs are 'planted' on the
computer that are designed to watch out
for, seize and then transmit to another
computer, specific types of data.
775
Glossary of Terms
D
DHCP
Any machine requires a unique IP
address to connect to the Internet using
Internet Protocol. Dynamic Host
Configuration Protocol (DHCP) is a
communications protocol that assigns
Internet Protocol (IP) addresses to
computers on the network.
DHCP uses the concept of a "lease" or
amount of time that a given IP address
will be valid for a computer.
DMZ
A DMZ (demilitarized zone) is an
internal network defined in addition to
the LAN network and protected by the
UTM-1 appliance.
DNS
The Domain Name System (DNS) refers
to the Internet domain names, or
easy-to-remember "handles", that are
translated into IP addresses.
An example of a Domain Name is
'www.checkpoint.com'.
Domain Name System
Domain Name System. The Domain
Name System (DNS) refers to the
Internet domain names, or
easy-to-remember "handles", that are
translated into IP addresses.
An example of a Domain Name is
'www.checkpoint.com'.
776
E
Exposed Host
An exposed host allows one computer to
be exposed to the Internet. An example
of using an exposed host would be
exposing a public server, while
preventing outside users from getting
direct access form this server back to the
private network.
F
Firmware
Software embedded in a device.
G
Gateway
A network point that acts as an entrance
to another network.
H
Hacking
An activity in which someone breaks
into someone else's computer system,
bypasses passwords or licenses in
computer programs; or in other ways
intentionally breaches computer
security. The end result is that whatever
resides on the computer can be viewed
and sensitive data can be stolen without
anyone knowing about it. Sometimes,
tiny programs are 'planted' on the
computer that are designed to watch out
for, seize and then transmit to another
computer, specific types of data.
Check Point UTM-1 Embedded NGX User Guide
Glossary of Terms
HTTPS
Hypertext Transfer Protocol over Secure
Socket Layer, or HTTP over SSL.
A protocol for accessing a secure Web
server. It uses SSL as a sublayer under
the regular HTTP application. This
directs messages to a secure port number
rather than the default Web port number,
and uses a public key to encrypt data
HTTPS is used to transfer confidential
user information.
Hub
A device with multiple ports, connecting
several PCs or network devices on a
network.
I
IP Address
An IP address is a 32-bit number that
identifies each computer sending or
receiving data packets across the
Internet. When you request an HTML
page or send e-mail, the Internet
Protocol part of TCP/IP includes your IP
address in the message and sends it to the
IP address that is obtained by looking up
the domain name in the Uniform
Resource Locator you requested or in the
e-mail address you're sending a note to.
At the other end, the recipient can see the
IP address of the Web page requestor or
the e-mail sender and can respond by
sending another message using the IP
address it received.
Glossary of Terms
IP Spoofing
A technique where an attacker attempts
to gain unauthorized access through a
false source address to make it appear as
though communications have originated
in a part of the network with higher
access privileges. For example, a packet
originating on the Internet may be
masquerading as a local packet with the
source IP address of an internal host. The
firewall can protect against IP spoofing
attacks by limiting network access based
on the gateway interface from which
data is being received.
IPSEC
IPSEC is the leading Virtual Private
Networking (VPN) standard. IPSEC
enables individuals or offices to
establish secure communication
channels ('tunnels') over the Internet.
ISP
An ISP (Internet service provider) is a
company that provides access to the
Internet and other related services.
L
LAN
A local area network (LAN) is a group of
computers and associated devices that
share a common communications line
and typically share the resources of a
single server within a small geographic
area.
777
Glossary of Terms
M
MAC Address
The MAC (Media Access Control)
address is a computer's unique hardware
number. When connected to the Internet
from your computer, a mapping relates
your IP address to your computer's
physical (MAC) address on the LAN.
Mbps
Megabits per second. Measurement unit
for the rate of data transmission.
MTU
The Maximum Transmission Unit
(MTU) is a parameter that determines
the largest datagram than can be
transmitted by an IP interface (without it
needing to be broken down into smaller
units). The MTU should be larger than
the largest datagram you wish to transmit
un-fragmented. Note: This only prevents
fragmentation locally. Some other link in
the path may have a smaller MTU - the
datagram will be fragmented at that
point. Typical values are 1500 bytes for
an Ethernet interface or 1452 for a PPP
interface.
N
NAT
Network Address Translation (NAT) is
the translation or mapping of an IP
address to a different IP address. NAT
can be used to map several internal IP
addresses to a single IP address, thereby
sharing a single IP address assigned by
the ISP among several PCs.
778
Check Point FireWall-1's Stateful
Inspection Network Address Translation
(NAT) implementation supports
hundreds of pre-defined applications,
services, and protocols, more than any
other firewall vendor.
NetBIOS
NetBIOS is the networking protocol
used by DOS and Windows machines.
P
Packet
A packet is the basic unit of data that
flows from one source on the Internet to
another destination on the Internet.
When any file (e-mail message, HTML
file, GIF file etc.) is sent from one place
to another on the Internet, the file is
divided into "chunks" of an efficient size
for routing. Each of these packets is
separately numbered and includes the
Internet address of the destination. The
individual packets for a given file may
travel different routes through the
Internet. When they have all arrived,
they are reassembled into the original
file at the receiving end.
PPPoE
PPPoE (Point-to-Point Protocol over
Ethernet) enables connecting multiple
computer users on an Ethernet local area
network to a remote site or ISP, through
common customer premises equipment
(e.g. modem).
Check Point UTM-1 Embedded NGX User Guide
Glossary of Terms
PPTP
The Point-to-Point Tunneling Protocol
(PPTP) allows extending a local network
by establishing private ―tunnels‖ over
the Internet. This protocol it is also used
by some DSL providers as an alternative
for PPPoE.
R
RJ-45
The RJ-45 is a connector for digital
transmission over ordinary phone wire.
Router
A router is a device that determines the
next network point to which a packet
should be forwarded toward its
destination. The router is connected to at
least two networks.
S
Server
A server is a program (or host) that
awaits and requests from client programs
across the network. For example, a Web
server is the computer program, running
on a specific host, that serves requested
HTML pages or files. Your browser is
the client program, in this case.
Stateful Inspection
Stateful Inspection was invented by
Check Point to provide the highest level
of security by examining every layer
within a packet, unlike other systems of
inspection. Stateful Inspection extracts
information required for security
decisions from all application layers and
Glossary of Terms
retains this information in dynamic state
tables for evaluating subsequent
connection attempts. In other words, it
learns!
Subnet Mask
A 32-bit identifier indicating how the
network is split into subnets. The subnet
mask indicates which part of the IP
address is the host ID and which
indicates the subnet.
T
TCP
TCP (Transmission Control Protocol) is
a set of rules (protocol) used along with
the Internet Protocol (IP) to send data in
the form of message units between
computers over the Internet. While IP
takes care of handling the actual delivery
of the data, TCP takes care of keeping
track of the individual units of data
(called packets) that a message is divided
into for efficient routing through the
Internet.
For example, when an HTML file is sent
to you from a Web server, the
Transmission Control Protocol (TCP)
program layer in that server divides the
file into one or more packets, numbers
the packets, and then forwards them
individually to the IP program layer.
Although each packet has the same
destination IP address, it may get routed
differently through the network.
At the other end (the client program in
your computer), TCP reassembles the
779
Glossary of Terms
individual packets and waits until they
have arrived to forward them to you as a
single file.
TCP/IP
TCP/IP (Transmission Control
Protocol/Internet Protocol) is the
underlying communication protocol of
the Internet.
U
UDP
UDP (User Datagram Protocol) is a
communications protocol that offers a
limited amount of service when
messages are exchanged between
computers in a network that uses the
Internet Protocol (IP). UDP is an
alternative to the Transmission Control
Protocol (TCP) and, together with IP, is
sometimes referred to as UDP/IP. Like
the Transmission Control Protocol, UDP
uses the Internet Protocol to actually get
a data unit (called a datagram) from one
computer to another. Unlike TCP,
however, UDP does not provide the
service of dividing a message into
packets (datagrams) and reassembling it
at the other end.
Hypertext Transfer Protocol), an
example of a URL is
'http://www.checkpoint.com'.
V
VPN
A virtual private network (VPN) is a
private data network that makes use of
the public telecommunication
infrastructure, maintaining privacy
through the use of a tunneling protocol
and security procedures.
VPN tunnel
A secure connection between a Remote
Access VPN Client and a Remote
Access VPN Server.
UDP is often used for applications such
as streaming data.
URL
A URL (Uniform Resource Locator) is
the address of a file (resource) accessible
on the Internet. The type of resource
depends on the Internet application
protocol. On the Web (which uses the
780
Check Point UTM-1 Embedded NGX User Guide
Index
Index
A
Adding and Editing VStream Antivirus
Rules • 484
About This Guide • ix
Adding and Editing Web Rules • 534
About Your Check Point UTM-1 Embedded
NGX Appliance • 1
Adding Blocked Senders • 508
Accessing a Remote Computer's Desktop •
661
Accessing the UTM-1 Portal Remotely
Using HTTPS • 107
Adding Internal Networks to Bridges • 253
Adding Internet Connections to Bridges •
256
Adding Quick Guest HotSpot Users • 642
Adding and Editing Allowed Commands •
471
Adding Safe Senders • 522
Adding and Editing Bridges • 249
ADSL Modem • 775
Adding and Editing Classes • 278
and • 698
Adding and Editing Firewall Rules • 377
Antispam Filtering Solutions • 478
Adding and Editing NAT Rules • 399
Antivirus Filtering Solutions • 477
Adding and Editing Network Objects • 212
Application-Layer Gateways • 63
Adding and Editing Network Service
Objects • 220
ADSL Model Attributes • 751
B
Adding and Editing Port-Based VLANs •
204
Backing Up and Restoring the UTM-1
Appliance Configuration • 706
Adding and Editing Static Routes • 224
Backing Up the Appliance Configuration •
707
Adding and Editing Tag-Based VLANs •
206
Adding and Editing Users • 637
Backing Up the Appliance Configuration to
a USB Flash Drive • 707
Adding and Editing VLANs • 204
Before You Install the UTM-1 Appliance •
69
Adding and Editing VPN Sites • 582
Block Known Ports • 455
Adding and Editing VStream Antispam
Rules • 517
Block Port Overflow • 455
Index
781
Index
Blocked FTP Commands • 457
C
CA • 775
Cable Modem • 775
Cascading Your Appliance • 98
CE • 762
CE Declaration of Conformity • 762
Certificate Authentication Method • 591, 606
Certificate Authority • 775
Configuring a DMZ Network • 195
Configuring a Gateway Hostname • 677
Configuring a Remote Access VPN Site •
584
Configuring a Site-to-Site VPN Gateway •
598
Configuring an Ethernet-Based Connection •
142
Configuring an Ethernet-Based Connection
on ADSL Models • 124
Changing IP Addresses • 184
Configuring an Ethernet-Based Connection
on Non-ADSL Models • 117
Changing Network Printer Ports • 741
Configuring Automatic Snooze • 544
Changing Your Login Credentials • 635
Check Point Stateful Inspection Technology
• 63
Checking for Software Updates when
Locally Managed • 549
Checking for Software Updates when
Remotely Managed • 548
Checking the TCP/IP Installation • 70, 74
Checksum Verification • 445
China • 772
Configuring Clients for Server
Authentication on Wired Connections •
411
Configuring Clients for Server
Authentication on Wireless Connections •
408
Configuring Computers to Use Network
Printers • 724
Configuring DHCP Relay • 189
Configuring DHCP Server Options • 190
Cisco IOS DOS • 442
Configuring Email Filtering Advanced
Settings • 527
Computer and Network Security • 60
Configuring High Availability • 263
Configuring a Backup Internet Connection •
176
Configuring High Availability on a Gateway
• 266
Configuring a DHCP Server • 186
Configuring HTTPS • 680
Configuring a Dialup Connection • 155
Configuring L2TP VPN Clients • 576
Configuring a Direct ADSL Connection •
126, 132
Configuring Network Service Objects • 220
782
Check Point UTM-1 Embedded NGX User Guide
Index
Configuring Network Settings • 181
Configuring the Terminal Server • 240
Configuring No Connection • 157
Configuring the VStream Antispam Policy •
515
Configuring Port-Based Security • 387
Configuring RADIUS Attributes • 650
Configuring Remote Desktop • 656
Configuring Servers • 371
Configuring SmartDefense • 422
Configuring SNMP • 683
Configuring SSH • 670
Configuring Syslog Logging • 678
Configuring the Block List Engine • 508
Configuring the Block List Engine Settings •
510
Configuring the Content Based Antispam
Engine • 504
Configuring the DHCP Address Range • 187
Configuring the Endpoint Connect VPN
Server • 573
Configuring the VStream Antivirus Policy •
482
Configuring Traffic Monitor Settings • 332
Configuring Virtual Access Points • 313
Configuring VLANs • 200
Configuring VStream Antispam Advanced
Settings • 524
Configuring VStream Antivirus Advanced
Settings • 491
Configuring WAN Load Balancing • 178
Configuring Web Filtering Advanced
Settings • 541
Configuring Wireless Distribution System
Links • 317
Configuring Wireless Networks • 294
Configuring Your Account • 560
Configuring the Host Computer • 659
Connecting a DC Power Source • 86
Configuring the Internet Connection • 115
Connecting the Appliance to Network
Printers • 98
Configuring the IP Reputation Engine • 512
Configuring the L2TP VPN Server • 574
Configuring the LAN Network • 182
Configuring the OfficeMode Network • 197
Configuring the Safe Sender List • 522
Configuring the SecuRemote Internal VPN
Server • 573
Configuring the SecuRemote Remote
Access VPN Server • 572
Index
Connecting to a Service Center • 554
Connecting Wireless Clients to the UTM-1
Appliance • 418
Connectivity • 745
Contacting Technical Support • 55
Controlling the Appliance via the Command
Line • 665
Cracking • 775
783
Index
Customizing Secure HotSpot • 394
Customizing the Access Denied Page • 545
D
DDoS Attack • 434
Default Antispam Policy • 500
Enabling/Disabling the Internet Connection •
175
Enabling/Disabling the UTM-1 DHCP
Server • 187
Enabling/Disabling VStream Antispam • 500
Default Antivirus Policy • 480
Enabling/Disabling VStream Antispam
Rules • 520
Default Security Policy • 367
Enabling/Disabling VStream Antivirus • 481
Deleting Allowed Commands • 475
Enabling/Disabling VStream Antivirus
Rules • 489
Deleting Bridges • 260
Deleting VLANs • 208
Denial of Service • 430
DHCP • 776
Disconnecting from Your Service Center •
561
Enabling/Disabling Web Filtering • 540
Enabling/Disabling Web Rule Logging • 538
ether proto • 700
Example • 209
Exporting Certificates • 626
DMZ • 776
Exporting General Traffic Reports • 332
DNS • 776
Exporting the Appliance Configuration to
Your Computer • 707
Domain Name System • 776
dst • 699
dst port • 699
E
Enabling the Internal DNS Server • 209
Exporting the CA Certificate • 627
Exporting the UTM-1 Appliance Certificate
• 626
Exposed Host • 776
F
Enabling/Disabling a VPN Site • 615
Filter String Syntax • 698
Enabling/Disabling Email Filtering • 526
Firmware • 776
Enabling/Disabling Firewall Rule Logging •
385
Flags • 450
Enabling/Disabling Firewall Rules • 384
Enabling/Disabling Hide NAT • 185
Enabling/Disabling Secure HotSpot • 393
784
Front Panel • 22, 27, 32, 37, 43, 49, 54
FTP • 453
FTP Bounce • 454
Check Point UTM-1 Embedded NGX User Guide
Index
G
Games • 468
Gateway • 776
HTTPS • 777
Hub • 777
I
Generating a Self-Signed Certificate • 619
IGMP • 461
Getting Started • 103
Importing a Certificate • 623
Getting to Know Your UTM-1 Edge N
ADSL Appliance • 24
Importing the Appliance Configuration from
Your Computer • 709
Getting to Know Your UTM-1 Edge N
Appliance • 20
Information is Valuable! • 57
Getting to Know Your UTM-1 Edge N
Industrial Appliance • 30
Initial Login to the UTM-1 Portal • 103
Getting to Know Your UTM-1 Edge NW
ADSL Appliance • 39
Information Security Challenges • 58
Installing a Certificate • 619
Installing and Setting Up UTM-1 • 69
Getting to Know Your UTM-1 Edge NW
Appliance • 34
Installing Endpoint Connect • 575
Getting to Know Your UTM-1 Edge W
ADSL Appliance • 50
Installing SecuRemote • 575
Getting to Know Your UTM-1 Edge W
Appliance • 46
H
H.323 • 464
Hacking • 776
Header Marking • 499
Header Rejection • 458
host • 700
How Does Bridge Mode Work? • 246
How Does Hide NAT Work? • 398
How VStream Antispam Works • 497
HTTP • 458
Index
Installing Non-ADSL Models • 83
Installing TCP/IP Protocol • 77
Installing the UTM-1 Appliance's CA
Certificate on Clients • 413
Installing UTM-1 Edge N Industrial • 84
Installing UTM-1 Edge W ADSL • 88
Instant Messaging Traffic • 466
Internal VPN Server • 568
Introduction • 1
Introduction to Information Security • 57
IP Address • 777
IP and ICMP • 435
IP Fragments • 438
IP Spoofing • 777
785
Index
IPSEC • 777
Microsoft Networks • 460
ISP • 777
Modbus/TCP • 469
L
Modbus/TCP Policy • 471
LAN • 777
Modifying Link Configurations • 236
LAND • 432
Modifying Port Assignments • 234
Logging in through the my.vpn page • 617
Mounting the UTM-1 Edge N Industrial
Appliance on a DIN Rail • 90
Logging in through the UTM-1 Portal • 616
Logging in to a Remote Access VPN Site •
615
Logging in to the UTM-1 Portal • 106
Logging Out • 113
Logging Out of a Remote Access VPN Site •
618
M
MTU • 778
Multiple Bridges and Spanning Tree
Protocol • 247
N
NAT • 778
NetBIOS • 778
Network Count Limitations • 291
MAC Address • 778
Network Quota • 439
Mac OS • 79
Network Requirements • 21, 25, 31, 35, 40,
46, 51
Mac OS-X • 80
MAC OS-X • 737
Main Frame • 111
Main Menu • 110
Maintenance • 673
Managing Ports • 228
Managing Users • 635
Managing Your Network • 181
Manually Configuring a Wireless Network •
301
No Security • 301
Non-ADSL Model Attributes • 753
Non-TCP Flooding • 433
North America • 770
not • 701
Null Payload • 443
O
Old Firewall Technologies • 62
Optional Security Services • 19
Max Ping Size • 437
or • 701
Mbps • 778
Other Problems • 750
786
Check Point UTM-1 Embedded NGX User Guide
Index
Overview • 115, 243, 263, 275, 285, 396,
421, 477, 531, 547, 563, 655, 665, 721
P
Reordering VStream Antispam Rules • 521
Reordering VStream Antivirus Rules • 490
Reordering Web Rules • 538
Package Contents • 20, 24, 30, 34, 39, 46, 50
Resetting 802.1x Locking • 390
Packet • 778
Resetting All Ports to Defaults • 238
Packet Filters • 62
Resetting Individual Ports to Defaults • 238
Packet Sanity • 435
Resetting Network Printers • 743
Packet State and Context Information • 64
Resetting Ports to Defaults • 237
Peer-to-Peer • 465
Resetting SmartDefense to its Defaults • 475
Performing a Rapid Deployment • 714
Ping of Death • 431
Resetting the UTM-1 Appliance to Defaults •
715
Planning the UTM-1 Firewall Security
Policy • 367
Resetting Web Filtering Categories to
Defaults • 545
port • 702
Restarting the Terminal Server • 242
Port Scan • 451
Restoring the Appliance Configuration • 709
PPPoE • 778
Restoring the Appliance Configuration from
a USB Flash Drive • 711
PPTP • 779
Predefined QoS Classes • 277
Preparing the Edge Appliance for a Wireless
Connection • 93
Preparing the USB Flash Drive for Rapid
Deployment • 713
R
Rear Panel • 21, 25, 31, 35, 41, 47, 52
Rebooting the UTM-1 Appliance • 718
Refreshing Your Service Center Connection
• 560
Restoring Traffic Shaper Defaults • 284
RJ-45 • 779
Router • 779
RSA SecurID Authentication Method • 593
Running Diagnostics • 717
S
Sample Implementation on Two Gateways •
271
SCADA • 469
Remote Access VPNs • 567
Securing the UTM-1 Edge Appliance against
Theft • 96
Reordering Firewall Rules • 385
Security Policy Enforcement • 367
Index
787
Index
Security Policy Implementation • 366
Security Requirements • 62
Selecting Categories for Blocking • 541
Selecting Protocols for Scanning • 526
Sequence Verifier • 450
Server • 779
Service Center and Upgrades • 749
Setting the Firewall Security Level • 368
Setting the Time on the Appliance • 687
Setting Up a USB Modem • 168
Setting Up an ExpressCard Cellular Modem
• 172
Setting Up an RS232 Modem • 165
Setting Up Modems • 164
SMART Management and Subscription
Services • 553
SmartDefense Categories • 429
Software Requirements • 20
Specifications • 751
src • 703
src port • 703
Stateful Inspection • 779
Status Bar • 111
Strict TCP • 446
Subnet Mask • 779
Supported NAT Rule Types • 397
SynDefender • 448
T
Setting Up Network Printers • 722
tcp • 704
Setting Up Remote VPN Access for Users •
644
TCP • 445, 779
Setting Up Secure HotSpot • 392
Setting Up the UTM-1 Appliance • 99
Setting Up Traffic Shaper • 276
TCP/IP • 780
TCP/IP Settings • 73, 78
Teardrop • 430
Technical Specifications • 751
Setting Up Your UTM-1 Appliance as a
VPN Server • 569
Temporarily Disabling Email Filtering • 528
Setting Your Security Policy • 365
Temporarily Disabling Web Filtering • 542
Shared Secret Authentication Method • 602
The Primary WLAN • 286
Side Panel • 27, 43
The Security Policy • 59
SIP • 463
The Stateful Inspection Advantage - Passive
FTP Example • 65
Site-to-Site VPNs • 565
Small PMTU • 447
788
The UTM-1 Firewall • 61
The UTM-1 Firewall Security Policy • 366
Check Point UTM-1 Embedded NGX User Guide
Index
Troubleshooting • 745
Troubleshooting Wireless Connectivity •
321
U
udp • 705
UDP • 780
Uninstalling a Certificate • 625
Updating the Firmware • 547
Updating the Firmware Manually • 550
Updating VStream Antivirus • 494
Upgrading Your License • 675
URL • 780
Username and Password Authentication
Method • 588
Using an IPoA (IP over ATM) Connection •
140
Using an L2TP Connection • 151
Using Antivirus and Antispam Filtering •
477
Using Bridges • 243
Using Centralized Email Filtering • 525
Using Certificates • 618
Using Diagnostic Tools • 691
Using Internet Setup • 131
Using IP Tools • 692
Using NAT Rules • 396
Using Network Objects • 210
Using Network Printers • 721
Using a Cable Modem Connection • 122, 145
Using Packet Sniffer • 694
Using a DHCP Connection • 124
Using Port-Based Security • 386
Using a LAN Connection • 143
Using Quick Internet
Connection/Disconnection • 176
Using a PPPoA (PPP over ATM) Connection
• 134
Using RADIUS Authentication • 645
Using a PPPoE (PPP over Ethernet)
Connection • 138
Using Rapid Deployment • 712
Using a PPPoE Connection • 119, 147
Using Rules • 374
Using a PPPoE or PPPoA Connection • 130
Using Secure HotSpot • 391
Using a PPTP Connection • 121, 149
Using SmartDefense • 421
Using a Static IP Connection • 123
Using Software Updates • 548
Using a Telstra (BPA) Connection • 153
Using Static Routes • 223
Using an EoA (Ethernet over ATM)
Connection • 136
Using the EAP Authenticator • 404
Using Remote Desktop • 655
Using the EAP Authenticator for
Authentication of Wired Clients • 406
Index
789
Index
Using the EAP Authenticator for
Authentication of Wireless Clients • 404
Using the Internal DNS Server • 208
Using the Internet Wizard • 116
Using the Serial Console • 668
Using the SmartDefense Tree • 427
Using the SmartDefense Wizard • 422
Using the Terminal Server • 239
Using the Traffic Monitor • 330
Using the UTM-1 Portal • 108, 666
Using the Wireless Configuration Wizard •
294
Using Traffic Shaper • 275
Using VStream Antispam • 495
Using VStream Antivirus • 479
Using Web Content Filtering • 531
Using Web Filtering • 539
Using Web Rules • 532
UTM-1 Edge Installation • 83
UTM-1 Edge N and Edge NW • 751
UTM-1 Edge N Series Features • 3
UTM-1 Edge NW Series Features • 9
UTM-1 Edge Series Products • 2
UTM-1 Edge W • 757
UTM-1 Edge W Series Features • 14
UTM-1 Security • 57
V
Viewing and Deleting Blocked Senders • 510
790
Viewing and Deleting Classes • 283
Viewing and Deleting Firewall Rules • 386
Viewing and Deleting NAT Rules • 403
Viewing and Deleting Network Objects •
219
Viewing and Deleting Network Service
Objects • 223
Viewing and Deleting Safe Senders • 524
Viewing and Deleting Static Routes • 228
Viewing and Deleting Users • 643
Viewing and Deleting VPN Sites • 614
Viewing and Deleting VStream Antispam
Rules • 521
Viewing and Deleting VStream Antivirus
Rules • 490
Viewing and Deleting Web Rules • 539
Viewing Bridge Statistics • 346
Viewing Computers • 333
Viewing Connections • 336
Viewing Firmware Status • 673
Viewing General Network Statistics • 338
Viewing IKE Traces for VPN Connections •
630
Viewing Internet Connection Information •
173
Viewing Internet Connection Statistics • 339
Viewing Logs • 353
Viewing Network Printers • 741
Viewing Network Statistics • 337
Check Point UTM-1 Embedded NGX User Guide
Index
Viewing Port Statuses • 230
Viewing Reports • 325
Viewing Services Information • 559
Viewing the Event Log • 353
Viewing the Routing Table • 348
Viewing the Security Log • 357
Viewing the UTM-1 Appliance Status • 325
Viewing Traffic Reports • 331
Viewing VPN Topology • 632
Viewing VPN Tunnels • 628
Viewing VStream Antispam Statistics • 503
Viewing VStream Antivirus Signature
Database Information • 481
What Other Stateful Inspection Firewalls
Cannot Do • 68
Why Protect Business Information? • 58
Windows 2000/XP • 74, 731
Windows 7 and Vista • 70
Windows Vista • 724
Wireless Attributes • 756, 761
Wireless Distribution System Links • 287
Wireless Security Protocols • 291
Workflow • 248, 656
Workflows • 404
Working with VPNs • 563
Working with Wireless Networks • 285
Viewing Wired Network Statistics • 342
Worm Catcher • 459
Viewing Wireless Network Statistics • 344
WPA-Personal • 297
Viewing Wireless Station Statistics • 350
Virtual Access Points • 286
VoIP • 463
VPN • 780
VPN tunnel • 780
VStream Antivirus Actions • 479
W
Wall Mounting the UTM-1 Edge Appliance •
94
Welchia • 441
WEP • 300
What Is a Firewall? • 61
What Is a Security Policy? • 366
Index
791
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement