Check Point 730, 750 Getting Started Manual
Reklama
Reklama
Check Point 730/750
Appliance
Locally Managed
Getting Started Guide
Models: L-71, L-71W, L-71WD Classification: [Protected] P/N 707785
© 2018 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation.
No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page https://www.checkpoint.com/copyright/ for a list of our trademarks.
Refer to the Third Party copyright notices https://www.checkpoint.com/about-us/third-party-trademarks
-and-copyrights/ for a list of relevant copyrights and third-party licenses.
2
Latest Documentation
The latest version of this document is at: http://downloads.checkpoint.com/dc/download.htm?ID=78564
To learn more, visit the Check Point Support Center https://supportcenter.checkpoint.com
.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments mailto:[email protected]?subject=Feedba ck on Check Point 730/750 Appliance Locally Managed Getting
Started Guide .
3
Contents
Health and Safety Information 9
Informations relatives à la santé et à la sécurité (Class B) 28
Before You Get Started ..........................................................48
Shipping Carton Contents .....................................................49
Appliance Diagrams and Specifications ............................50
Check Point Software Blades Overview ............................56
Access Policy ...........................................................................57
Threat Prevention ...................................................................57
VPN ............................................................................................58
Cloud Services .........................................................................58
Configuring Check Point 730/750 Appliance 59
Workflow ..................................................................................59
Setting up the Check Point 730/750 Appliance ................60
Connecting the Cables ...........................................................60
First Time Deployment Options 61
Using the First Time Configuration Wizard ......................62
Starting the First Time Configuration Wizard ..................... 62
Authentication Details .................................................................... 66
Appliance Date and Time Settings ............................................ 67
Appliance Name ................................................................................ 69
........................................................................ 70
Local Network ................................................................................... 74
Wireless Network ............................................................................ 76
Administrator Access ..................................................................... 77
Appliance Registration .................................................................. 79
Software Blade Activation ............................................................ 82
............................................................................................. 83
Zero Touch Cloud Service .................................................... 84
USB Drive or SD Card ........................................................... 90
Threat Prevention Updates ................................................. 91
Firmware Upgrades .............................................................. 92
Internet Connectivity ............................................................. 93
Licensing .................................................................................. 94
Backup and Restore .............................................................. 95
Configuring Firewall Policy ................................................. 97
Setting Outgoing Services .................................................... 99
Configuring Applications and URL Filtering .................... 99
Configuring Access Policy ..................................................101
Blocking Specific Applications or URLs ..........................101
Creating a Permanent Access Rule ..................................102
Blocking Access for Users or Groups .............................. 104
Configuring Threat Prevention 105
Cyber Threats ........................................................................ 105
Enabling/Disabling Threat Prevention Control ............. 106
IPS Security Levels ............................................................... 108
Changing the Anti-Virus, Anti-Bot and Threat Emulation
Policy ....................................................................................... 108
Scheduling Blade Updates ................................................. 110
Configuring the Anti-Spam Blade ..................................... 110
Configuring the Anti-Spam Policy .................................... 111
Configuring Anti-Spam Exceptions .................................. 112
Configuring Anti-Spam to Detect-Only Mode ................. 113
Setting up Users and Administrators 115
Configuring Local System Administrators ..................... 116
Editing Information of Locally Defined Administrators 117
Deleting a Locally Defined Administrator ....................... 117
Configuring Local Users ..................................................... 117
Granting Remote Access Permissions ............................ 120
Editing a Specific User or Group ....................................... 121
Deleting a User or Group .................................................... 121
Connecting to Cloud Services ............................................ 124
Configuring a Guest Network .............................................127
Viewing Monitoring Reports ...............................................129
Viewing Security Reports ....................................................130
Viewing System Logs ...........................................................131
Support ....................................................................................133
Where to From Here ............................................................134
Health and Safety
Information
Read these warnings before setting up or using the appliance.
Warning - Do not block air vents. A minimum
1/2-inch clearance is required.
Warning - This appliance does not contain any user-serviceable parts. Do not remove any covers or attempt to gain access to the inside of the product. Opening the device or modifying it in any way has the risk of personal injury and will void your warranty. The following instructions are for trained service personnel only.
Power Supply Information
To reduce potential safety issues with the DC power source, only use one of these:
• The AC adapter supplied with the appliance.
• A replacement AC adapter supplied by Check Point.
• An AC adapter purchased as an accessory from Check
Point.
9
To prevent damage to any system, it is important to handle all parts with care. These measures are generally sufficient to protect your equipment from static electricity discharge:
• Restore the communications appliance system board and peripherals back into the antistatic bag when they are not in use or not installed in the chassis. Some circuitry on the system board can continue operating when the power is switched off.
• Do not allow the lithium battery cell used to power the real-time clock to short. The battery cell may heat up under these conditions and present a burn hazard.
Warning - DANGER OF EXPLOSION IF BATTERY IS
INCORRECTLY REPLACED. REPLACE ONLY WITH
SAME OR EQUIVALENT TYPE RECOMMENDED BY
THE MANUFACTURER. DISCARD USED
BATTERIES ACCORDING TO THE
MANUFACTURER’S INSTRUCTIONS.
• Do not dispose of batteries in a fire or with household waste.
• Contact your local waste disposal agency for the address of the nearest battery deposit site.
• Disconnect the system board power supply from its power source before you connect or disconnect cables or install or remove any system board components. Failure to do this can result in personnel injury or equipment damage.
• Avoid short-circuiting the lithium battery; this can cause it to superheat and cause burns if touched.
• Do not operate the processor without a thermal solution.
Damage to the processor can occur in seconds.
10
IMPORTANT SAFETY INSTRUCTIONS: When using your telephone equipment, basic safety precautions should always be followed to reduce the risk of fire, electric shock and injury to persons, including the following:
• Do not use this product near water for example, near a bathtub, washbowl, kitchen sink or laundry tub, in a wet basement or near a swimming pool.
• Avoid using a telephone (other than a cordless type) during an electrical storm. There may be a remote risk of electric shock from lightning.
• Do not use the telephone to report a gas leak in the vicinity of the leak.
• Use only the power cord and batteries indicated in this manual. Do not dispose of batteries in a fire. They may explode. Check with local codes for possible special disposal instructions.
SAVE THESE INSTRUCTIONS
CAUTION: To reduce the risk of fire, use only No. 26 AWG or larger (e.g., 24 AWG) UL Listed or CSA Certified
Telecommunication Line Cord.
For California:
Perchlorate Material - special handling may apply. See http://www.dtsc.ca.gov/hazardouswaste/perchlorate
The foregoing notice is provided in accordance with California
Code of Regulations Title 22, Division 4.5, Chapter 33. Best
Management Practices for Perchlorate Materials. This product, part, or both may include a lithium manganese dioxide battery which contains a perchlorate substance.
11
Proposition 65 Chemical
Chemicals identified by the State of California, pursuant to the requirements of the California Safe Drinking Water and Toxic
Enforcement Act of 1986, California Health & Safety Code s.
25249.5, et seq. ("Proposition 65"), that is "known to the State to cause cancer or reproductive toxicity." See http://www.calepa.ca.gov.
WARNING:
Handling the cord on this product will expose you to lead, a chemical known to the State of California to cause cancer, and birth defects or other reproductive harm. Wash hands after handling.
Declaration of Conformity
Manufacturer's Name:
Manufacturer's Address:
Check Point Software
Technologies Ltd.
5 Ha'Solelim Street, Tel Aviv
67897, Israel
Declares under our sole responsibility, that the products:
Model Number: L-71, *L-71W, **L-71WD
Product Options: 730 Wired, 730 WiFi, 730 WiFi
+ DSL, 750 Wired, 750 WiFi,
750 WiFi + DSL
Date First Applied: January 2016
12
Conform to the following Product Specifications:
RF/Wi-Fi (* marked model)
Telecom (** marked model)
Certification
EN 55032:2015 + AC:2016, Class B
EN 55032:2012 + AC:2013, Class B
EN 55024:2010 / A1:2015
EN 55024:2010
EN61000-3-2:2014
EN61000-3-3:2013
EN61000-4-2:2009
EN61000-4-3:2006+A1:2008+A2:2010
EN61000-4-4:2012
EN61000-4-5:2014
EN61000-4-6:2014
EN61000-4-11:2004
*EN 300 328 V2.1.1 (2016-11)
*EN 301 893 V2.1.1 (2017-05)
*EN 301 489-1 V2.1.1 (2017-02)
*EN 301 489-17 V3.1.1 (2017-02)
*EN 62311:2008 (SAR)
*EN 50386:2002, EN50383:2010 (SAR)
**ITU-T K.21 (04-2008)
Type
EMC,
*RF/WiFi, **Telecom
13
Certification Type
AS/NZS CISPR 32:2015, Class B
AS/NZS CISPR 32:2013, Class B
* AS/NZS 4268:2017
* ARPANSA Radiation Protection
Standard No.3:2002AS/NZS 2772.2:2011
(SAR)
**AS/CA S041.1-2015 & AS/CA
S041.2-2015
**AS/CA S043.1:2015 / AS/CA
S043.2:2015
EMC,
*RF, **Telecom
14
Certification Type
47 CRF FCC Part 15, Subpart B, Class B EMC,
ANSI C63.4:2009 *RF, **Telecom
ANSI C63.4:2014
ICES-003:2012 Issue 5 Class B
ICES-003:2016 Issue 6, Class B
*47 CFR FCC Part15, Subpart C (section
15.247) ANSI C63.10:2013
*FCC Part 15, Subpart E (Section
15.407)
*KDB 905462 D02 UNII DFS Compliance
Procedures New Rules v02
*FCC Part 2 (Section 2.1091)
KDB 447498 D01
*RSS-247 Issue 1(1015-05)
*RSS-247 Issue 2 (2017-02)
*RSS-Gen Issue 4 (2014-11)
*RSS-102 Issue 5:2015
*IEEE C95.3-2002
*FCC KDB 447498 D01
**FCC Part 68, ANSI/TIA-968-B-3-2016
**CS-03 Part I Issue 9, Amendment 5,
March 2016
**CS-03, Part VIII, Issue 9, Amendment
5, March 2016
15
Certification
VCCI, V-3/2015.4 Class B, V4/2012.04
VCCI-CISPR 32:2016, Class B
JP ARIB STD-T66 (V3.7), MIC notice 88
Appendix 43
JP ARIB STD-T71 (V6.1), MIC notice 88
Appendix 45
Type
EMC,
*RF
EN 60950-1
IEC 60950-1
UL/ULc 60950-1,
AS/NZS 60950-1
Safety
Date and Place of Issue: January 2016, Tel Aviv, Israel
Federal Communications Commission (FCC) Statement:
FCC SDOC
According to FCC Part 15
We, Check Point Software Technologies Ltd.
Address: Shlomo Kaplan St 5, / HaSolelim St 5 Tel Aviv-Yafo #
67897, Phone: +972-3-753-4555.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) This device must accept any interference received, including interference that may cause undesired operation.
16
Device reports and testing labs details:
Responsible party
Company Name: Check Point Software Technologies Inc.
Company Address: 959 Skyway Road Suite 300, San Carlos, CA
94070
Phone: 1-800-429-4391
Name: Ronen Sasson
This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the
FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in
17
accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.
FCC Caution:
• Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment.
• This transmitter must not be co-located or operating in conjunction with any other antenna or transmitter.
Radiation Exposure Statement
This equipment complies with FCC RF radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with a minimum distance of 20 centimeters between the radiator and your body.
18
For Country Code Selection Usage (WLAN Devices)
Note: The country code selection is for non-US models only and is not available to all US models. Per FCC regulation, all
WiFi products marketed in the US must be fixed to US operation channels only.
Customer Information - Part 68 Statement
This equipment complies with Part 68 of the FCC rules and the requirements adopted by the ACTA. On the bottom of the device that contains, among other information, a product identifier in the format US: FK1DL01AL71WD. If requested, this number must be provided to the telephone company.
Applicable connector jack Universal Service Order Codes
(“USOC”) for the Equipment is RJ11-C.
A plug and jack used to connect this equipment to the premises wiring and telephone network must comply with the applicable
FCC Part 68 rules and requirements adopted by the ACTA. A compliant telephone cord and modular plug is provided with this product. It is designed to be connected to a compatible modular jack that is also compliant. See installation instructions for details.
19
The REN is used to determine the number of devices that may be connected to a telephone line. Excessive RENs on a telephone line may result in the devices not ringing in response to an incoming call. In most but not all areas, the sum of RENs should not exceed five (5.0). To be certain of the number of devices that may be connected to a line, as determined by the total RENs, contact the local telephone company. For products approved after July 23, 2001, the REN for this product is part of the product identifier that has the format US:
FK1DL01AL71WD. The digits represented by 0.1 are the REN without a decimal point (e.g., 03 is a REN of 0.3).
If this Gateway causes harm to the telephone network, the telephone company will notify you in advance that temporary discontinuance of service may be required. But if advance notice isn't practical, the telephone company will notify the customer as soon as possible. Also, you will be advised of your right to file a complaint with the FCC if you believe it is necessary.
The telephone company may make changes in its facilities, equipment, operations or procedures that could affect the operation of the equipment. If this happens the telephone company will provide advance notice in order for you to make necessary modifications to maintain uninterrupted service.
If trouble is experienced with this Gateway, for repair or warranty information, please contact:
Check Point
6330 Commerce Drive Suite 120, Irving, Texas 75063
Office Phone Numbers 972-444-6612
20
If the equipment is causing harm to the telephone network, the telephone company may request that you disconnect the equipment until the problem is resolved.
Connection to party line service is subject to state tariffs.
Contact the state public utility commission, public service commission or corporation commission for information.
If your home has specially wired alarm equipment connected to the telephone line, ensure the installation of this equipment does not disable your alarm equipment. If you have questions about what will disable alarm equipment, consult your telephone company or a qualified installer.
WHEN PROGRAMMING EMERGENCY NUMBERS AND(OR)
MAKING TEST CALLS TO EMERGENCY NUMBERS:
1.
Remain on the line and briefly explain to the dispatcher the reason for the call.
2.
Perform such activities in the off-peak hours, such as early morning or late evenings.
Canadian Department Compliance Statement
This radio transmitter (identify the device by certification number) has been approved by Industry Canada to operate with the antenna types listed below with the maximum permissible gain indicated. Antenna types not included in this list, having a gain greater than the maximum gain indicated for that type, are strictly prohibited for use with this device.
Cet émetteur radio (identifier l'appareil par numéro de certification) a été approuvé par l'industrie Canada pour fonctionner avec les types d'antenne énumérés ci-dessous avec le gain maximum admissible indiqué. Types d'antennes
21
non inclus dans cette liste, ayant un gain supérieur au gain maximum indiqué pour cette type, sont strictement interdits pour une utilisation avec cet appareil.
Gain List of antenna information
Components
WLAN
Frequency
(MHz)
Antenna type
2412~2462 Dipole
Brand
WIESON
Main
1.93
WLAN 5180~5240 Dipole WIESON 1.95
WLAN
WLAN
WLAN
5260~5320
5500~5580
5660~5720
Dipole
Dipole
Dipole
WIESON
WIESON
WIESON
1.89
1.99
1.99
WLAN 5745~5825 Dipole WIESON 1.94
Radiation Exposure Statement:
This equipment complies with IC radiation exposure limits set forth for an uncontrolled environment. This equipment should be installed and operated with minimum distance 20cm between the radiator & your body.
Déclaration d'exposition aux radiations:
Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un environnement non contrôlé.
Cet équipement doit être installé et utilisé avec un minimum de
22
20 cm de distance entre la source de rayonnement et votre corps.
This device complies with Industry Canada license-exempt RSS standard(s). Operation is subject to the following two conditions:
1.
This device may not cause interference, and
2.
This device must accept any interference, including interference that may cause undesired operation of the device.
Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de licence.
L'exploitation est autorisée aux deux conditions suivantes:
1.
L'appareil ne doit pas produire de brouillage, et
2.
L'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage est susceptible d'en compromettre le fonctionnement.
This Class B digital apparatus complies with Canadian
ICES-003.
Cet appareil numérique de la classe B est conforme à la norme
NMB-003 du Canada.
This device and its antenna(s) must not be co-located or operating in conjunction with any other antenna or transmitter, except tested built-in radios.
Cet appareil et son antenne ne doivent pas être situés ou fonctionner en conjonction avec une autre antenne ou un autre
émetteur, exception faites des radios intégrées qui ont été testées.
The County Code Selection feature is disabled for products marketed in the US/ Canada.
23
La fonction de sélection de l'indicatif du pays est désactivée pour les produits commercialisés aux États-Unis et au Canada.
FOR WLAN 5 GHz DEVICE:
Caution :
1.
The device for operation in the band 5150-5250 MHz is only for indoor use to reduce the potential for harmful interference to co-channel mobile satellite systems;
2.
The maximum antenna gain permitted for devices in the bands 5250-5350 MHz and 5470-5725 MHz shall comply with the e.i.r.p. limit; and
3.
The maximum antenna gain permitted for devices in the band 5725-5825 MHz shall comply with the e.i.r.p. limits specified for point-to-point and non point-to-point operation as appropriate.
4.
The worst-case tilt angle(s) necessary to remain compliant with the e.i.r.p. elevation mask requirement set forth in
Section 6.2.2(3) shall be clearly indicated. (For 5G B2 with
DFS devices only)
5.
Users should also be advised that high-power radars are allocated as primary users (i.e. priority users) of the bands
5250-5350 MHz and 5650-5850 MHz and that these radars could cause interference and/or damage to LE-LAN devices.
Avertissement:
1.
Les dispositifs fonctionnant dans la bande 5150-5250 MHz sont réservés uniquement pour une utilisation à l’intérieur afin de réduire les risques de brouillage préjudiciable aux systèmes de satellites mobiles utilisant les mêmes canaux;
24
2.
Le gain maximal d’antenne permis pour les dispositifs utilisant les bandes 5250-5350 MHz et 5470-5725 MHz doit se conformer à la limite de p.i.r.e.;
3.
Le gain maximal d’antenne permis (pour les dispositifs utilisant la bande 5725-5825 MHz) doit se conformer à la limite de p.i.r.e. spécifiée pour l’exploitation point à point et non point à point, selon le cas.
4.
Les pires angles d’inclinaison nécessaires pour rester conforme à l’exigence de la p.i.r.e. applicable au masque d’élévation, et énoncée à la section 6.2.2 3), doivent être clairement indiqués. (Pour 5G B2 avec les périphériques
DFS uniquement)
5.
De plus, les utilisateurs devraient aussi être avisés que les utilisateurs de radars de haute puissance sont désignés utilisateurs principaux (c.-à-d., qu’ils ont la priorité) pour les bandes 5250-5350 MHz et 5650-5850 MHz et que ces radars pourraient causer du brouillage et/ou des dommages aux dispositifs LAN-EL.
NOTICE: This equipment meets the applicable ISED Terminal
Equipment Technical Specifications. This is confirmed by the registration number. The abbreviation, IC, before the registration number signifies that registration was performed based on a Declaration of Conformity indicating that ISED technical specifications were met. It does not imply that ISED approved the equipment.
NOTICE: The Ringer Equivalence Number (REN) for this terminal equipment is 01. The REN assigned to each terminal equipment provides an indication of the maximum number of terminals allowed to be connected to a telephone interface.
The termination on an interface may consist of any combination of devices subject only to the requirement that the sum of the
25
Ringer Equivalence Numbers of all the devices does not exceed five.
Japan Class B Compliance Statement:
European Union (EU) Electromagnetic Compatibility
Directive
This product is herewith confirmed to comply with the requirements set out in the Council Directive on the
Approximation of the Laws of the Member States relating to
Electromagnetic Compatibility Directive (2014/30/EU).
This product is in conformity with Low Voltage Directive
2014/35/EU, and complies with the requirements in the Council
Directive 2014/35/EU relating to electrical equipment designed for use within certain voltage limits and the Amendment
Directive 93/68/EEC.
26
Product Disposal
This symbol on the product or on its packaging indicates that this product must not be disposed of with your other household waste. Instead, it is your responsibility to dispose of your waste equipment by handing it over to a designated collection point for the recycling of waste electrical and electronic equipment.
The separate collection and recycling of your waste equipment at the time of disposal will help to conserve natural resources and ensure that it is recycled in a manner that protects human health and the environment. For more information about where you can drop off your waste equipment for recycling, please contact your local city office or your household waste disposal service.
27
Informations relatives à la santé et à la sécurité (Class
B)
Avant de mettre en place ou d'utiliser l'appareil, veuillez lire les avertissements suivants.
Avertissement : ne pas obturer les aérations. Il faut laisser au moins 1,27 cm d'espace libre.
Avertissement : cet appareil ne contient aucune pièce remplaçable par l'utilisateur. Ne pas retirer de capot ni tenter d'atteindre l'intérieur.
L'ouverture ou la modification de l'appareil peut entraîner un risque de blessure et invalidera la garantie. Les instructions suivantes sont réservées à un personnel de maintenance formé.
Information pour l'alimentation
Pour limiter les risques avec l'alimentation CC, n'utilisez que l'une des solutions suivantes :
• L'adaptateur secteur fourni avec l'appareil
• Un adaptateur secteur de remplacement, fourni par Check
Point
• Un adaptateur secteur acheté en tant qu'accessoire auprès de Check Point
Pour éviter d'endommager tout système, il est important de manipuler les éléments avec soin. Ces mesures sont
28
généralement suffisantes pour protéger votre équipement contre les décharges d'électricité statique :
• Remettez dans leur sachet antistatique la carte système et les périphériques de l'appareil de communications lorsqu'ils ne sont pas utilisés ou installés dans le châssis.
Certains circuits sur la carte système peuvent rester fonctionnels lorsque si l'appareil est éteint.
• Ne jamais court-circuiter la pile au lithium (qui alimente l'horloge temps-réel). Elle risque de s'échauffer et de causer des brûlures.
Avertissement : DANGER D'EXPLOSION SI LA
PILE EST MAL REMPLACÉE. NE REMPLACER
QU'AVEC UN TYPE IDENTIQUE OU ÉQUIVALENT,
RECOMMANDÉ PAR LE CONSTRUCTEUR. LES
PILES DOIVENT ÊTRE MISES AU REBUT
CONFORMÉMENT AUX INSTRUCTIONS DE LEUR
FABRICANT.
• Ne pas jeter les piles au feu ni avec les déchets ménagers.
• Pour connaître l'adresse du lieu le plus proche de dépôt des piles, contactez votre service local de gestion des déchets.
• Débrancher l'alimentation de la carte système de sa source électrique avant de connecter ou déconnecter des câbles ou d'installer ou retirer des composants. À défaut, les risques sont d'endommager l'équipement et de causer des blessures corporelles.
• Ne pas court-circuiter la pile au lithium : elle risque de surchauffer et de causer des brûlures en cas de contact.
29
• Ne pas faire fonctionner le processeur sans refroidissement. Le processeur peut être endommagé en quelques secondes.
INSTRUCTIONS DE SÉCURITÉ IMPORTANTES : Lorsque vous utilisez votre équipement téléphonique, des précautions de sécurité élémentaires doivent toujours être respectées afin de réduire le risque incendie, d'électrocution ou de blessures, comme celles qui suivent :
• Ne pas utiliser ce produit à proximité de l'eau, par exemple près d'une baignoire, d'un lavabo, d'un évier de cuisine ou de buanderie, dans un sous-sol humide ou près d'une piscine.
• Evitez d'utiliser un téléphone (autre qu'un téléphone sans fil) par temps de foudre. Les éclaires impliquent un risque faible d'électrocution.
• N'utilisez pas la téléphone pour signaler une fuite de gaz si vous vous tenez près de cette fuite.
• Utilisez uniquement le cordon alimentation et les piles indiquées dans ce manuel. Ne pas jeter les piles au feu.
Elles risquent d'exploser. Consultez les réglementations locales pour toute instruction spécifique concernant leur
élimination.
SAUVEGARDEZ CES INSTRUCTIONS
ATTENTION : Pour réduire tout risque d'incendie, utilisez uniquement un cordon de ligne téléphonique 26 AWG ou plus large (ex. 24 AWG) homologué UL et certifié CSA.
30
Pour la Californie :
Matériau perchloraté : manipulation spéciale potentiellement requise. Voir http://www.dtsc.ca.gov/hazardouswaste/perchlorate
L'avis suivant est fourni conformément au California Code of
Regulations, titre 22, division 4.5, chapitre 33. Meilleures pratiques de manipulation des matériaux perchloratés. Ce produit, cette pièce ou les deux peuvent contenir une pile au dioxyde de lithium manganèse, qui contient une substance perchloratée.
Produits chimiques « Proposition 65 »
Les produits chimiques identifiés par l'état de Californie, conformément aux exigences du California Safe Drinking
Water and Toxic Enforcement Act of 1986 du California Health
& Safety Code s. 25249.5, et seq. (« Proposition 65 »), qui sont
« connus par l'état pour être cancérigène ou être toxiques pour la reproduction » (voir http://www.calepa.ca.gov)
AVERTISSEMENT :
La manipulation de ce cordon vous expose au contact du plomb, un élément reconnue par l'état de Californie pour être cancérigène, provoquer des malformations à la naissance et autres dommages relatifs à la reproduction. Se laver les mains après toute manipulation.
Déclaration de conformité
Nom du constructeur : Check Point Software
Technologies Ltd.
Adresse du constructeur : 5 Ha'Solelim Street, Tel Aviv
67897, Israël
31
Déclare sous son entière responsabilité que les produits :
Numéro de modèle :
Options de produit :
L-71, *L-71W, **L-71WD
Date de demande initiale :
730, 730 Wi-Fi, 730 Wi-Fi +
DSL, 750, 750 Wi-Fi, 750 Wi-Fi
+ DSL
Janvier 2016
Sont conformes aux normes produit suivantes :
RF/Wi-Fi (modèle signalé par *)
Telecom (modèle signalé par **)
32
Certification
EN 55032:2015 + AC:2016, Classe B
EN 55032:2012 + AC:2013, Classe B
EN 55024:2010 / A1:2015
EN 55024:2010
EN61000-3-2:2014
EN61000-3-3:2013
EN61000-4-2:2009
EN61000-4-3:2006+A1:2008+A2:2010
EN61000-4-4:2012
EN61000-4-5:2014
EN61000-4-6:2014
EN61000-4-11:2004
*EN 300 328 V2.1.1 (2016-11)
*EN 301 893 V2.1.1 (2017-05)
*EN 301 489-1 V2.1.1 (2017-02)
*EN 301 489-17 V3.1.1 (2017-02)
*EN 62311:2008 (SAR)
*EN 50386:2002, EN50383:2010 (SAR)
**ITU-T K.21 (04-2008)
Type
EMC,
*RF/WiFi, **Telecom
33
Certification
AS/NZS CISPR 32:2015, Classe B
AS/NZS CISPR 32:2013, Classe B
* AS/NZS 4268:2017
* ARPANSA Radiation Protection
Standard No.3:2002AS/NZS
2772.2:2011 (SAR)
**AS/CA S041.1-2015 & AS/CA
S041.2-2015
**AS/CA S043.1:2015 / AS/CA
S043.2:2015
Type
EMC,
*RF, **Telecom
34
Certification Type
47 CRF FCC Partie 15, Sous-partie B,
Classe B
ANSI C63.4:2009
ANSI C63.4:2014
ICES-003:2012 Issue 5 Classe B
ICES-003:2016 Issue 6, Classe B
*47 CFR FCC Partie15, Sous-partie C
(section 15.247) ANSI C63.10:2013
*FCC Partie 15, Sous-partie E (Section
15.407)
*KDB 905462 D02 UNII DFS Procédure de conformité Nouvelles règles v02
*FCC Partie 2 (Section 2.1091)
KDB 447498 D01
*RSS-247 Issue 1(1015-05)
EMC,
*RF, **Telecom
*RSS-247 Issue 2 (2017-02)
*RSS-Gen Issue 4 (2014-11)
*RSS-102 Issue 5:2015
*IEEE C95.3-2002
*FCC KDB 447498 D01
**FCC Part 68, ANSI/TIA-968-B-3-2016
**CS-03 Partie I Issue 9, Amendement
5, Mars 2016
**CS-03, Partie VIII, Issue 9,
Amendement 5, Mars 2016
35
Certification
VCCI, V-3/2015.4 Classe B, V4/2012.04
VCCI-CISPR 32:2016, Classe B
JP ARIB STD-T66 (V3.7), avis MIC 88
Annexe 43
JP ARIB STD-T71 (V6.1), avis MIC 88
Annexe 45
Type
EMC,
*RF
EN 60950-1
IEC 60950-1
UL/ULc 60950-1,
AS/NZS 60950-1
Sécurité
Date et lieu d'émission : Janvier 2016, Tel Aviv, Israël
Déclaration à la Federal Communications Commission (FCC) :
Selon section 15 des réglementations de la FCC
Nous, Check Point Software Technologies Ltd.
Adresse: Shlomo Kaplan St 5, / HaSolelim St 5 Tel Aviv-Yafo #
67897, Phone: +972-3-753-4555.
Ce dispositif est conforme à la section 15 des réglementations de la FCC. Son fonctionnement est soumis aux deux conditions suivantes : (1) Cet appareil ne doit pas causer d'interférence préjudiciable et (2) Cet appareil doit tolérer toute interférence reçue, y compris celles qui pourraient causer un fonctionnement indésirable.
36
Rapports de périphérique et détails des laboratoires de test:
Partie responsable
Nom de la compagnie: Check Point Software Technologies Inc.
Adresse de la compagnie: 959 Skyway Road Suite 300, San
Carlos, CA 94070
Téléphone: 1-800-429-4391
Nom: Ronen Sasson
Cet équipement a été testé et déclaré conforme aux limites pour appareils numériques de classe B, selon la section 15 des règlements de la FCC. Ces limitations sont conçues pour fournir une protection raisonnable contre les interférences nocives dans un environnement résidentiel. Cet appareil
37
génère, et peut diffuser des fréquences radio et, dans le cas d’une installation et d’une utilisation non conforme aux instructions, il peut provoquer des interférences nuisibles aux communications radio. Cependant, il n’existe aucune garantie qu’aucune interférence ne se produira dans le cadre d'une installation particulière. Si cet appareil provoque des interférences avec un récepteur radio ou un téléviseur, ce qui peut être détecté en mettant l’appareil sous et hors tension, l’utilisateur peut essayer d’éliminer les interférences en suivant au moins l’une des procédures suivantes :
• Réorienter ou déplacer l’antenne de réception.
• Augmenter la distance entre l’appareil et le récepteur.
• Brancher l’appareil sur une prise appartenant à un circuit différent de celui sur lequel est branché le récepteur.
• Consulter le distributeur ou un technicien radio/télévision qualifié pour obtenir de l’aide.
FCC Attention
• Tout changement ou modification non expressément approuvé par la partie responsable de la conformité pourrait empêcher l’utilisateur autorisé de faire fonctionner cet appareil.
• Cet émetteur ne doit pas être installé ou utilisé en conjonction avec d'autres antennes ou émetteurs.
Déclaration à la FCC sur l'exposition aux rayonnements
Cet équipement respecte les limites de la FCC en matière d'exposition aux rayonnements radio, pour un environnement non contrôlé. Cet équipement doit être installé et utilisé en réservant au moins 20 cm entre l'élément rayonnant et l'utilisateur.
38
Concernant la sélection du code pays (appareils WLAN)
Remarque: la sélection du code pays est uniquement pour les modèles hors Etats-Unis, et reste indisponible pour tout modèle vendus aux États-Unis. Selon la règlementation FCC tous les produits WIFI commercialisés aux Etats-Unis sont fixés uniquement sur des canaux américains.
Information client – Déclaration de la section 68
Cet équipement répond aux règles de la section 68 du Code des règlements fédéraux (FCC) et aux exigences adoptées par l'ACTA. Au bas de l'appareil est indiqué, entre autres informations, un identifiant produit au format US :
FK1DL01AL71WD. Si besoin, ce numéro devra être fourni à la compagnie de téléphone.
Le code USOC (Universal Service Order Code) du connecteur applicable pour l'équipement est RJ11-C (connecteur courant continu).
La prise et le connecteur utilisés pour brancher cet
équipement au câblage et au réseau téléphonique sur place doit répondre aux règles de la section 68 du FCC et aux exigences adoptées par l'ACTA. Un cordon de ligne téléphonique conforme et un connecteur modulaire sont fournis avec ce produit. Il est conçu pour être branché à un connecteur modulaire qui devra lui aussi être aux normes. Voir les instructions d'installation pour plus de détails.
Le numéro de REN (Ringer Equivalence Number) est utilisé pour déterminer le nombre d'appareils pouvant être branchés sur une ligne téléphonique. Un trop grand nombre de REN sur une même ligne téléphonique peut avoir pour résultat que les appareils n'émettront pas de sonnerie lors d'un appel entrant.
39
Dans la plupart des zones, la somme des REN ne devra pas dépasser cinq (5.0). Pour être certain du nombre d'appareils pouvant être branchés sur une même ligne téléphonique, tel que déterminé par le total des REN, contactez votre compagnie de téléphone. Pour les produits approuvés après le 23 juillet
2001, le REN pour ce produit est inclus dans l'identifiant de produit au format US :
FK1DL01AL71WD. Les chiffres représentés par le 0.1 sont le
REN sans point décimal (ex., 03 est un REN de 0.3).
En cas d'endommagement du réseau téléphonique causé par la Passerelle, la compagnie de téléphone vous informera à l'avance du temps d'arrêt nécessaire pour que le problème soit résolu. Si une notification préalable n'est pas possible, la compagnie de téléphone en informera le client dès que possible. Aussi, vous serez informé de votre droit de porter plainte en vertu du FCC si vous pensez que cela est nécessaire.
La compagnie de téléphone peut effectuer des changements au niveau de ses installations, équipements, opérations ou procédures pouvant affecter le fonctionnement de l'équipement. Dans ce cas, la compagnie de téléphone vous en informera à l'avance pour que vous puissiez effectuer les modifications nécessaires pour maintenir un service continu.
En cas de problème avec cette passerelle, et pour toute information concernant une réparation ou la garantie, veuillez contacter :
Check Point
6330 Commerce Drive Suite 120, Irving, Texas 75063
Numéro de téléphone de nos bureaux 972-444-6612
En cas d'endommagement du réseau téléphonique causé par l'équipement, il se peut que la compagnie de téléphone vous
40
demande de débrancher l'équipement jusqu'à ce que le problème soit résolu.
La connexion au service de ligne est assujettie aux tarifs en vigueur dans votre État. Veuillez contacter la Commission des services collectifs de proximité, la Commission des services publics et la Commission des sociétés de votre État pour plus d'information.
Si votre domicile est équipé d'une alarme spécifique branchée
à la ligne téléphonique, assurez-vous que l'installation de cet
équipement ne désactive pas votre équipement d'alarme. Si vous avez des questions concernant ce qui pourrait désactiver votre équipement d'alarme, veuillez contacter votre compagnie de téléphone ou un installateur agréé.
LORSQUE VOUS PROGRAMMEZ DES NUMÉROS D'URGENCE
ET (OU) EFFECTUEZ DES TESTS D'APPEL À DES NUMÉROS
D'URGENCE :
1.
Restez en ligne et expliquez brièvement à l'opérateur la raison de votre appel.
2.
Faites cela pendant les heures creuses, comme en fin de matinée et en début de soirée.
Déclaration de conformité du département Canadien :
Cet émetteur radio (identifier l'appareil par numéro de certification) a été approuvé par l'industrie Canada pour fonctionner avec les types d'antenne énumérés ci-dessous avec le gain maximum admissible indiqué. Types d'antennes non inclus dans cette liste, ayant un gain supérieur au gain maximum indiqué pour cette type, sont strictement interdits pour une utilisation avec cet appareil.
41
List of antenna information
Components
WLAN
Frequency
(MHz)
Antenna type
2412~2462 Dipole
Brand
WIESON
WLAN
WLAN
5180~5240
5260~5320
Dipole
Dipole
WIESON
WIESON
WLAN
WLAN
WLAN
5500~5580 Dipole
5660~5720 Dipole
5745~5825 Dipole
WIESON
WIESON
WIESON
Gain
Main
Déclaration d'exposition aux radiations:
Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un environnement non contrôlé.
Cet équipement doit être installé et utilisé avec un minimum de
20 cm de distance entre la source de rayonnement et votre corps.
Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de licence.
L'exploitation est autorisée aux deux conditions suivantes:
1.
L'appareil ne doit pas produire de brouillage, et
2.
L'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage est susceptible d'en compromettre le fonctionnement.
1.93
1.95
1.89
1.99
1.99
1.94
42
Cet appareil numérique de la classe B est conforme à la norme
NMB-003 du Canada.
Cet appareil et son antenne ne doivent pas être situés ou fonctionner en conjonction avec une autre antenne ou un autre
émetteur, exception faites des radios intégrées qui ont été testées.
La fonction de sélection de l'indicatif du pays est désactivée pour les produits commercialisés aux États-Unis et au Canada.
POUR WLAN 5 GHz DISPOSITIF:
Avertissement:
1.
Les dispositifs fonctionnant dans la bande 5150-5250 MHz sont réservés uniquement pour une utilisation à l’intérieur afin de réduire les risques de brouillage préjudiciable aux systèmes de satellites mobiles utilisant les mêmes canaux;
2.
Le gain maximal d’antenne permis pour les dispositifs utilisant les bandes 5250-5350 MHz et 5470-5725 MHz doit se conformer à la limite de p.i.r.e.;
3.
Le gain maximal d’antenne permis (pour les dispositifs utilisant la bande 5725-5825 MHz) doit se conformer à la limite de p.i.r.e. spécifiée pour l’exploitation point à point et non point à point, selon le cas.
4.
Les pires angles d’inclinaison nécessaires pour rester conforme à l’exigence de la p.i.r.e. applicable au masque d’élévation, et énoncée à la section 6.2.2 3), doivent être clairement indiqués. (Pour 5G B2 avec les périphériques
DFS uniquement)
5.
De plus, les utilisateurs devraient aussi être avisés que les utilisateurs de radars de haute puissance sont désignés utilisateurs principaux (c.-à-d., qu’ils ont la priorité) pour les bandes 5250-5350 MHz et 5650-5850 MHz et que ces
43
radars pourraient causer du brouillage et/ou des dommages aux dispositifs LAN-EL.
Restrictions concernant le raccordement de matériel
Avis : Le présent matériel est conforme aux spécifications techniques d’ISED applicables au matériel terminal. Cette conformité est confirmée par le numéro d'enregistrement. Le sigle IC, placé devant le numéro d'enregistrement, signifie que l’enregistrement s’est effectué conformément à une déclaration de conformité et indique que les spécifications techniques d'ISED ont été respectées. Il n’implique pas qu’ISED a approuvé le matériel.
Avis: L'indice d'équivalence de la sonnerie (IES) du présent matériel est de 01. L'IES assigné à chaque dispositif terminal indique le nombre maximal de terminaux qui peuvent être raccordés à une interface téléphonique. La terminaison d'une interface peut consister en une combinaison quelconque de dispositifs, à la seule condition que la somme d'indices d'équivalence de la sonnerie de tous les dispositifs n'excède pas 5.
Déclaration de conformité de classe B pour le Japon :
44
Directive de l'Union européenne relative à la compatibilité électromagnétique
Ce produit est certifié conforme aux exigences de la directive du Conseil concernant le rapprochement des législations des
États membres relatives à la directive sur la compatibilité
électromagnétique (2014/30/EU).
Ce produit est conforme à la directive basse tension
2014/35/EU et satisfait aux exigences de la directive
2014/35/EU du Conseil relative aux équipements électriques conçus pour être utilisés dans une certaine plage de tensions, selon les modifications de la directive 93/68/CEE.
45
Mise au rebut du produit
Ce symbole apposé sur le produit ou son emballage signifie que le produit ne doit pas être mis au rebut avec les autres déchets ménagers. Il est de votre responsabilité de le porter à un centre de collecte désigné pour le recyclage des
équipements électriques et électroniques. Le fait de séparer vos équipements lors de la mise au rebut, et de les recycler, contribue à préserver les ressources naturelles et s'assure qu'ils sont recyclés d'une façon qui protège la santé de l'homme et l'environnement. Pour obtenir plus d'informations sur les lieux où déposer vos équipements mis au rebut, veuillez contacter votre municipalité ou le service de gestion des déchets.
46
CHAPTER 1
Introduction
In This Section:
Thank you for choosing Check Point's Internet Security Product
Suite. Check Point products provide your business with the most up to date and secure solutions available today.
Check Point also delivers worldwide technical services including educational, professional, and support services through a network of Authorized Training Centers, Certified
Support Partners, and Check Point technical support personnel to ensure that you get the most out of your security investment.
For more information about the appliance, see the relevant
Check Point Appliance Administration Guide.
For more technical information, go to: http://support.checkpoint.com
47
Before You Get Started
Review these documents before doing the procedures in this guide:
• Release Notes
• Known Limitations
48
Shipping Carton Contents
Item
Appliance
Description
A single Check Point 730/750
Appliance
Power Supply and
Accessories
Guides
Sticker
• 1 power adapter
• 1 power cord
• 2 standard network cables
• 1 serial console cable
• 1 mini USB console cable
• Wall mount kit (screws and plastic anchors)
• 3 wireless network antennas (wireless network models only)
• RJ11 to RJ11 telephone cable for Annex A
DSL modem or RJ11 to TAE telephone cable for Annex B DSL modem (DSL models only)
• Check Point 730/750 Appliance Quick Start
Guide
• Check Point 730/750 Appliance Getting
Started Guide
LEDs behavior
License Agreement End user license agreement
49
Appliance Diagrams and
Specifications
These are the Check Point 730/750 Appliance models:
• Wired
• Wireless (WiFi)
• Wireless (WiFi) + DSL
This section describes the differences in the front and back panels.
50
Front Panel
Key Item
1 Alert LED
2 DSL LED
(DSL models only)
3 Internet LED
Description
• Off - Normal operation.
• Blinking green during boot.
• Red when the appliance has a resource problem such as memory shortage.
• Red blink fast - High temperature or system failure.
• Off – DSL Modem is off.
• Blinking green - DSL modem is performing synchronization.
• Steady green – DSL is synchronized.
• Off – No Internet connection is configured and enabled.
• Blinking green - Establishing an Internet connection.
• Blinking red - Error.
• Steady green – Internet connection is established.
51
Key Item
4 SD LED
Description
Green when SD card is inserted.
5 USB LED Green when a USB device is connected.
6 WiFi LED • Blinking green when there is WiFi activity.
(WiFi and WiFi
+ DSL models only)
• Green when there is no WiFi activity.
7 DSL Traffic
LED
(DSL models only)
• Off - DSL connection has not been established.
• Blinking Green - DSL connection is established. The blinking rate is proportional to the internet traffic rate.
8 LAN1 - LAN6,
DMZ, WAN
LEDS
Speed Indicator
• Orange when the port speed is 1000 Mbps.
• Green when the port speed is 100 Mbps.
• Not lit when the port speed is 10 Mbps.
Activity Indicator
9
10
Power LED
USB port
• Not lit when there is no link.
• Green when there is a link but no traffic encountered.
• Blinking green when encountering traffic.
• Green when the appliance is turned on.
• Red when there is a boot error or the appliance is in maintenance mode.
USB port that is used for:
• Cellular and analog modems.
• Reinstalling the appliance with new firmware.
• Running a first-time configuration script.
52
Note - The appliance supports using the SD-card slot (located on the side panel) for log storage.
Optional sizes:
• 8 GB
• 32 GB
53
Back Panel
Key Item
1 ANT1, ANT2 and
ANT3
(WiFi and WiFi +
DSL models only)
Description
Ports for attaching wireless network antennas.
2 DSL
(DSL models only)
Port for attaching telephone cable.
3 Factory Default button
Lets you restore the appliance to its factory defaults. The button is recessed into the appliance chassis to prevent accidental restoring of factory default settings. See
Restoring Factory Defaults.
54
Key Item
4 PWR+12VDC
5 Reboot button
6 Console port
Description
Connects to the power supply unit's cable.
Note The power unit cable must be securely screwed in to the appliance.
Lets you forcibly reboot the appliance. The button is recessed into the appliance chassis to prevent accidental reboot. The appliance reboots after you press the button.
RJ45 or Mini USB Serial connection configured to 115200 bps by default. You can also use this port to connect an analog modem. Note - When both the RJ45 and
Mini USB cables are connected, the Mini
USB takes precedence.
7 DMZ and WAN ports
8 Ground (Earth)
9 LAN1 - LAN6 ports
Built in Ethernet ports.
Functional grounding.
Built in Ethernet ports.
55
Check Point Software Blades
Overview
The available Check Point Software Blades can be divided into these major groups:
• Access Policy
• Threat Prevention
• VPN
56
Access Policy
The Access Policy has these features:
• Firewall - Makes sure that only allowed traffic enters the company's network. Other traffic is blocked before it enters.
• Application Control and URL Filtering - Makes sure that only authorized applications are used on the network and only allowed websites can be accessed.
• User Awareness - Lets you define policies for individual users.
• Quality of Service (QoS) - Enables bandwidth control and lets you give priority to your most important traffic.
Threat Prevention
The Threat Prevention policy has these features:
• Intrusion Prevention System (IPS) - Blocks attempts to exploit known vulnerabilities in files and network protocols.
• Anti-Virus - Blocks malware, such as viruses and worms, before it can get into the network.
• Anti-Spam - Blocks spam.
• Anti-Bot - Detects bot-infected machines and blocks bot
Command and Control (C&C) communications.
• Threat Emulation - Protects networks against unknown threats in files that are downloaded from the internet or attached to emails.
57
VPN
The VPN protects your business data in these ways:
• Remote Access - Encrypts traffic from authorized PCs and user devices that access your network, both in the office and from a remote location.
• Site-to-Site VPN - Encrypts all communications between multiple sites in your network.
Cloud Services
Cloud Services lets you connect your Check Point 730/750
Appliance to a Cloud Services Provider that uses a Web-based application to manage, configure, and monitor the appliance.
See Setting up Cloud Services (on page 123 ).
58
CHAPTER 2
Configuring Check Point
730/750 Appliance
In This Section:
The appliance is a Security Gateway and uses a web application to manage a Security Policy. After you configure the appliance with the First Time Configuration Wizard, the default Security
Policy is enforced automatically. Use the WebUI to configure the software blades you activated in the First Time
Configuration Wizard and fine tune the Security Policy.
Workflow
This is the recommended workflow for configuring Check Point
730/750 Appliance:
1.
Setting up the Check Point 730/750 Appliance (on page 60 ).
2.
Connecting the cables (on page 60 ).
3.
Configuring the appliance with the First Time Configuration
Wizard.
4.
Defining a security policy with the Web User Interface
(WebUI).
59
Setting up the Check Point
730/750 Appliance
1.
Remove the Check Point 730/750 Appliance from the shipping carton and place it on a tabletop.
2.
Identity the network interface marked as LAN1. This interface is preconfigured with the IP address 192.168.1.1.
Connecting the Cables
1.
Connect the power supply unit to the appliance and to a power outlet.
The appliance is turned on when the power supply unit is connected to an outlet.
The Power LED on the front panel lights up. This indicates that the appliance is turned on.
The Alert LED on the front panel starts to blink. This indicates that the appliance is booting up.
When the Alert LED turns off, the appliance is ready for login.
2.
Connect the standard network cable to the LAN1 port on the appliance and to the network adapter on your PC.
3.
If you use an external modem:
Connect the Ethernet cable to the WAN port on the appliance back panel and plug it into your external modem or router’s PC/LAN network port. The WAN Link LED on the appliance front panel lights up when the Ethernet is connected.
60
4.
If you do not use an external modem:
Connect the telephone cable to the DSL port on the appliance back panel and plug it into the DSL line socket.
The DSL Link LED as well as the Internet Link LED remains off until you configure the appliance, including setting up the DSL as an internet connection.
First Time Deployment
Options
There are different options for first time deployment of your gateways:
• First Time Configuration Wizard
•
Zero Touch Cloud Service (on page 90 )
•
USB Drive or SD Card (on page 90 )
61
Using the First Time Configuration
Wizard
Configure the Check Point 730/750 Appliance with the First
Time Configuration Wizard.
To close the wizard and save configured settings, click Quit.
Note - In the First Time Configuration Wizard, you may not see all the pages described in this guide. The pages that show in the wizard depend on your appliance model and the options you select.
Starting the First Time Configuration Wizard
To configure the Check Point 730/750 Appliance for the first time after you complete the hardware setup, use the First Time
Configuration Wizard.
If you do not complete the wizard because of one of these conditions, the wizard will run again the next time you connect to the appliance:
• The browser window is closed.
• The appliance is restarted while you run the wizard.
After you complete the wizard, you can use the WebUI (Web
User Interface) to change settings configured with the First
Time Configuration Wizard and to configure advanced settings.
62
To open the WebUI, enter one of these addresses in the browser:
• http://my.firewall
• http://192.168.1.1:4434
If a security warning message shows, confirm it and continue.
The First Time Configuration Wizard runs.
Welcome
The Welcome page introduces the product and shows the name of your appliance.
On this page you can:
• Change the language of the WebUI application.
• Connect to the Zero Touch server to fetch settings automatically from the cloud.
63
To change the language of the WebUI application:
Select the language link at the top of the page.
Note - Only English is allowed as the input language.
64
Zero Touch
Zero Touch enables a gateway to automatically fetch settings from the cloud when it is connected to the internet for the first time.
If the gateway connects to the internet via DHCP, the gateway will fetch the Zero Touch settings without any additional action.
If no DHCP service is available, you must run the First Time
Configuration Wizard, configure the Internet Connection settings, and then fetch the settings from the Zero Touch server.
To connect to the Zero Touch server:
Click Fetch Settings from the cloud .
For the rest of this procedure, see Zero Touch Cloud Service
To run the First Time Configuration Wizard:
Click Next .
65
Authentication Details
In the Authentication Details page, enter the required details to log in to the Check Point 730/750 Appliance WebUI application or if the wizard terminates abnormally:
• Administrator Name We recommend that you change the default "admin" login name of the administrator. The name is case sensitive.
• Password - A strong password has a minimum of 6 characters with at least one capital letter, one lower case letter, and a special character. Use the Password strength meter to measure the strength of your password.
Note - The meter is only an indicator and does not enforce creation of a password with a specified number of characters or character combination. To enforce password complexity, click the check box.
• Confirm Password - Enter the password again.
• Country - Select a country from the list (for wireless network models).
66
Appliance Date and Time Settings
In the Appliance Date and Time Settings page, configure the appliance's date, time, and time zone settings manually or use the Network Time Protocol option.
When you set the time manually, the host computer's settings are used for the default date and time values. If necessary, change the time zone setting to show your correct location.
Daylight Savings Time is automatically enabled by default. You can change this in the WebUI application on the Device > Date and Time page.
67
When you use the NTP option, there are two default servers you can use. These are ntp.checkpoint.com and ntp2.checkpoint.com.
68
Appliance Name
In the Appliance Name page, enter a name to identify the
Check Point 730/750 Appliance, and enter a domain name
(optional).
When the gateway performs DNS resolving for a specified object’s name, the domain name is appended to the object name. This lets hosts in the network look up hosts by their internal names.
69
Internet Connection
In the Internet Connection page, configure your Internet connectivity details or select Configure Internet connection later .
To configure Internet connection now:
1.
Select Configure Internet connection now .
2.
From the Connection Protocol drop down list, select the protocol used to connect to the Internet.
Note - During the First Time Configuration Wizard, you cannot create multiple connections.
3.
Enter information for the selected connection protocol. The information is different for each protocol. You can get it from your Internet Service Provider (ISP).
• Static IP - A fixed (non-dynamic) IP address.
• DHCP - Dynamic Host Configuration Protocol (DHCP) automatically issues IP addresses within a specified range to devices on a network. This is a common option when you connect through a cable modem.
• PPPoE (PPP over Ethernet) - A network protocol for encapsulating Point-to-Point Protocol (PPP) frames inside Ethernet frames. It is used mainly with DSL services where individual users connect to the DSL modem over Ethernet and Metro Ethernet networks. enter the ISP login user name and ISP login password .
Note - In the First Time Configuration Wizard, only dynamic IP is supported.
• PPTP - The Point-to-Point Tunneling Protocol (PPTP) is a method for implementing virtual private networks.
PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP packets.
70
• L2TP - Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual private networks
(VPNs). It does not provide any encryption or confidentiality by itself. It relies on an encryption protocol that it passes within the tunnel to provide privacy.
• Cellular Modem - Connect to the Internet using a wireless modem to a cellular ISP through the USB port.
• Analog Modem - Connect to the Internet using an analog modem through a USB port. In the WebUI application, you can configure to use an analog modem through the serial port.
• VDSL/ADSL IPoE - IP over Ethernet over DSL system where the IP is provided by the service provider. Note -
In the First Time Configuration Wizard, only dynamic IP is supported.
• Bridge - Connects multiple network segments at the data link layer (Layer 2).
• Wireless - Connects to a wireless network. Connection through the wireless interface in the First Time
Configuration Wizard is always DHCP.
• DNS Server (Static IP and Bridge connections) - Enter the DNS server address information in the relevant fields. For DHCP, PPPoE, PPTP, L2TP, VDSL, Analog
Modem, and Cellular Modem, the DNS settings are supplied by your service provider. You can override these settings later in the WebUI application, under
Device > DNS .
4.
For PPPoE over VDSL/ADSL or VDSL/ADSL IPoE :
• ADSL (ATM) system - Enter the VPI number and VCI number you received from your service provider, and the Encapsulation type (LLC or VC_MUX).
71
5.
For WAN/DMZ interfaces and static, DHCP, PPPoE, PPTP, and L2TP connection types
Or
For VDSL/ADSL interfaces and IPoE - dynamic IP and IPoE
- static IP connection types over PTM:
• Use connection as VLAN - Select this checkbox to add a virtual Internet interface.
• VLAN ID - Enter a VLAN ID between 1 and 4094,
Note - Annex L and Annex M systems can only be configured from the WebUI, not during the First Time
Configuration Wizard.
6.
Click Connect and wait for a connection to be established before you click Next .
7.
Complete the rest of the First Time Configuration Wizard.
8.
Click Finish .
We recommend that you configure the DNS as Check Point
730/750 Appliance needs to perform DNS resolving for different functions. For example, to connect to Check Point
User Center during license activation or when Application
Control, Web Filtering, Anti-Virus, or Anti-Spam services are enabled.
9.
In the Network names(SSID) field, click the arrow to select a wireless network.
If the network is secure, enter a password. Depending on the security type, you might need to enter the user name.
72
To test your ISP connection status:
Click Connect.
The appliance connects to your ISP. Success or failure shows at the bottom of the page.
73
Local Network
In the Local Network page, select to enable or disable switch on LAN ports and configure your network settings. By default, they are enabled. You can change the IP address and stay connected as the appliance's original IP is kept as an alias IP until the first time you boot the appliance.
DHCP is enabled by default with a default network range. Make sure to set the range accordingly and be careful not to include predefined static IPs in your network. Set the exclusion range for IP addresses that should not be defined by the DHCP server.
74
The appliance's IP address is automatically excluded from the range. For example, if the appliance IP is 1.1.1.1, the range also starts from 1.1.1.1, but will exclude its own IP address.
Important - If you choose to disable the switch on
LAN ports (clear the checkbox), make sure your network cable is placed in the LAN1 port. Otherwise, connectivity will be lost when you click Next .
75
Wireless Network
This applies to Wireless Network models only.
In the Wireless Network page, configure wireless connectivity details.
When you configure a wireless network, you must define a network name (SSID). The SSID (service set identifier) is a unique string that identifies a WLAN network to clients that try to open a wireless connection with it.
We recommend that you protect the wireless network with a password. Otherwise, a wireless client can connect to the network without authentication.
To configure the wireless network now:
1.
Select Configure wireless network now.
2.
Enter a name in the Network name (SSID) field. This is the name shown to clients that look for access points in the transmission area.
3.
Select Protected network (recommended) if the wireless network is protected by password.
4.
Enter a Password .
5.
Click Hide to conceal the password.
6.
Allow access from this network to the local network is selected by default. Clear if it is not necessary. If this option is selected, the wireless network is considered trusted and access by default is allowed from it to the local network.
76
Administrator Access
In the Administrator Access page, configure if administrators can use Check Point 730/750 Appliance from a specified IP address or any IP address.
To configure administrator access:
1.
Select the sources from where administrators are allowed access:
• LAN - All internal physical ports.
• Trusted wireless - Wireless networks that are allowed access to the LAN by default. This field is only shown in wireless network modes.
77
• VPN - Using encrypted traffic through VPN tunnels from a remote site or using a remote access client.
• Internet - Clear traffic from the Internet (not recommended).
2.
Select the IP address from which the administrator can access Check Point 730/750 Appliance:
• Any IP address
• Specified IP addresses only
• Specified IP addresses from the Internet and any IP address from other sources - Select this option to allow administrator access from the Internet from specific IP addresses only and access from other selected sources from any IP address. This option is the default.
To specify IP addresses:
1.
Click New .In the IP Address Configuration window, select an option:
• Specific IP address - Enter the IP address or click Get
IP from my computer .
• Specific network - Enter the Network IP address and
Subnet mask .
2.
Click Apply .
78
Appliance Registration
The appliance can connect to the Check Point User Center to pull the license information and activate the appliance. You must register the appliance in your Check Point User Center account. If you don't already have an account, you must create one.
To activate the appliance:
Click Activate License .
79
A 30 day trial license will be used if:
• License activation is not completed.
• The registration information for your MAC address can't be found in the Check Point User Center.
To activate your appliance later :
In the WebUI, go to Home > License > Activate License .
To configure a proxy server:
1.
Click Set Proxy .
The Proxy Configuration box opens.
2.
Select the checkbox Use proxy server .
3.
Enter the address and port.
4.
Click Apply .
To configure the appliance offline:
1.
Go to: http://register.checkpoint.com/cpapp to register your appliance.
2.
Enter the appliance's credentials, MAC address and registration key.
3.
After you complete the registration wizard, download the activation file to a local location.
4.
In the Appliance Activation page, click Offline .
The Import from File window opens.
5.
Browse to the activation file you downloaded and click
Import .
6.
The activation process starts.
80
7.
You will be notified that you successfully activated the appliance. The next page shows the license status for each blade.
81
Software Blade Activation
Select the software blades to activate on this Check Point
730/750 Appliance.
QoS (bandwidth control) can only be activated from the WebUI after completing the First Time Configuration Wizard.
82
Summary
The Summary page shows the details of the elements configured with the First Time Configuration Wizard.
Click Finish to complete the First Time Configuration Wizard.
The WebUI opens on the Home > System page .
To back up the system configuration in the WebUI:
Go to Device > System Operations > Backup .
83
Zero Touch Cloud Service
The Zero Touch Cloud Service lets you easily manage the initial deployment of your gateways in the Zero Touch portal https://zerotouch.checkpoint.com
.
Zero Touch enables a gateway to automatically fetch settings from the cloud when it is connected to the internet for the first time.
Note - If you already used the First Time Configuration Wizard to configure your appliance, you cannot use the Zero Touch
Cloud service. If you start the First Time Configuration Wizard while the Zero Touch settings are being installed, the installation process terminates.
If the gateway connects to the internet via DHCP, the gateway will fetch the Zero Touch settings without any additional action.
If no DHCP service is available, you must run the First Time
Configuration Wizard, configure the Internet Connection settings, and then fetch the settings from the Zero Touch server.
84
To connect to the Zero Touch server from the First Time
Configuration Wizard:
1.
In the Welcome page of the First Time Configuration
Wizard, click Fetch Settings from the cloud .
85
2.
In the window that opens, click Yes to confirm that you want to proceed.
86
3.
The Internet connection page of First Time Configuration
Wizard opens. Configure your Internet connection and click
Connect .
The settings are automatically downloaded and installed.
A new window opens and shows the installation status. It may take several minutes until the installation is complete.
When you reconnect to the WebUI or click Refresh , you may see one of these:
• Login page - This means the process ended successfully and your settings are installed.
• Welcome page of the First Time Configuration Wizard - The process is still running. The settings are installing or they do not exist in the cloud.
87
Note - If you click Next on the Welcome page, the Zero
Touch settings installation process terminates.
• Page not found - The appliance local IP address may have been changed by the cloud settings installation. Try http://my.firewall or consult your administrator for the new local IP address.
After the gateway downloads and successfully applies the settings, it does not connect to the Zero Touch server again.
For more information on how to use Zero Touch, see sk116375 http://supportcontent.checkpoint.com/solutions?id=sk116375 and the Check Point Zero Touch User Guide.
Retries mechanism:
During cloud activation, there are sometimes temporary issues which prevent the gateway from activating Cloud Services.
The PWR LED shows the status of the retries mechanism:
Action
Trying to access Zero Touch deployment service.
Power LED Activity
Blinks red (slowly)
Blinks red (rapidly) Applying configuration fetched from
Zero Touch
Trying to activate Cloud Services
Waiting after failure (before retry)
Cloud Services are activated
Blinks green (rapidly)
Blinks green (slowly)
Solid green
88
Wait times before retry:
Failure
1st
Waiting Time
2 minutes
2nd
3rd
4th
Subsequent
4 minutes
8 minutes
16 minutes
Retries every 16 minutes until Cloud Services are successfully activated
89
USB Drive or SD Card
You can deploy the Check Point 730/750 Appliance configuration files from a USB drive or SD card and quickly configure many appliances without using the First Time
Configuration Wizard. The configuration file lets you configure more settings and parameters than are available in the First
Time Configuration Wizard.
You can deploy configuration files in these conditions:
• An appliance with default settings is not configured at all.
• An appliance that already has an existing configuration.
The Check Point 730/750 Appliance starts, automatically mounts the USB drive or SD card, and searches the root directory for a configuration file.
Note - The USB drive must be formatted in FAT32.
90
CHAPTER 3
Basic System Configuration
In This Section:
Do these configurations after you complete the First Time
Configuration Wizard and log in to the appliance.
Threat Prevention Updates
Click the status bar at the bottom of the WebUI to see updates.
To keep your protection up to date, configure automatic updates.
To schedule updates:
1.
Click Schedule at the bottom of the page or move the cursor over the update status.
2.
Select the blades you want to schedule for updates.
Note - When a "Not up to date" message shows for other blades, you must manually update them.
91
3.
Select Recurrence:
• Daily
• Weekly
• Monthly
4.
Click Apply .
Firmware Upgrades
To see notifications of available upgrades:
1.
Click the status bar.
We recommend you configure automatic upgrades.
2.
Move the cursor over the notification to show the version number.
3.
Click Upgrade Now or More Information .
To configure automatic upgrades:
1.
Go to Device > System Operations .
2.
Click Configure automatic upgrades .
The Automatic Firmware Upgrades window opens.
3.
Click Perform firmware upgrades automatically .
4.
Click Upgrade immediately or Upgrade according to this frequency .
5.
Click Apply .
Note - If the gateway is configured by Cloud Services, automatic firmware upgrades are locked.
92
To make sure you have the latest version:
1.
Go to Device > System Operations .
2.
Click Check now .
Internet Connectivity
To see the Internet Connectivity status:
Click the status bar.
If you are not connected, go to Devices > Internet .
93
Licensing
You must first register the appliance in your Check Point User
Center account. If you do not have a User Center account, you must create one to receive support and updates.
To see license information:
1.
Go to Home > License .
2.
If you did not do this during the First Time Configuration
Wizard, click Activate .
If Internet connectivity is configured:
1.
Click Activate License
2.
Browse to: http://register.checkpoint.com/cpapp
3.
Complete these fields:
• MAC address
• Registration key
4.
Select Hardware Platform .
5.
In Hardware Mode l, select Check Point 730/750
Appliance .
6.
Click Activate License .
You are notified when you successfully activate the appliance. If changes are made to your license, click Reactivate to get the updated license information.
If your license is expired:
Contact your local Check Point representative or visit https://www.checkpoint.com
.
94
To pull a new license:
Go to User Center > License > Reactivate.
Backup and Restore
See the relevant Check Point Appliance Administration Guide for backup and restore instructions.
95
CHAPTER 4
Configuring Access Policy
In This Section:
Configuring Firewall Policy
Your Check Point 730/750 Appliance is assigned a Firewall policy.
To manually change the policy:
1.
Go to Access Policy > Firewall Blade Control .
2.
Select an action:
• Set the default Access Policy control level.
• Set the default applications.
• Set URLs to block.
• Allow secure browsing.
• Configure User Awareness.
97
These are the security levels:
• Standard (Default) - Allows outgoing traffic on configured services, and traffic between internal and trusted wireless networks. Blocks incoming unencrypted traffic.
• Strict - Blocks all traffic in all directions.
• Off - Allows all traffic. Manually defined rules are not applied.
Note - When the firewall is deactivated, your network is not secured.
To add access policy rules:
Go to Access Policy > Firewall Policy .
You can also define access to specified servers.
98
Setting Outgoing Services
To set outgoing services in a Standard policy:
Click all services .
To allow specified services only:
1.
Click Block all outgoing services except the following .
2.
Select the services to allow.
To allow all services
1.
Click Allow all outgoing services .
2.
Click Apply .
Configuring Applications and URL
Filtering
The Applications & URL Filtering lets you define the access policy for Internet applications and websites. Select if you want
Applications & URL Filtering to be On, Off , or URL Filtering only .
You can select which categories and applications to block.
Security risk categories and applications are blocked by default.
99
Configure one or more of these options:
• Block security risk categories Block applications and
URLs that may be security risks:
• Spyware
• Phishing
• Botnet
• Spam
• Anonymizer
• Hacking
This option is selected by default.
• Block inappropriate content Block access to websites with inappropriate content like pornography, violence, gambling and alcohol.
• Block file sharing applications Block file-sharing from sources that use torrents and peer-to-peer (P2P) applications.
• Block other undesired applications Block specified applications or URLs. Click this option to manage your basic Application and URL Filtering policy.
• Limit bandwidth-consuming applications Limit or block applications that take up a lot of bandwidth. P2P file sharing, media sharing and media streams are selected by default. You can edit the group to add other applications or categories.
Note The maximum bandwidth limit must be lower than the actual bandwidth provided by your ISP.
100
Configuring Access Policy
To configure your access policy using standard categories:
1.
Go to Users & Objects > Applications & URLs .
2.
Click applications Default Policy or Applications Blade
Control page .
3.
Select the applications and URLs to block.
4.
Click Apply .
Blocking Specific Applications or
URLs
To customize your access policy:
1.
Go to Users & Objects > Applications & URLs .
2.
Click Applications Default Policy or Applications Blade
Control page.
101
3.
Select Custom or New to enter a specified application or
URL to block.
4.
Click Apply .
For more information on application and URL control, see the relevant Check Point Appliance Administration Guide or the online help from the top right corner of your WebUI.
Creating a Permanent Access Rule
A Permanent Access Rule is used to make exceptions to the default category definitions for specified users or groups. You can set stand-alone access rules and block one group of users from an area that others can access, or override the policy and give access to certain applications for only specified users. For example, HR can access Facebook during work hours as part of their job but other users are blocked. Another example of an exception is the payroll records of a company can only be accessed by the finance group.
To create a permanent access rule:
1.
Go to Access Policy > Firewall > Policy .
2.
In Outgoing access to the Internet , click New .
The Add Rule window opens.
3.
In the Add Rule window, click Any in the Source column and then click Users in the new window (Filter: Users).
This lets you create a rule for the selected user only. See
Configuring Local Users (on page 117 ) for steps to create
local users. You can also click New > Local user to create a new local user from the rule wizard.
4.
Select a user from the list.
102
5.
In the Add Rule window, click Any in the Application column.
6.
From the Common or Custom filter, select a URL or application to apply to the rule.
Or
Click New at the bottom of this window, and then select
URL or Application to enter a customized URL or application.
7.
Select Apply .
8.
Click Block or Accept in the Action column
• Block - Prevent the selected users from accessing the
URLs or Applications included in the rule.
• Accept - Override a generic block rule to let the selected users access URLs or Applications.
9.
Select when this rule applies.
Note - This type of access rule will affect all users and groups, unless you set up an overriding rule for individual users or groups.
103
Blocking Access for Users or
Groups
To block internet access for users or groups:
1.
Complete steps 1 to 4 in Creating a Permanent Access
2.
Make sure Any is selected in the Application column and
Block is selected in the Action column.
3.
Use the time of day feature to apply this rule.
For example, you can block the network to staff after hours, or block children’s Internet access at bedtime at home.
104
CHAPTER 5
Configuring Threat
Prevention
In This Section:
Changing the Anti-Virus, Anti-Bot and Threat Emulation Policy .................... 108
Cyber Threats
Malware is a major threat to network operations that is increasingly dangerous and sophisticated. Examples include worms, blended threats (combinations of malicious code and vulnerabilities for infection and dissemination) and Trojans.
To challenge today's malware landscape, Check Point's comprehensive Threat Prevention solution offers a multi-layered, pre- and post-infection defense approach and a consolidated platform that enables enterprise security to deal with modern malware.
105
The Intrusion Prevention System (IPS) blocks potentially malicious attempts to exploit known vulnerabilities in files and network protocols.
The Anti-Virus engine blocks viruses that pass through web and mail traffic (HTTP and SMTP) as well as through the File
Transfer Protocol (FTP).
The Anti-Bot engine detects bot-infected machines and blocks bot Command and Control communications.
The Anti-Spam engine blocks or flags emails that contain or are suspected to contain spam.
The Threat Emulation protects networks against unknown threats in files that are downloaded from the internet or attached to emails.
Enabling/Disabling Threat
Prevention Control
In Threat Prevention > Blade Control , you can enable or disable the IPS, Anti-Bot, and Anti-Virus blades.
To enable/disable the blade:
1.
Go to Threat Prevention > Blade Control .
2.
For the blades you want to enable, select On .
3.
For the blades you want to disable, select Off .
4.
Click Apply .
106
When the blade is managed by Cloud Services, a lock icon is shown. You cannot toggle between the on and off states.
If you change other policy settings, the change is temporary. Any changes made locally will be overridden in
the next synchronization between the gateway and Cloud
Services.
107
IPS Security Levels
Select the level of IPS protection you want:
• Typical - Most suitable for small or medium sized businesses and provides the best mixture of security and performance.
• Strict - Focuses on security.
• Custom - You can manually define your protection level.
After you select this option, click Apply .
You can also set IPS to detect-only mode and use the logs to see any attack attempts.
To see the logs:
Go to Logs & Monitoring > Security Logs page.
Changing the Anti-Virus, Anti-Bot and Threat Emulation Policy
Anti-Virus, Anti-Bot, and Threat Emulation share the same policy. Your Check Point 730/750 Appliance is configured to manage a standard policy.
To manually change the policy:
Go to Threat Prevention > Engine Settings .
108
You can:
• Configure when files will be inspected.
By default, only incoming files are inspected.
• Select policy overrides.
• Select file types policy.
• Block viruses from web and mail traffic (HTTP, SMTP, and POP3) and from the File Transfer Protocol (FTP).
• Prevent virus and bot attacks. You can also set detect only mode and use the logs to see if there are any attacks.
• Protect against malicious files.
109
Scheduling Blade Updates
The Blade Control page also shows the update status:
• Up to date
• Updated service unreachable Usually caused by a loss in
Internet connectivity. Check your Internet connection in the
Device > Internet page and contact your ISP if the problem continues.
• Update available / Not up to date A new package is ready to download but it is not time for the scheduled update.
To schedule updates:
1.
Go to Threat Prevention > Blade Control .
2.
Click Schedule Updates .
3.
Select the blades you want to update.
4.
Select the recurrence.
5.
Click Apply .
For more information on Anti-Virus Blade control options, see the relevant Check Point Appliance Administration Guide or the online help from the top right-hand corner of your WebUI.
Configuring the Anti-Spam Blade
The Anti-Spam blade lets you block or flag emails that contain spam. If you flag emails, you prevent the loss of any emails as suspected spam. You can handle suspected spam differently.
You can also set to detect-only mode and use the logs to see if there are spam attacks.
110
To configure the Anti-Spam blade:
1.
Go to Threat Prevention > Anti-Spam Blade Control .
2.
Select On or Off .
3.
Click Apply .
Configuring the Anti-Spam Policy
Your Check Point 730/750 Appliance is configured to manage a typical Anti-Spam Policy. To change this policy, see Configuring
Anti-Spam Exceptions (on page 112 ).
The spam filter can identify spam emails by their source address (default), or by email content.
To configure your appliance to inspect email content:
1.
Go to Threat Prevention > Anti-Spam Blade Control .
2.
Click Email content .
3.
Select one or more of these actions:
• Block spam emails .
• Flag spam email subject with X Replace X with manually defined text to add to the subject line for spam emails.
• Flag spam email header Identify email as spam in the email message header.
• Handle suspected spam separately
111
Configuring Anti-Spam Exceptions
You can configure which senders, domains, or IP addresses are not considered spam. Emails from these senders are not inspected.
You can also identify specified senders, domains or IP addresses for the Anti-Spam engine to automatically block.
To configure Anti-Spam exceptions:
1.
Go to Threat Prevention > Anti-Spam .
2.
Click Exceptions .
Note Filter Spam based on: Email content must be activated on the Anti-Spam Blade control page to apply
Anti-Spam policies.
112
For more information on Anti-Spam Blade control options, see the relevant Check Point Appliance Administration Guide or the online help from the top right-hand corner of your WebUI.
Configuring Anti-Spam to
Detect-Only Mode
To configure the Anti-Spam to work in detect only mode:
1.
Click Detect-only mode .
2.
Click Apply .
Note - In detect-only mode, only logs will show. The blade will not block emails.
113
CHAPTER 6
Setting up Users and
Administrators
In This Section:
Editing Information of Locally Defined Administrators ..................................... 117
These sections explain how to set up the initial configuration of your network:
• Administrators - Have permission to configure policies and settings
• Users - Individuals who have permission to use the appliance but not make any changes to policies
• Groups - Users with the same rules are grouped together
Important - You must complete the First Time
Configuration Wizard before you do these procedures.
115
Configuring Local System
Administrators
We recommend you configure your system so an administrator can log in from a specific network only.
To configure local system Administrators:
1.
Go to Device > Administrators .
2.
Click New .
The Add Administrator window opens.
3.
Enter Administrator Name and Password.
Note - You cannot use these characters in your password: {
} [ ] ` ~ | ’ "
4.
Optional: To set the administrator with read-only privileges, click Read-only Administrator .
5.
Click Apply .
116
Editing Information of Locally
Defined Administrators
To edit information of locally defined administrators:
1.
Go to Device > Administrators .
2.
Select the administrator and click Edit .
3.
Edit the information.
4.
Click Apply .
Note Only administrators with full access privileges can edit administrators.
Deleting a Locally Defined
Administrator
To delete a locally defined administrator:
1.
Go to Device > Administrators .
2.
Select the administrator and click Delete .
3.
Click Yes in the confirmation window.
Note - You cannot delete an administrator who is logged in.
Configuring Local Users
User profiles define how users can operate within the network:
• The time frame that users can access the network
• If users can work remotely
117
To add a new local user:
1.
Go to Users & Objects > User Awareness.
2.
Click On .
3.
Click Users .
4.
Click New .
5.
Enter User name , Password and Comments (optional).
Note You cannot use these characters in your password {
} [ ] ` ~ | ’ "
6.
For temporary or guest users, click Temporary User .
Enter the expiration date and time.
7.
To give remote access permissions, select Remote Access permissions .
8.
Click Apply .
118
The user is added to the table in the Users window.
119
Granting Remote Access
Permissions
To add a new local users group and grant remote access permissions:
1.
Go to Users & Objects > Users .
2.
Click the arrow on the New button and select Users Group .
3.
Enter a group name.
4.
Click Apply .
To give remote access permissions:
Click Remote Access permissions .
To add users to the group:
1.
Select from the user list or click New to create new users.
You can see a summary of the group members above the user list. Click the X next to the table to remove members.
2.
Click Apply .
The group is added.
120
Editing a Specific User or Group
To edit a specific user or group:
1.
Go to Users & Objects > Users .
2.
Select the user or group from the list.
3.
Click Edit .
4.
Edit the information.
5.
Click Apply .
Deleting a User or Group
To delete a user or group:
1.
Go to Users & Objects > Users .
2.
Select the user or group from the list.
3.
Click Delete .
4.
Click OK to confirm.
121
CHAPTER 7
Setting up Cloud Services
In This Section:
Cloud Services lets you connect your Check Point 730/750
Appliance to a Cloud Services that uses a Web-based application to manage, configure, and monitor the appliance.
This lets your appliance be remotely serviced by your managed services provider.
Before you can connect to Cloud Services, make sure you have:
• Received an email from your Cloud Services Provider that contains an activation link.
Or
• The Service Center IP address, the Check Point 730/750
Appliance gateway ID, and the registration key. Use these details to manually connect your Check Point 730/750
Appliance to Cloud Services.
123
Connecting to Cloud Services
To automatically connect to Cloud Services:
1.
In the email that the Security Gateway owner gets from the
Cloud Services Provider, click the activation link .
After you log in, a window opens and shows the activation details sent in the email.
2.
Make sure the details are correct and click Connect .
During cloud activation, there are sometimes temporary issues which prevent the gateway from activating Cloud Services. For
more information, see Zero Touch Cloud Service (on page 84 ).
124
This is a sample email:
Dear John Doe,
You are invited to activate your security services using the Security Appliance.
Once connected, you will be fully protected by a comprehensive security solution that will secure your assets and minimize the risks of a data breach.
Click http://myfirewall:443476382020.
If the First Time Configuration Wizard for the
Security Appliance appears, follow the initial setup instructions in your Getting Started Guide.
If the above activation link doesn't work, do the following:
1.
On a computer connected to the Security
Appliance, browse to the Security Appliance management interface: http://myfirewall:4434.
2.
Go to the Home tab and select Cloud Services.
3.
Click on the Configure button.
4.
Copy your activation key smbmgmt.provisioning.local&Sample-Gateway.d
omain.Prime&6382020 to the Activation Key field.
5.
Click Apply to connect.
Your appliance will connect to smbmgmt.provisioning.local&Sample-Gateway.doma
in.Prime (Gateway ID) using the key 6382020
(registration key).
Thank you,
Service Center security team
125
When connectivity is established, the Cloud Services section at the top of the page shows:
• The date of the synchronization
• The On/Off lever shows that Cloud Services is turned on.
A Cloud Services Server widget shows Connected on the status bar. Click this widget to open the Cloud Services page.
126
CHAPTER 8
Guest Network
In This Section:
Your Check Point security appliance lets you provide guest
Internet access without giving access to your local network.
When you configure a guest network with a Hotspot, you can monitor users that connect through your guest network.
To establish a Guest Network:
• Enable a WiFi network on your appliance. The guest network is actually a Virtual Access Point (VAP).
• Define the network interfaces that will redirect users to the
Hotspot portal when they browse from those defined interfaces.
Configuring a Guest Network
To configure a guest network:
1.
Go to Device > Wireless .
2.
Click Guest .
3.
Select Use Hotspot .
4.
Set Wireless Security to Unprotected or Protected.
5.
In the Access Policy tab, set the access and log policy options.
127
Note Do not select the boxes in the Access Policy tab if you do not want guests to access your local network.
6.
Enter a password .
7.
Click Apply .
128
CHAPTER 9
Monitoring and Reports
In This Section:
Viewing Monitoring Reports
The Monitoring page shows statistics for security events and network analysis. When you enter this page, the latest data shows.
To see monitoring reports:
1.
Go to Home or Logs and Monitoring > Monitoring .
2.
Select to show statistics from the last hour or last day.
3.
Click Demo to see sample reports.
4.
Click Refresh to update information.
129
Viewing Security Reports
The Reports page shows security reports for the time frame you specify. Security events include:
• High Risk Applications - The number of potentially risky applications accessed.
• Infected Hosts - The number of infected hosts or servers detected.
• Malwares - The number of malwares detected by Anti-Bot and Anti-Virus.
To see security reports in the reports dashboard:
1.
Go to Home or Logs and Monitoring > Reports .
2.
The different security reports show for the specified time frame:
• Hourly
• Daily
• Weekly
• Monthly
To generate a report:
1.
Go to Reports > Generate to create a new report or
Regenerate if a report already exists.
2.
Click the link to see the report.
The date and time link shows the date and time of the latest report generation.
Note The last generated report for each type is saved.
When you generate a new report, you overwrite the last saved report.
130
Viewing System Logs
The Security Logs page shows the last 100 log records. To load more records, scroll down the page. The log table is automatically refreshed.
To see the system logs:
1.
Go to Logs and Monitoring > Security Logs .
The Security Logs page shows up to 500 system logs generated by the appliance at all levels.
2.
Click View Details to get more information on the highlighted log.
For more information on Reports, Logs, and Monitoring, see the relevant Check Point Appliance Administration Guide or the online help from the top right-hand corner of your WebUI.
131
CHAPTER 10
Getting Support
In This Section:
Support
For technical assistance, contact Check Point 24 hours a day, seven days a week at:
• +1 972-444-6600 (Americas)
• +972 3-611-5100 (International)
When you contact support, you must provide your MAC address.
For more technical information, go to: http://supportcenter.checkpoint.com
To learn more about the Check Point Internet Security Product
Suite and other security solutions, go to: https://www.checkpoint.com
133
Where to From Here
You have now learned the basics that are necessary to begin using your Check Point 730/750 Appliance.
For more information about the Check Point 730/750 Appliance and links to the relevant Check Point Appliance Administration
Guide, go to the Check Point Support Center https://supportcenter.checkpoint.com/supportcenter/portal?ev
entSubmit_doShowproductpage&productTab=overview&produ ct=460 where you can find all related sks, downloads, and documentation.
134
Atsisiųsti
Vieša nuoroda atnaujinta
Vieša nuoroda į jūsų pokalbį buvo atnaujinta. You may view and manage your chat links after registration here.
Dokumento vieša nuoroda
Reklama
