Appliance Configuration
Built-in System Service Groups
Some built-in service groups represent Check Points ability to perform deep inspection of a specific protocol.
Such system service groups cannot be deleted. They contain a list of built in services which you can restore if you edit the content of such groups by clicking Reset.
Some system service groups have additional configuration which affect the way the deep inspection is performed.
DNS - The Firewall settings tab lets you configure NAT support over DNS. Note that choosing this option will affect the performance of DNS traffic and is normally not needed unless your organization uses both
NAT and an internal DNS server accessible to the Internet. The IPS settings tab lets you configure how and when DNS deep inspection is performed. Select the relevant options.
Managing Network Objects
The Users & Objects > Network Objects page lists the network objects defined in the system. In this page you can add new network objects, edit network objects, and delete network objects. In most cases, the most common use for these objects is to define a security policy and exceptions to it. These objects can be used as hosts for the internal DNS service and their IP addresses can be configured as fixed for the internal
DHCP service.
These are the available network object types:
Single IP - A network object that represents a device with a single IP address.
IP Range - A network object that represents a range of IP addresses.
Network - A network object that represents a network.
To create a Single IP network object:
1. Click New.
The New Network Object window opens.
2. In Type, select Single IP.
3. Enter an IP address and Object name.
4. Select or clear these options as necessary:
Allow DNS server to resolve this object name - When the gateway is the DNS server for your internal networks the name of the server/network object will be translated to its IP address if this option is selected.
Exclude from DHCP service - The internal DHCP service will not distribute the configured IP address of this server/network object to anyone.
Reserve IP address in DHCP service for MAC - The internal DHCP service will distribute the configured IP address only to this server/network object according to its MAC address.
Enter the MAC address - This is required for IP reservation. When you create the object from the Active Computers page, the MAC address is detected automatically.
5. Click Apply.
To create an IP Range network object:
1. Click New.
The New Network Object window opens.
2. In Type, select IP Range.
3. In the Start IP and End IP fields, enter the IP addresses that represent the start of the IP range and end of the IP range.
4. Enter the Object name.
5. Select or clear this option as necessary:
Exclude from DHCP service - The internal DHCP service will not distribute the configured IP range to anyone.
6. Click Apply.
To create a Network type network object:
1. Click New.
The New Network Object window opens.
2. In Type, select Network.
Check Point 600 Appliance Administration Guide | 99
