Checkpoint
Ch 1: Hardware overview
Checkpoint is the highest used firewall in the world following Palo Alto. Other are Cisco and Fortigate.
Types of firewall:
1. Application firewall: it works on application layer such as Windows firewall. It works on base
machine operating system.
2. Packet filter firewall: Layer 3 firewall to filter based on Layer 3 inspection. It can’t protect against
anti-spoofing.
3. Stateful firewall: Checkpoint invented this technology. It checks Source IP dest IP source port and
dest port. On this basis it creates state table which keeps record of all connections. It does the entries in
state table and checks if it to be allowed.
Other technology
WAF(web application firewall)- it checks http and https traffic for applications
Sandbox: it is a technology to check some file to be send on different operating systems.
Q: Will stateful firewall create entry for UDP connection in its state table?
CH 2: History, Packet Flow, Types of deployment and 3-Layer architecture
History: Checkpoint is from Israel. Its Operating system is combination of 2 OS IPSO(Nokia) and
Splat. Combination of these two OS forms GAIA OS.
Packet flow of checkpoint firewall
Types of deployment:
1. Distributed deployment
2.
Standalone deployment
Checkpoint 3 Layer architechture
Q: What is the major difference between Checkpoint and ASA firewall?
VPN (Virtual private network)
Meshed Topology
Understanding Checkpoint Management Station
ICA is
internal
certificate authority which gets installed alongwith management station. ICA allows one to create
certificates for various VPN which are created by the same management station. Thus they are
signed by same ICA on the management station.
Another way to use ICA is with SIC communication. SIC is a protocol that uses certificates for
authentication. SIC is a secure method to build communication between a firewall and
management station.
A management station can also be a log server to store all the logs from users and firewall.
FWM: process listens on port 18190. In some case if a client is unable to connect to the
management station maybe FWM process is not running. We can use netstat -na command to
check if it is running.
Once authentication to management is done by a client all the communication is carried out over
checkpoint proprietary protocol CPMI(Checkpoint management Infrastructure). CPMI listens
on port 18190.
FWD demon listens for all log files. It uses port 257 for all logs coming out of firewall. It runs on
MGMT and listens on port 257 for all the logs.
CPD is used for secure communication between MGMT and firewall. It is installed on both
MGMT and firewall. A secure communication is established between firewall and MGMT using
SIC which is a SSL tunnel between the two. It listens on port 18211 where certificate is send from
MGMT to firewall and after estd. The comunication will happen over port 18191 and 18192.
AMON(Application monitoring) protocol is used to connect the MGMT and firewall and send
statistics to the management station.
Checkpoint certificate authority (CPCA): is the daemon for ICA. It is a child process for FWD
daemon. It is used for 2 major purposes:
1. Retrive CRL: When firwalls are making VPNs they receive certificates. In the certificate there
is a CRL (certificate relocation list) pointing to IP address where to locate the [Link] IP
address is usually MGMT. MGMT checks if it is still valid and decite to use it or not.
2. ICA management tool: we can use a mangement tool with a web browser to merge, delete or
maintain a certificate. This is on the management station.
CPCA runs on MGMT and it listens on port 18264 and 18265
to retrieve CRL list on web browser we need to enter URL: IP_addr:18254 to see the ICA
management tool.