Checkpoint Firewall's Questions & Answers

-Which of the applications in Check Point technology can be used to configure security objects?  Ans-SmartDasboard

What is Anti-Spoofing.
Ans-  Anti-Spoofing is the feature of Checkpoint Firewall. which is protect from attacker who generate IP Packet with Fake or Spoof source address. Its determine that whether traffic is legitimate or not. If traffic is not legitimate then firewall block that traffic on interface of firewall.

What is Stealth Rule in checkpoint firewall.
Ans – Stealth Rule Protect Checkpoint firewall from direct access any traffic. Its rule should be place on the top of Security rule base. In this rule administrator denied all traffic to access checkpoint firewall.

What is Cleanup rule In Checkpoint Firewall.
Ans – Cleanup rule place at last of the security rule base, Its used to drop all traffic which not match with above rule and Logged. Cleanup rule mainly created for log purpose. In this rule administrator denied all the traffic and enable log.

Which of the applications in Check Point technology can be used to view who and what the administrator do to the security policy?
Ans-SmartView Tracker

What is NAT.
Ans- NAT stand for Network Address Translation. Its used to map private IP address with Public IP Address and Public IP address map with Private IP Address. Mainly its used for Provide Security to the Internal Network and Servers from Internet. NAT is also used to connect Internet with Private IP Address. Because Private IP not route able on Internet.

What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.

What is Hide NAT.
Ans – Hide NAT used to translate multiple private IP or Network with single public IP address. Means many to one translation. Its can only be used in source NAT translation. Hide NAT can not be used in Destination NAT.

What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.

Difference between Automatic NAT and Manual NAT. Ans- Automatic NATAutomatic created by Firewall Can not modify Can not create “No NAT” rule Can not create Dual NAT Port forwarding not possible Proxy ARP by default enabled Manual NATManually Created by Network Security Administrator Can be Modify Can be Create “No NAT” rule Can be Create Dual NAT Port forwarding possible Proxy ARP by default not enable

What is 3 trier architecture component of Checkpoint Firewall.
Ans-
Smart Console.
Security Management.
Security Gateway.

What is the Packet Flow of Checkpoint firewall.
Ans-
SAM Database.
Address Spoofing.
Session Lookup.
Policy Lookup.
Destination NAT.
Route Lookup.
Source NAT.
Layer 7 Inspection.
VPN.
Routing.

What is Explicit rule In Checkpoint Firewall.
Ans-Its a rule in ruse base which is manually created by network security administrator that called Explicit rule.

Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.

What is VPN (Virtual Private Network).
Ans – VPN (Virtual Private Network) is used to create secure connection between two private network over Internet. Its used Encryption authentication to secure data during transmission.
There are two type of VPN
•Site to Site VPN.
•Remote Access VPN.

What is IP Sec.
Ans – IP Sec (IP Security) is a set of protocol. which is responsible for make secure communication between two host machine, or network over public network such as Internet. IPSec Protocol provide Confidentiality , Integrity, Authenticity and Anti Replay protection.
There is two IPSec protocol which provide security
1. ESP (Encapsulation Security Payload) and
2. AH (Authentication Header).

What is Difference between ESP and AH IPSec Protocol.
Ans - ESP – ESP Protocol is a part of IPsec suit , Its provide Confidentiality, Integrity and Authenticity. Its used in two mode Transport mode and Tunnel mode.
AH – Its is also part of a IPsec suit, Its provide only Authentication and Integrity, Its does not provide Encryption. Its also used to two mode Transport mode and Tunnel mode.

What is difference between standalone deployment distributed deployment. 
Ans - Standalone deployment – In standalone deployment, Security Gateway and Security
management server installed on same Machine.
Distributed deployment  – In Distributed deployment, Security Gateway and Security Management Server installed on different machine.

What is SIC.
SIC – SIC stand for “Secure Internal Communication”. Its a checkpoint firewall feature that is used to make secure communication between Checkpoint firewall component. Its used when Security Gateway and Security management server installed in Distributed deployment. Its Authentication and Encryption for secure communication.

What Advantage of NAT.
•Save Public IP to save cost.
•Security with hide Internal Network.
•Avoid Routing.
•Publish Server over Internet.
•Overlapping Network.
•Access Internet from Private IP address.

What is Smart Dashboard.
Ans– Its tool of smart console. Its used to Configure Rule, Policy object, Create NAT Policy, Configure VPN and Cluster.

What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.

Where you can view the results of the checkpoint?
Ans-You can view the results of the checkpoints in the Test Result Window.
Note: If you want to retrieve the return value of a checkpoint (a boolean value that indicates whether the checkpoint passed or failed) you must add parentheses around the checkpoint argument in the statement in the Expert View.

What’s the Standard Checkpoint?
Ans-Standard Checkpoints checks the property value of an object in your application or web page.

Which environment are supported by Standard Checkpoint?
Ans-Standard Checkpoint are supported for all add-in environments.

What’s the Bitmap Checkpoint?
Ans-Bitmap Checkpoint checks the bitmap images in your web page or application.

Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.

What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.

Which environments are supported by Table Checkpoint?
Ans-Table Checkpoints are supported only ActiveX environment.

What is Checkpoint Architecture?
Ans-Check Point has developed a Unified Security Architecture that is implemented throughout all of its security products. This Unified Security Architecture enables all Check Point products to be managed and monitored from a single administrative console, and provides a consistent level of security. The  Check Point Unified Security Architecture is comprised of four main components:
 Core Technologies: - Check Point uses a common set of core technologies, such as INSPECT for security inspection, across multiple layers of security.
 Central Management: - All Check Point products can be managed and monitored from a single administrative console.
 Open Architecture: - Check Point has built its security architecture to be open and interoperable in a heterogeneous environment. For example, Check Point products can interoperate with other network and security equipment from third-party vendors to enable cooperative enforcement of Security Policies.
 Universal-update Ability: - Check Point has consolidated multiple security-alert and update functions to ease update procedures and help Administrators ensure that security is always upto-date.
server gets hack...

How Checkpoint Component communicate and Syns with each other?
Ans-Secure Internal Communications (SIC) is the Check Point feature that ensures components, such as Security Gateways, SmartCenter Server, SmartConsole, etc. can communicate with each other freely and securely using a simple communication-initialization process.

What are the major differences between SPLAT and GAIA?
Ans-Gaia is the latest version of Checkpoint which is a combination of SPLAT and IPSO. Here are some benefits of Gaia as compare to SPLAT/IPSO.
1. Web-Based user interface with Search Navigation
2. Full Software Blade support
3. High connection capacity
4. Role-Based administrative Access
5. Intelligent Software updates
6. Native IPv4 and IPv6 Support
7. ClusterXL or VRRP Clusters
8. Manageable Dynamic Routing Suite
9. Full Compatibility with IPSO and SecurePlatform.

How SIC work? What are the different ports of SIC?
Ans-Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers.
These security measures make sure of the safety of SIC:
1. Certificates for authentication
2. Standards-based SSL for the creation of the secure channel
3. 3DES for encryption

The Internal Certificate Authority (ICA)
The ICA is created during the Security Management server installation process. The ICA is responsible for issuing certificates for authentication. For example, ICA issues certificates such as SIC certificates for authentication purposes to administrators and VPN certificates to users and gateways.
Initializing the Trust Establishment Process
Communication Initialization establishes a trust between the Security Management server and the Check Point gateways. This trust lets Check Point components communicate securely. Trust can only be established when the gateways and the server have SIC certificates.
The Internal Certificate Authority (ICA) is created when the Security Management server is installed. The ICA issues and delivers a certificate to the Security Management server.
To initialize SIC:
1. Decide on an alphanumeric Activation Key.
2. In SmartDashboard, open the gateway network object. In the General Properties page of the gateway, click Communication to initialize the SIC procedure.
3. In the Communication window of the object, enter the Activation Key that you created in step 2.
4. Click Initialize.
The ICA signs and issues a certificate to the gateway. Trust state is Initialized but not trusted. The certificate is issued for the gateway, but not yet delivered.
SSL negotiation takes place. The two communicating peers are authenticated with their Activation Key.
The certificate is downloaded securely and stored on the gateway. After successful Initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate, signed by the same ICA. The Activation Key is deleted. The SIC process no longer requires the Activation Key, only the SIC certificates.
Checkpoint SIC Ports
PORT     TYPE     SERVICE DESCRIPTION 18209     tcp          NGX Gateways <> ICAs (status, issue, or revoke). 18210     tcp          Pulls Certificates from an ICA. 18211     tcp          Used by the cpd daemon (on the gateway) to receive Certificates.

Checkpoint Packet flow for SNAT and DNAT?
Ans. In case of SNAT
Antispoofing Session lookup Policy lookup Routing Netting In case of DNAT Antispoofing Session lookup Policy lookup Netting
Routing 

What is the main different between cpstop/cpstart and fwstop/fwstart?
Ans-Using cpstop and then cpstart will restart all Check Point components, including the SVN foundation. Using fwstop and then fwstart will only restart VPN-1/FireWall-1

What are the functions of CPD, FWM, and FWD processes?
Ans-CPD – CPD is a high in the hierarchical chain and helps to execute many services, such as Secure Internal Communication (SIC), Licensing and status report.
FWM – The FWM process is responsible for the execution of the database activities of the SmartCenter server. It is; therefore, responsible for Policy installation, Management High Availability (HA) Synchronization, saving the Policy, Database Read/Write action, Log Display, etc.
FWD – The FWD process is responsible for logging. It is executed in relation to logging, Security Servers and communication with OPSEC applications.

CHECKPOINT CLUSTER
Q.1      Which protocol use in Checkpoint for Clustering?
Q.2      How Cluster_XL works? What the ports used by Cluster_XL?
Q.3      What are the New and Legacy Mode in Clustering?
Q.4      What are Delta and Full Mode in Clustering?
Q.5      Step by Step Process of configuring Checkpoint Cluster?
Q.6      How to use VRRP for Checkpoint Clustering?

CHECKPOINT VPN
Q.1      Difference between IPSec and SSL VPN?
Q.2      Difference between Domain Base and Route Base VPN?
Q.3   What are the protocols of IPSec? And what are the Protocol numbers of IPSec Protocols.?
Ans.   IPSec use two Protocols AH (Authentication Header) and ESP (Encapsulated Security Payload). AH works on Protocol number 51 and ESP works on Protocol number 50. 
Q.4      What is NAT traversal? Where it used?
Q.5      How use NAT in VPN Tunnel?
Q.6      What is Norm in IPSec?
Q.7    What the Phases of IPSec VPN? And many messages being exchanged in MAIN and QUICK Mode? What are these messages? 
Q.8      What is Encryption Domain?
Q.9     IPSec works at which OSI layer?
Ans.   IP Layer (Network Layer and provide security services Network Layer and above).

What is Anti-Boat? 
How to block ICMP tunnel in checkpoint?
Difference between fwstop and cpstop?
What are the services which impacted during cpstop and spstart?
What is CPinfo? And why it is used?
What are Cluster_XL, Secure_XL and CORE_XL?
What is Provider1?
What is MDF Database?
How to configure SMC HA?
How to check License via Smartview Monitor?
How to configure perform DNAT before routing via Global Properties? 

Network Security Questions & Answers

Network concepts:

·         Data communication and transmission techniques

·         Fundamentals of OSI & TCP/IP model

·         Router’s basic operations (startup, nvram, flash/IOS backup & recovery)

·         IP Addressing and Summarization

·         IP Routing : Basics of RIP , EIGRP , OSPF & BGP

Firewall

·         NAT (object based)

·         ACL (object based)

·         Contexts

·         Failover (Active-Standby & Active-Active)

·         Transparent

·         MPF (Modular Policy Framework)

VPN

·         Site to Site

·         SSL

·         Get VPN

·         Easy VPN

·         DMVPN

·         Flex

Route-Filtering

·         Access-lists

·         Route-Maps

·         Prefix-Lists

·         Distribute-Lists

·         Filter-lists

·         Class-maps & Policy-maps

Network security

·         AAA Server

·         Dot 1x Authentication

·         Ip SLA

Questions for an Interview of Network Security Engineer/Administrator: All listed questions are very common and important and you must be prepared with all of the following answers before facing any interview for a Network Security position.

Q. What is a firewall?

A: A firewall is used to provide security to the private networks connected to the internet. They can be implemented as hardware or software, or a combination of both. All incoming and outgoing network traffic are examined and accepted/rejected by the firewall as per defined rules.

Q. What is the difference between network gateway and a firewall?

A: A network gateway joins two networks together and a network firewall protects a computer network against unauthorized incoming or outgoing access. Network firewalls may be hardware devices or software programs.

Q. What is the difference between IPS and a firewall?

A: The primary function of a firewall is to prevent/control traffic flow from an untrusted network (outside). A firewall is not able to detect an attack in which the data is deviating from its regular pattern, whereas an IPS can detect and reset that connection as it has inbuilt anomaly detection.

Q. What is a transparent firewall?

A: A transparent firewall is considered as Layer 2. Deploying a new firewall into a network can be a complicated process due to various issues (e.g. IP address reconfiguration, network topology changes, current firewall etc.) because the firewall is not a routed hop and you can easily introduce a transparent firewall into an existing network.

Q. What is packet filtering?

A: Packet filtering is the process of permitting or blocking ip packets based on source and destination addresses, ports, or protocols. The packet filter examines the header of each packet based on a specific set of rules, and on that basis, decides to prevent it from passing or allow. Packet filtering is also part of a firewall program for protecting a local network from unwanted access.

Q. Define stateful inspection?

A: Stateful inspection is known as dynamic packet filtering and is a firewall technology that monitors the state of active connections and uses this information to determine which network packets are allowed through the firewall. Stateful inspection analyses packets down to the application layer.

Q. What is the Public Key Encryption?

A: Public key encryption uses public and private key for encryption and decryption. In this mechanism, public key is used to encrypt messages and only the corresponding private key can be used to decrypt them. To encrypt a message, a sender has to know the recipient’s public key.

Q. Define Digital Signatures

A: Digital signature is an attachment to an electronic message used for security purposes. It is used to verify the authenticity of the sender.

Q. What is Authorization?

A: Authorization is a security mechanism used to determine user/client privileges or access levels related to network resources, including firewalls, routers, switches and application features. Authorization is normally preceded by authentication and during authorization. It’s system that verifies an authenticated user’s access rules and either grants or refuses resource access.

Q. What is stateful failover?

A: Every time a session is created for a flow of traffic on the primary node, it is synced to the secondary node. When the primary node fails, sessions continue to pass traffic through the secondary node without having to re-establish.

Q. What is VPN and describe IPsec VPN

A: Virtual Private Network (VPN) creates a secure network connection over a public network such as the internet.

IPsec VPN means VPN over IP Security allows two or more users to communicate in a secure manner by authenticating and encrypting each IP packet of a communication session.

Q. What is Site to Site and remote access VPN?

A: A site-to-site VPN allows offices in multiple locations to establish secure connections with each other over a public network such as the Internet. Site-to-site VPN is different from remote-access VPN as it eliminates the need for each computer to run VPN client software as if it were on a remote-access VPN.

Q. How do you check the status of the tunnel’s phase 1 & 2 ?

A: Use following commands to check the status of tunnel phases:

Phase 1 : show crypto isakmp and State : MM_ACTIVE

Phase 2 : show crypto ipsec sa

Note: if you have lot of tunnels and the output is confusing use a ‘show crypto ipsec sa peer 12.12.12.12’ command instead.

Q. What is SSL VPN? How it is different from IPsec VPN?

A: SSL VPN provides remote access connectivity from almost any internet enabled location without any special client software at a remote site. You only need a standard web browser and its native SSL encryption.

IPsec is a dedicated point-to-point fixed VPN connection where SSL VPNs provides anywhere connectivity without any configuration or special software at remote site.

Q. What is GRE and why is it required?

A: Generic Routing Encapsulation (GRE) is a protocol that encapsulates packets in order to route other protocols over IP networks.

GRE enables a wrapper to be placed around a packet during transmission of the data. A receiving GRE removes the wrapper, enabling the original packet to be processed by the receiving stack.

Advantages of GRE tunnels include the following:

·         GRE tunnels connect discontinuous sub-networks.

·         GRE tunnels allow VPNs across wide area networks (WANs).

·         GRE tunnels encase multiple protocols over a single-protocol backbone.

·         GRE tunnels provide workarounds for networks with limited hops.

Q. Firewalls work at what layer? Define firewall generations and their roles.

A: Firewalls work at layer 3, 4 & 7. First generation firewalls provide packet filtering and they generally operate at layer 3 (Network Layer). Second generation firewalls operate up to the Transport layer (layer 4) and records all connections passing through it and determines whether a packet is the start of a new connection, a part of an existing connection, or not part of any connection. Second generation firewall is mainly used for Stateful Inspection.

Third generation firewalls operate at layer 7. The key benefit of application layer filtering is that it can “understand” certain applications and protocols (such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP)).

Q. What is DoS attack? How can it be prevented?

A: DoS (Denial of Service) attack can be generated by sending a flood of data or requests to a target system resulting in a consume/crash of the target system’s resources. The attacker often uses ip spoofing to conceal his identity when launching a DoS attack.

Q. What is IP Spoofing?

A: An IP spoofing attack enables an attacker to replace its identity as trusted for attacking host. For example, if an attacker convinces a host that he is a trusted client, he might gain privileged access to a host.

Q. What are the security-levels in cisco ASA?

A: ASA uses security levels to determine the parameters of trust given to a network attached to the respective interface. The security level can be configured between 0 to 100 where higher number are more trusted than lower. By default, the ASA allows packets from a higher (trusted) security interface to a lower (untrusted) security interface without the need for an ACL explicitly allowing the packets.

Q. What is AAA?

A: AAA stands for authentication, authorization and accounting, used to control user’s rights to access network resources and to keep track of the activity of users over a network. The current standard by which devices or applications communicate with an AAA server is the Remote Authentication Dial-In User Service (RADIUS).

Q. What is IPS? How does it work?

A: An Intrusion Prevention System (IPS) is a network security/threat prevention technology that examines network traffic flows to detect and prevent vulnerability exploits. An Intrusion Prevention System can play a good role to protect against various network security attacks such as brute force attacks, Denial of Service (DoS) attacks, and vulnerability detection. Moreover, an IPS also ensures prevention against protocol exploits.

Intrusion Prevention System uses four types of approaches to secure the network from intrusions which include:

·         Signature-Based

·         Anomaly-Based

·         Policy-Based

·         Protocol-Analysis-Based

The above described questions are very tricky and important in aspect to clear any interview for Network Security Engineer/Administrator position and it is not possible for anyone to explain all kind of questions so you can download more questions from the download link posted here and if you find any difficulty getting the answer to any question then you can write me er.vipinchauhan@gmail.com.