-Which of the applications in Check Point technology can be used to configure security objects? Ans-SmartDasboard
What is Anti-Spoofing.
Ans- Anti-Spoofing is the feature of Checkpoint Firewall. which is protect from attacker who generate IP Packet with Fake or Spoof source address. Its determine that whether traffic is legitimate or not. If traffic is not legitimate then firewall block that traffic on interface of firewall.
What is Stealth Rule in checkpoint firewall.
Ans – Stealth Rule Protect Checkpoint firewall from direct access any traffic. Its rule should be place on the top of Security rule base. In this rule administrator denied all traffic to access checkpoint firewall.
What is Cleanup rule In Checkpoint Firewall.
Ans – Cleanup rule place at last of the security rule base, Its used to drop all traffic which not match with above rule and Logged. Cleanup rule mainly created for log purpose. In this rule administrator denied all the traffic and enable log.
Which of the applications in Check Point technology can be used to view who and what the administrator do to the security policy?
Ans-SmartView Tracker
What is NAT.
Ans- NAT stand for Network Address Translation. Its used to map private IP address with Public IP Address and Public IP address map with Private IP Address. Mainly its used for Provide Security to the Internal Network and Servers from Internet. NAT is also used to connect Internet with Private IP Address. Because Private IP not route able on Internet.
What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.
What is Hide NAT.
Ans – Hide NAT used to translate multiple private IP or Network with single public IP address. Means many to one translation. Its can only be used in source NAT translation. Hide NAT can not be used in Destination NAT.
What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.
Difference between Automatic NAT and Manual NAT. Ans- Automatic NATAutomatic created by Firewall Can not modify Can not create “No NAT” rule Can not create Dual NAT Port forwarding not possible Proxy ARP by default enabled Manual NATManually Created by Network Security Administrator Can be Modify Can be Create “No NAT” rule Can be Create Dual NAT Port forwarding possible Proxy ARP by default not enable
What is 3 trier architecture component of Checkpoint Firewall.
Ans-
Smart Console.
Security Management.
Security Gateway.
What is the Packet Flow of Checkpoint firewall.
Ans-
SAM Database.
Address Spoofing.
Session Lookup.
Policy Lookup.
Destination NAT.
Route Lookup.
Source NAT.
Layer 7 Inspection.
VPN.
Routing.
What is Explicit rule In Checkpoint Firewall.
Ans-Its a rule in ruse base which is manually created by network security administrator that called Explicit rule.
Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.
What is VPN (Virtual Private Network).
Ans – VPN (Virtual Private Network) is used to create secure connection between two private network over Internet. Its used Encryption authentication to secure data during transmission.
There are two type of VPN
•Site to Site VPN.
•Remote Access VPN.
What is IP Sec.
Ans – IP Sec (IP Security) is a set of protocol. which is responsible for make secure communication between two host machine, or network over public network such as Internet. IPSec Protocol provide Confidentiality , Integrity, Authenticity and Anti Replay protection.
There is two IPSec protocol which provide security
1. ESP (Encapsulation Security Payload) and
2. AH (Authentication Header).
What is Difference between ESP and AH IPSec Protocol.
Ans - ESP – ESP Protocol is a part of IPsec suit , Its provide Confidentiality, Integrity and Authenticity. Its used in two mode Transport mode and Tunnel mode.
AH – Its is also part of a IPsec suit, Its provide only Authentication and Integrity, Its does not provide Encryption. Its also used to two mode Transport mode and Tunnel mode.
What is difference between standalone deployment distributed deployment.
Ans - Standalone deployment – In standalone deployment, Security Gateway and Security
management server installed on same Machine.
Distributed deployment – In Distributed deployment, Security Gateway and Security Management Server installed on different machine.
What is SIC.
SIC – SIC stand for “Secure Internal Communication”. Its a checkpoint firewall feature that is used to make secure communication between Checkpoint firewall component. Its used when Security Gateway and Security management server installed in Distributed deployment. Its Authentication and Encryption for secure communication.
What Advantage of NAT.
•Save Public IP to save cost.
•Security with hide Internal Network.
•Avoid Routing.
•Publish Server over Internet.
•Overlapping Network.
•Access Internet from Private IP address.
What is Smart Dashboard.
Ans– Its tool of smart console. Its used to Configure Rule, Policy object, Create NAT Policy, Configure VPN and Cluster.
What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.
Where you can view the results of the checkpoint?
Ans-You can view the results of the checkpoints in the Test Result Window.
Note: If you want to retrieve the return value of a checkpoint (a boolean value that indicates whether the checkpoint passed or failed) you must add parentheses around the checkpoint argument in the statement in the Expert View.
What’s the Standard Checkpoint?
Ans-Standard Checkpoints checks the property value of an object in your application or web page.
Which environment are supported by Standard Checkpoint?
Ans-Standard Checkpoint are supported for all add-in environments.
What’s the Bitmap Checkpoint?
Ans-Bitmap Checkpoint checks the bitmap images in your web page or application.
Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.
What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.
Which environments are supported by Table Checkpoint?
Ans-Table Checkpoints are supported only ActiveX environment.
What is Checkpoint Architecture?
Ans-Check Point has developed a Unified Security Architecture that is implemented throughout all of its security products. This Unified Security Architecture enables all Check Point products to be managed and monitored from a single administrative console, and provides a consistent level of security. The Check Point Unified Security Architecture is comprised of four main components:
Core Technologies: - Check Point uses a common set of core technologies, such as INSPECT for security inspection, across multiple layers of security.
Central Management: - All Check Point products can be managed and monitored from a single administrative console.
Open Architecture: - Check Point has built its security architecture to be open and interoperable in a heterogeneous environment. For example, Check Point products can interoperate with other network and security equipment from third-party vendors to enable cooperative enforcement of Security Policies.
Universal-update Ability: - Check Point has consolidated multiple security-alert and update functions to ease update procedures and help Administrators ensure that security is always upto-date.
server gets hack...
How Checkpoint Component communicate and Syns with each other?
Ans-Secure Internal Communications (SIC) is the Check Point feature that ensures components, such as Security Gateways, SmartCenter Server, SmartConsole, etc. can communicate with each other freely and securely using a simple communication-initialization process.
What are the major differences between SPLAT and GAIA?
Ans-Gaia is the latest version of Checkpoint which is a combination of SPLAT and IPSO. Here are some benefits of Gaia as compare to SPLAT/IPSO.
1. Web-Based user interface with Search Navigation
2. Full Software Blade support
3. High connection capacity
4. Role-Based administrative Access
5. Intelligent Software updates
6. Native IPv4 and IPv6 Support
7. ClusterXL or VRRP Clusters
8. Manageable Dynamic Routing Suite
9. Full Compatibility with IPSO and SecurePlatform.
How SIC work? What are the different ports of SIC?
Ans-Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers.
These security measures make sure of the safety of SIC:
1. Certificates for authentication
2. Standards-based SSL for the creation of the secure channel
3. 3DES for encryption
The Internal Certificate Authority (ICA)
The ICA is created during the Security Management server installation process. The ICA is responsible for issuing certificates for authentication. For example, ICA issues certificates such as SIC certificates for authentication purposes to administrators and VPN certificates to users and gateways.
Initializing the Trust Establishment Process
Communication Initialization establishes a trust between the Security Management server and the Check Point gateways. This trust lets Check Point components communicate securely. Trust can only be established when the gateways and the server have SIC certificates.
The Internal Certificate Authority (ICA) is created when the Security Management server is installed. The ICA issues and delivers a certificate to the Security Management server.
To initialize SIC:
1. Decide on an alphanumeric Activation Key.
2. In SmartDashboard, open the gateway network object. In the General Properties page of the gateway, click Communication to initialize the SIC procedure.
3. In the Communication window of the object, enter the Activation Key that you created in step 2.
4. Click Initialize.
The ICA signs and issues a certificate to the gateway. Trust state is Initialized but not trusted. The certificate is issued for the gateway, but not yet delivered.
SSL negotiation takes place. The two communicating peers are authenticated with their Activation Key.
The certificate is downloaded securely and stored on the gateway. After successful Initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate, signed by the same ICA. The Activation Key is deleted. The SIC process no longer requires the Activation Key, only the SIC certificates.
Checkpoint SIC Ports
PORT TYPE SERVICE DESCRIPTION 18209 tcp NGX Gateways <> ICAs (status, issue, or revoke). 18210 tcp Pulls Certificates from an ICA. 18211 tcp Used by the cpd daemon (on the gateway) to receive Certificates.
Checkpoint Packet flow for SNAT and DNAT?
Ans. In case of SNAT
Antispoofing Session lookup Policy lookup Routing Netting In case of DNAT Antispoofing Session lookup Policy lookup Netting
Routing
What is the main different between cpstop/cpstart and fwstop/fwstart?
Ans-Using cpstop and then cpstart will restart all Check Point components, including the SVN foundation. Using fwstop and then fwstart will only restart VPN-1/FireWall-1
What are the functions of CPD, FWM, and FWD processes?
Ans-CPD – CPD is a high in the hierarchical chain and helps to execute many services, such as Secure Internal Communication (SIC), Licensing and status report.
FWM – The FWM process is responsible for the execution of the database activities of the SmartCenter server. It is; therefore, responsible for Policy installation, Management High Availability (HA) Synchronization, saving the Policy, Database Read/Write action, Log Display, etc.
FWD – The FWD process is responsible for logging. It is executed in relation to logging, Security Servers and communication with OPSEC applications.
CHECKPOINT CLUSTER
Q.1 Which protocol use in Checkpoint for Clustering?
Q.2 How Cluster_XL works? What the ports used by Cluster_XL?
Q.3 What are the New and Legacy Mode in Clustering?
Q.4 What are Delta and Full Mode in Clustering?
Q.5 Step by Step Process of configuring Checkpoint Cluster?
Q.6 How to use VRRP for Checkpoint Clustering?
CHECKPOINT VPN
Q.1 Difference between IPSec and SSL VPN?
Q.2 Difference between Domain Base and Route Base VPN?
Q.3 What are the protocols of IPSec? And what are the Protocol numbers of IPSec Protocols.?
Ans. IPSec use two Protocols AH (Authentication Header) and ESP (Encapsulated Security Payload). AH works on Protocol number 51 and ESP works on Protocol number 50.
Q.4 What is NAT traversal? Where it used?
Q.5 How use NAT in VPN Tunnel?
Q.6 What is Norm in IPSec?
Q.7 What the Phases of IPSec VPN? And many messages being exchanged in MAIN and QUICK Mode? What are these messages?
Q.8 What is Encryption Domain?
Q.9 IPSec works at which OSI layer?
Ans. IP Layer (Network Layer and provide security services Network Layer and above).
What is Anti-Boat?
How to block ICMP tunnel in checkpoint?
Difference between fwstop and cpstop?
What are the services which impacted during cpstop and spstart?
What is CPinfo? And why it is used?
What are Cluster_XL, Secure_XL and CORE_XL?
What is Provider1?
What is MDF Database?
How to configure SMC HA?
How to check License via Smartview Monitor?
How to configure perform DNAT before routing via Global Properties?
What is Anti-Spoofing.
Ans- Anti-Spoofing is the feature of Checkpoint Firewall. which is protect from attacker who generate IP Packet with Fake or Spoof source address. Its determine that whether traffic is legitimate or not. If traffic is not legitimate then firewall block that traffic on interface of firewall.
What is Stealth Rule in checkpoint firewall.
Ans – Stealth Rule Protect Checkpoint firewall from direct access any traffic. Its rule should be place on the top of Security rule base. In this rule administrator denied all traffic to access checkpoint firewall.
What is Cleanup rule In Checkpoint Firewall.
Ans – Cleanup rule place at last of the security rule base, Its used to drop all traffic which not match with above rule and Logged. Cleanup rule mainly created for log purpose. In this rule administrator denied all the traffic and enable log.
Which of the applications in Check Point technology can be used to view who and what the administrator do to the security policy?
Ans-SmartView Tracker
What is NAT.
Ans- NAT stand for Network Address Translation. Its used to map private IP address with Public IP Address and Public IP address map with Private IP Address. Mainly its used for Provide Security to the Internal Network and Servers from Internet. NAT is also used to connect Internet with Private IP Address. Because Private IP not route able on Internet.
What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.
What is Hide NAT.
Ans – Hide NAT used to translate multiple private IP or Network with single public IP address. Means many to one translation. Its can only be used in source NAT translation. Hide NAT can not be used in Destination NAT.
What is Source NAT.
Ans- Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will translated in public IP address.
Difference between Automatic NAT and Manual NAT. Ans- Automatic NATAutomatic created by Firewall Can not modify Can not create “No NAT” rule Can not create Dual NAT Port forwarding not possible Proxy ARP by default enabled Manual NATManually Created by Network Security Administrator Can be Modify Can be Create “No NAT” rule Can be Create Dual NAT Port forwarding possible Proxy ARP by default not enable
What is 3 trier architecture component of Checkpoint Firewall.
Ans-
Smart Console.
Security Management.
Security Gateway.
What is the Packet Flow of Checkpoint firewall.
Ans-
SAM Database.
Address Spoofing.
Session Lookup.
Policy Lookup.
Destination NAT.
Route Lookup.
Source NAT.
Layer 7 Inspection.
VPN.
Routing.
What is Explicit rule In Checkpoint Firewall.
Ans-Its a rule in ruse base which is manually created by network security administrator that called Explicit rule.
Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.
What is VPN (Virtual Private Network).
Ans – VPN (Virtual Private Network) is used to create secure connection between two private network over Internet. Its used Encryption authentication to secure data during transmission.
There are two type of VPN
•Site to Site VPN.
•Remote Access VPN.
What is IP Sec.
Ans – IP Sec (IP Security) is a set of protocol. which is responsible for make secure communication between two host machine, or network over public network such as Internet. IPSec Protocol provide Confidentiality , Integrity, Authenticity and Anti Replay protection.
There is two IPSec protocol which provide security
1. ESP (Encapsulation Security Payload) and
2. AH (Authentication Header).
What is Difference between ESP and AH IPSec Protocol.
Ans - ESP – ESP Protocol is a part of IPsec suit , Its provide Confidentiality, Integrity and Authenticity. Its used in two mode Transport mode and Tunnel mode.
AH – Its is also part of a IPsec suit, Its provide only Authentication and Integrity, Its does not provide Encryption. Its also used to two mode Transport mode and Tunnel mode.
What is difference between standalone deployment distributed deployment.
Ans - Standalone deployment – In standalone deployment, Security Gateway and Security
management server installed on same Machine.
Distributed deployment – In Distributed deployment, Security Gateway and Security Management Server installed on different machine.
What is SIC.
SIC – SIC stand for “Secure Internal Communication”. Its a checkpoint firewall feature that is used to make secure communication between Checkpoint firewall component. Its used when Security Gateway and Security management server installed in Distributed deployment. Its Authentication and Encryption for secure communication.
What Advantage of NAT.
•Save Public IP to save cost.
•Security with hide Internal Network.
•Avoid Routing.
•Publish Server over Internet.
•Overlapping Network.
•Access Internet from Private IP address.
What is Smart Dashboard.
Ans– Its tool of smart console. Its used to Configure Rule, Policy object, Create NAT Policy, Configure VPN and Cluster.
What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.
Where you can view the results of the checkpoint?
Ans-You can view the results of the checkpoints in the Test Result Window.
Note: If you want to retrieve the return value of a checkpoint (a boolean value that indicates whether the checkpoint passed or failed) you must add parentheses around the checkpoint argument in the statement in the Expert View.
What’s the Standard Checkpoint?
Ans-Standard Checkpoints checks the property value of an object in your application or web page.
Which environment are supported by Standard Checkpoint?
Ans-Standard Checkpoint are supported for all add-in environments.
What’s the Bitmap Checkpoint?
Ans-Bitmap Checkpoint checks the bitmap images in your web page or application.
Which environments are supported by Image Checkpoint?
Ans-Image Checkpoint are supported only Web environment.
What’s the Table Checkpoints?
Ans-Table Checkpoint checks the information with in a table.
Which environments are supported by Table Checkpoint?
Ans-Table Checkpoints are supported only ActiveX environment.
What is Checkpoint Architecture?
Ans-Check Point has developed a Unified Security Architecture that is implemented throughout all of its security products. This Unified Security Architecture enables all Check Point products to be managed and monitored from a single administrative console, and provides a consistent level of security. The Check Point Unified Security Architecture is comprised of four main components:
Core Technologies: - Check Point uses a common set of core technologies, such as INSPECT for security inspection, across multiple layers of security.
Central Management: - All Check Point products can be managed and monitored from a single administrative console.
Open Architecture: - Check Point has built its security architecture to be open and interoperable in a heterogeneous environment. For example, Check Point products can interoperate with other network and security equipment from third-party vendors to enable cooperative enforcement of Security Policies.
Universal-update Ability: - Check Point has consolidated multiple security-alert and update functions to ease update procedures and help Administrators ensure that security is always upto-date.
server gets hack...
How Checkpoint Component communicate and Syns with each other?
Ans-Secure Internal Communications (SIC) is the Check Point feature that ensures components, such as Security Gateways, SmartCenter Server, SmartConsole, etc. can communicate with each other freely and securely using a simple communication-initialization process.
What are the major differences between SPLAT and GAIA?
Ans-Gaia is the latest version of Checkpoint which is a combination of SPLAT and IPSO. Here are some benefits of Gaia as compare to SPLAT/IPSO.
1. Web-Based user interface with Search Navigation
2. Full Software Blade support
3. High connection capacity
4. Role-Based administrative Access
5. Intelligent Software updates
6. Native IPv4 and IPv6 Support
7. ClusterXL or VRRP Clusters
8. Manageable Dynamic Routing Suite
9. Full Compatibility with IPSO and SecurePlatform.
How SIC work? What are the different ports of SIC?
Ans-Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers.
These security measures make sure of the safety of SIC:
1. Certificates for authentication
2. Standards-based SSL for the creation of the secure channel
3. 3DES for encryption
The Internal Certificate Authority (ICA)
The ICA is created during the Security Management server installation process. The ICA is responsible for issuing certificates for authentication. For example, ICA issues certificates such as SIC certificates for authentication purposes to administrators and VPN certificates to users and gateways.
Initializing the Trust Establishment Process
Communication Initialization establishes a trust between the Security Management server and the Check Point gateways. This trust lets Check Point components communicate securely. Trust can only be established when the gateways and the server have SIC certificates.
The Internal Certificate Authority (ICA) is created when the Security Management server is installed. The ICA issues and delivers a certificate to the Security Management server.
To initialize SIC:
1. Decide on an alphanumeric Activation Key.
2. In SmartDashboard, open the gateway network object. In the General Properties page of the gateway, click Communication to initialize the SIC procedure.
3. In the Communication window of the object, enter the Activation Key that you created in step 2.
4. Click Initialize.
The ICA signs and issues a certificate to the gateway. Trust state is Initialized but not trusted. The certificate is issued for the gateway, but not yet delivered.
SSL negotiation takes place. The two communicating peers are authenticated with their Activation Key.
The certificate is downloaded securely and stored on the gateway. After successful Initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate, signed by the same ICA. The Activation Key is deleted. The SIC process no longer requires the Activation Key, only the SIC certificates.
Checkpoint SIC Ports
PORT TYPE SERVICE DESCRIPTION 18209 tcp NGX Gateways <> ICAs (status, issue, or revoke). 18210 tcp Pulls Certificates from an ICA. 18211 tcp Used by the cpd daemon (on the gateway) to receive Certificates.
Checkpoint Packet flow for SNAT and DNAT?
Ans. In case of SNAT
Antispoofing Session lookup Policy lookup Routing Netting In case of DNAT Antispoofing Session lookup Policy lookup Netting
Routing
What is the main different between cpstop/cpstart and fwstop/fwstart?
Ans-Using cpstop and then cpstart will restart all Check Point components, including the SVN foundation. Using fwstop and then fwstart will only restart VPN-1/FireWall-1
What are the functions of CPD, FWM, and FWD processes?
Ans-CPD – CPD is a high in the hierarchical chain and helps to execute many services, such as Secure Internal Communication (SIC), Licensing and status report.
FWM – The FWM process is responsible for the execution of the database activities of the SmartCenter server. It is; therefore, responsible for Policy installation, Management High Availability (HA) Synchronization, saving the Policy, Database Read/Write action, Log Display, etc.
FWD – The FWD process is responsible for logging. It is executed in relation to logging, Security Servers and communication with OPSEC applications.
CHECKPOINT CLUSTER
Q.1 Which protocol use in Checkpoint for Clustering?
Q.2 How Cluster_XL works? What the ports used by Cluster_XL?
Q.3 What are the New and Legacy Mode in Clustering?
Q.4 What are Delta and Full Mode in Clustering?
Q.5 Step by Step Process of configuring Checkpoint Cluster?
Q.6 How to use VRRP for Checkpoint Clustering?
CHECKPOINT VPN
Q.1 Difference between IPSec and SSL VPN?
Q.2 Difference between Domain Base and Route Base VPN?
Q.3 What are the protocols of IPSec? And what are the Protocol numbers of IPSec Protocols.?
Ans. IPSec use two Protocols AH (Authentication Header) and ESP (Encapsulated Security Payload). AH works on Protocol number 51 and ESP works on Protocol number 50.
Q.4 What is NAT traversal? Where it used?
Q.5 How use NAT in VPN Tunnel?
Q.6 What is Norm in IPSec?
Q.7 What the Phases of IPSec VPN? And many messages being exchanged in MAIN and QUICK Mode? What are these messages?
Q.8 What is Encryption Domain?
Q.9 IPSec works at which OSI layer?
Ans. IP Layer (Network Layer and provide security services Network Layer and above).
What is Anti-Boat?
How to block ICMP tunnel in checkpoint?
Difference between fwstop and cpstop?
What are the services which impacted during cpstop and spstart?
What is CPinfo? And why it is used?
What are Cluster_XL, Secure_XL and CORE_XL?
What is Provider1?
What is MDF Database?
How to configure SMC HA?
How to check License via Smartview Monitor?
How to configure perform DNAT before routing via Global Properties?
No comments:
Post a Comment