Checkpoint M2 User manual

The NGX platform delivers a unified
security architecture for Check Point.
Network Security
Check Point network security
solutions are the market-
leading choice for securing the
network infrastructure.
Check Point Integrated
Appliance Solutions
Customized security appliances for your
unique security needs
PRODUCT BENEFITS
nDesigned to meet an organization’s
specific needs
nDelivers high performance platform
for security
nReduces hardware and operational costs
nProvides a single point of contact for
hardware, software, and support
Check Point Integrated Appliance Solutions enable IT departments to design
a total security solution tailored to meet specific needs, by combining proven
Check Point security software solutions with high performance hardware based
on IBM System xSeries servers and BladeCenter platforms. Integrated and
supported by Check Point, these solutions fit an organization’s every need and
compliment other Check Point appliances, such as UTM-1™and Power-1™
and enables the development of an enterprise-wide security infrastructure.
Integrated Appliance Solutions also work seamlessly with solutions from Check
Point appliance partners and certified open servers to deliver ultimate flexibility
in architecting security throughout the enterprise.
CUSTOM-DESIGNED TO MEET YOUR NEEDS
Check Point can help you design specific security systems that match your
architectural and security policy vision. By matching the appropriate Check
Point software with the appropriate platform, Check Point can provide you with
the flexibility to create customized security solutions designed to meet your
specific security needs—ranging from remote offices to large data centers or
telecom central offices.
VPN-1 Gateway
VPN-1 Power VSX
Connectra
IPS-1
Provider-1
SmartCenter
Rack-based
server
Blade-based
chassis
Custom
component
selection
++Integrated
Appliance
Solution
Each Integrated Appliance represents a customer’s vision for meeting
the organization’s security needs.

Check Point Integrated Appliance Solutions
puresecurity™
puresecurity™
The foundation of the Integrated Appliance Solutions is
the M series of pre-defined platforms. Choose from Check
Point software such as VPN-1®UTM, VPN-1 Power, and the
VPN-1 Power VSX™virtualized security services platform, as
well as Connectra®SSL VPN, SmartCenter™management,
and Provider-1®for management of large deployments with
separate security domains. You can also modify the default
hardware specifications of the M series to build a fully cus-
tomized platform. Check Point then integrates the software
and hardware into a single, certified solution for simple, effec-
tive deployment within your network.
STANDARDIZATION FOR LOWER SECURITY TOTAL
COST OF OWNERSHIP
With the Integrated Appliance Solutions, you can take advan-
tage of the benefits of customization and standardization.
You work with Check Point to tailor Check Point applications
and hardware components, and then finalize them into a
standard corporate security platform. Then create a single
support and procurement methodology that significantly
simplifies management overhead. This allows your customer
engineering teams the ability to save certification time and
work on new projects, procurement to build economies of
scale that reduce costs, and management to develop
standard operating procedures that improve service quality
and compliance.
HIGH SECURITY, HIGH PERFORMANCE
Because the Integrated Appliance Solutions are built
around the latest hardware innovations such as multi-core
processors, you can deploy to a higher level of security.
Organizations can activate strict intrusion prevention policies
with SmartDefense™with multi-gigabit performance levels.
And as Check Point updates its software, expect to see per-
formance improve without requiring hardware upgrades.
THE SIMPLICITY YOU WANT
Check Point provides total support for the Integrated
Appliance Solutions, including three levels of global advance
replacement determined by support level and location.
SmartDefense Services, an optional subscription, provides
the latest updates for SmartDefense integrated intrusion
prevention capabilities, delivering always up-to-date
threat mitigation.
Protection Details M2 M6 M8
Firewall
Protocol/application support 200-plus total 444
VoIP protection Sip, H.323, MGCP, and SIP with NAT support 444
Instant messaging control MSN, Yahoo, ICQ, and Skype (including over
HTTP and SSL) 444
Peer-to-peer blocking Kazaa, GNUTella, BitTorrent, eMule, IRC
(including over HTTP) 444
Network Address Translation Static/hide NAT support with manual or
automatic rules 444
IPSec VPN
Encryption support AES 128-256 bit, 3DES 56-168 bit 444
Authentication methods Password, RADIUS, TACACS, X.509, SecurID 444
Certificate authority Integrated X.509 certificate authority 444
VPN communities Automatically sets up site-to-site connections as
objects are created 444
Topology support Star and mesh 444
Route-based VPN Utilizes Virtual Tunnel Interfaces, numbered/
unnumbered interfaces 444
VPN client Check Point Endpoint Security™, VPN-1®
SecureClient™, VPN-1 SecuRemote 444
SSL VPN
SSL-based remote access Fully integrated SSL VPN gateway provides
on-demand SSL-based access Optional Optional Optional
SSL-based endpoint scanning Scans endpoint for compliance/malware prior to
admission to the network Optional Optional Optional
Continued on page 3
INTEGRATED APPLIANCE SOLUTION M SERIES SECURITY SPECIFICATIONS

puresecurity™
Customized security appliances
for your unique security needs
puresecurity™
Protection Details M2 M6 M8
Intrusion prevention
Network-layer protection Blocks attacks such as DoS, Port Scanning,
IP/ICMP/TCP-related 444
Application-layer protection Blocks attacks such as DNS cache poisoning,
FTP bounce, improper commands, and more 444
Detection methods Signature-based and protocol anomaly 444
UTM functionality
Antivirus protection Protects HTTP, FTP, POP3, and SMTP protocols 4Optional Optional
Anti-spyware blocks Pattern-based spyware blocks at the gateway 4Optional Optional
Web filtering 20 million-plus URLs covering three billion-plus
Web pages and more than 70 languages 4Optional Optional
Pattern-based and IP reputation
checking anti-spam
Detects spam based on dynamic database
of signatures 4Optional Optional
Updates Centralized, daily updates 4Optional Optional
Networking
Dynamic routing support OSPF, BGP, RIP v1/2, Multicast 444
DHCP support SecurePlatform™DHCP server and Relay 444
Layer-2 bridge support Transparently integrates into existing network 444
ISP redundancy Protocol-based, source/destination, and port
route decisions 444
Performance and availability
High availability Active/passive and active/active 444
Load balancing Integrated ClusterXL®Smart Load Balancing 444
Quality of Service (QoS) FloodGate-1®for granular QoS 444
ISP redundancy Automatically reroutes traffic to second interface 444
Traffic acceleration SecureXL™accelerates security decisions Optional 4 4
Multi-core acceleration CoreXL™balances security decisions across
multiple cores Optional 4 4
M2 M6 M8
Firewall throughput 4.5 Gbps 8 Gbps 12 Gbps
Concurrent sessions 900,000 1.1 million 1.1 million
HTTP connections/second 40,000 50,000 60,000
VLANs 256 256 256
CPU 1 x 5405 (2.0GHz QC) 1 x 5420 (2.5 GHZ QC) 2 x 5420 (2.5GHZ QC)
Standard memory 2 GB 4 GB 4 GB
Storage capacity 2 x 73 GB 2 x 73 GB 2 x 73 GB
1 gigabit (10/100/1000)
interfaces 4/10 10/10 14/18
Enclosure 1U 1U 2U
Power input 100~240V, 50~60Hz 100~240V, 50~60Hz 100~240V, 50~60Hz
Power consumption 350W (max.) 350W (max.) 835W (max.)
Operating environment range Temperature: 5oto 40oC, Humidity: 10%-85% non-condensing, Altitude: 2,500m
Safety and emissions NOM, IEC 60950, UL 60950, CSA 22.2 No 60950, FCC Part 15, ICES-003 Class A, BSMI,
CISPR 22 Class B, VCCI Class ITE, IEC 60950, CCEE
Certifications ISCA (firewall, VPN), VPNC, FIPS 140-2, Under evaluation for EAL 4 augmented
Continued on page 4
INTEGRATED APPLIANCE SOLUTION M SERIES SECURITY SPECIFICATIONS (CONTINUED)
INTEGRATED APPLIANCE SOLUTION M SERIES HARDWARE SPECIFICATIONS

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point, AlertAdvisor, Application Intelligence, Check Point Endpoint Security, Check Point Endpoint Security On
Demand, Check Point Express, Check Point Express CI, the Check Point logo, ClusterXL, Confidence Indexing, ConnectControl, Connectra, Connectra Accelerator Card, Cooperative Enforcement,
Cooperative Security Alliance, CoreXL, CoSa, DefenseNet, Dynamic Shielding Architecture, Eventia, Eventia Analyzer, Eventia Reporter, Eventia Suite, FireWall-1, FireWall-1 GX, FireWall-1 SecureServer,
FloodGate-1, Hacker ID, Hybrid Detection Engine, IMsecure, INSPECT, INSPECT XL, Integrity, Integrity Clientless Security, Integrity SecureClient, InterSpect, IPS-1, IQ Engine, MailSafe, NG, NGX, Open
Security Extension, OPSEC, OSFirewall, Pointsec, Pointsec Mobile, Pointsec PC, Pointsec Protector, Policy Lifecycle Management, Provider-1, PureAdvantage, PURE Security, the puresecurity logo,
Safe@Home, Safe@Office, SecureClient, SecureClient Mobile, SecureKnowledge, SecurePlatform, SecurePlatform Pro, SecuRemote, SecureServer, SecureUpdate, SecureXL, SecureXL Turbocard,
Security Management Portal, Sentivist, SiteManager-1, SmartCenter, SmartCenter Express, SmartCenter Power, SmartCenter Pro, SmartCenter UTM, SmartConsole, SmartDashboard, SmartDefense,
SmartDefense Advisor, Smarter Security, SmartLSM, SmartMap, SmartPortal, SmartUpdate, SmartView, SmartView Monitor, SmartView Reporter, SmartView Status, SmartViewTracker, SMP, SMP
On-Demand, SofaWare, SSL Network Extender, Stateful Clustering, TrueVector, Turbocard, UAM, UserAuthority, User-to-Address Mapping, UTM-1, UTM-1 Edge, UTM-1 Edge Industrial, UTM-1
Total Security, VPN-1, VPN-1 Accelerator Card, VPN-1 Edge, VPN-1 Express, VPN-1 Express CI, VPN-1 Power, VPN-1 Power Multi-core, VPN-1 Power VSX, VPN-1 Pro, VPN-1 SecureClient, VPN-1
SecuRemote, VPN-1 SecureServer, VPN-1 UTM, VPN-1 UTM Edge, VPN-1 VSX, Web Intelligence, ZoneAlarm, ZoneAlarm Anti-Spyware, ZoneAlarm Antivirus, ZoneAlarm ForceField, ZoneAlarm
Internet Security Suite, ZoneAlarm Pro, ZoneAlarm Secure Wireless Router, Zone Labs, and the Zone Labs logo are trademarks or registered trademarks of Check Point Software Technologies Ltd.
or its affiliates. ZoneAlarm is a Check Point Software Technologies, Inc. Company. All other product names mentioned herein are trademarks or registered trademarks of their respective owners. The
products described in this document are protected by U.S. Patent No. 5,606,668, 5,835,726, 5,987,611, 6,496,935, 6,873,988, 6,850,943, and 7,165,076 and may be protected by other U.S. Patents,
foreign patents, or pending applications.
June 4, 2008 P/N 503060
Worldwide Headquarters
5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: [phone] | Fax: [phone] | Email: [email protected]
U.S. Headquarters
800 Bridge Parkway, Redwood City, CA 94065 | Tel: [phone] | Fax: [phone] | www.checkpoint.com
CONTACT CHECK POINT
Additional hard disk drive options
CPAP-APXL-DDM1 IBM 73 GB 15K-RPM Ultra320 SAS Hot-Swap Disk Drive
CPAP-APXL-DDL1 IBM 300 GB 15K-RPM Ultra320 SAS Hot-Swap Disk Drive
Additional NIC options
CPAP-APXL-DLN2 Intel Pro 1000 PF Dual Port Gigabit Copper Ethernet Adapter
CPAP-APXL-FRN1 Intel Pro 1000 PF Single Port Gigabit Fiber Adapter
CPAP-APX-DFBR Intel Pro/1000 PF Dual Port Fiber Server Adapter
CPAP-APXL-QDN4 Intel Pro/1000 PT Quad Port Server Adapter
CPAP-APXL-QFBR Intel Pro/1000 PF Quad Port Fiber Server Adapter
CPAP-APXL-SPTG Single Port 10 Gb Server Adapter
Additional power options
CPAP-APXL-RDPR Redundant power supply unit for M2 and M6 platform
Additional memory options
CPAP-APXL-MEM2 Additional memory upgrades (2 GB 2 x 1 Gig)
CPAP-APXL-MEM4 Additional memory upgrades (4 GB 2 x 2 Gig)