Checkpoint QUANTUM SPARK 1500 Instruction Manual

31 August 2023
QUANTUM SPARK 1500,
1600, AND 1800
APPLIANCES
R81.10.X
Locally Managed
Administration Guide

Check Point Copyright Notice
© 2022 - 2023 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and distributed under
licensing restricting their use, copying, distribution, and decompilation. No part of this product or related
documentation may be reproduced in any form or by any means without prior written authorization of Check
Point. While every precaution has been taken in the preparation of this book, Check Point assumes no
responsibility for errors or omissions. This publication and features described herein are subject to change
without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)
(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR
52.227-19.
TRADEMARKS:
Refer to the Copyright page for a list of our trademarks.
Refer to the Third Party copyright notices for a list of relevant copyrights and third-party licenses.

Important Information
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|3
Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date with the
latest functional improvements, stability fixes, security enhancements and protection against
new and evolving attacks.
Certifications
For third party independent certification of Check Point products, see the Check Point
Certifications page.
Check Point Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X
Locally Managed Administration Guide
Latest Version of this Document in English
Open the latest version of this document in a Web browser.
Download the latest version of this document in PDF format.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments.

Important Information
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|4
Revision History
Date Description
31 August 2023 Added new content for R81.10.08
18 May 2023 Added new content for R81.10.07
09 May 2023 Updated "Configuring the Routing Table" on page129
06 March 2023 Merged the information about R81.10.00 and R81.10.05 into a single document
Updated:
n
"Configuring High Availability" on page138
n
"Configuring VPN Sites" on page248
15 February 2023 Updated "Configuring the Remote Access Blade" on page222
24 January 2023 First release of this document

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|5
Table of Contents
Overview of Quantum Spark 1500, 1600, and 1800 Appliance Series 15
1500 Appliances 15
1600 and 1800 Appliances 15
Getting Started with 1500, 1600, and 1800 Appliance Series 17
Setting Up the Quantum Spark Appliance 19
Using Default WiFi 19
First Time Deployment Options 21
Zero Touch Cloud Service 22
Deploying from a USB Drive or SD Card 23
Sample Configuration File 23
Preparing the Configuration Files 23
Deploying the Configuration File - Initial Configuration 24
Deploying the Configuration File - Existing Configuration 25
Viewing Configuration Logs 25
Troubleshooting Configuration Files 26
Configuration File Error 26
Suggested Workflow - Configuration File Error 26
Sample Configuration Log with Error 27
Using the set property Command 27
Configuration and Upgrade Scenarios 28
Configuring Cloud Services 28
Configuring a Guest Network 29
Introduction to the WebUI 30
The Home Tab 31
Viewing System Information 31
Controlling and Monitoring Software Blades 33
Setting the Management Mode 35
Configuring Cloud Services 37
Managing Licenses 40
Viewing the Site Map 42
Notifications 42
Managing Active Devices 44
Blocking a Device Temporarily 44

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|6
Toobar Buttons 44
Revoking the Hotspot Access 45
Adding a New Network Object to Bypass SSL Inspection Based on the Host MAC Address 45
Viewing Monitoring Data 46
Network 46
Troubleshooting 47
Viewing Reports 48
Using System Tools 50
Managing the Device 54
Configuring Internet Connectivity 54
The Configuration tab 55
Prefix Delegation (IPv6 only) 58
Neighbor Discover Protocol (ND Proxy) - IPv6 only 59
DS-Lite (Dual Stack Lite, IPoE) 60
IPIP 61
Creating a New Bond (WAN) 63
Configuring a USB Cellular Connection 64
Configuring a Cellular Internet Connection (Cellular models only) 64
Linking the APN to a SIM card based on a specific MMCNMC number 65
Switching the Active Image 66
The Connection Monitoring tab 68
The Advanced tab 69
Monitoring 71
Configuring the Wireless Network 74
Dynamic Frequency Selection (DFS) 75
Cloning a VAP 76
Additional Configurations 76
Wireless Scheduler 79
Wi-Fi Quality Analyzer 80
Configuring the Local Network 82
Reserved IP Address for Specific MAC 83
Switch 83
WAN as LAN 84
Monitor Mode 85
Mirror Port 87

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|7
Physical Interfaces 87
Bridge 89
VLANs 91
Alias IP 91
VPN Tunnel (VTI) 92
Virtual Access Point (VAP) 93
GRE 94
BOND 95
Configuring a Hotspot 97
User Authentication 99
Disabling the Hotspot 99
Configuring MAC Filtering 100
802.1x Authentication Protocol 101
Configuring the DNS Server 103
Configuring the Proxy Server 104
Backup, Restore, Upgrade, and Other System Operations 105
Using the Software Upgrade Wizard 107
Welcome 107
Upload Software 108
Upgrade Settings 108
Upgrading 108
Backing up the System 108
Configuring Local and Remote System Administrators 110
Administrator Roles: 110
Local Administrators 110
Remote Administrators 112
Pairing a Mobile Device 113
Configuring a RADIUS Server for non-local Quantum Spark Appliance users 113
Configuring Administrator Access 117
Managing Device Details 119
Managing Date and Time 120
Configuring DDNS and Access Service 121
DDNS 121
Reach My Device 121
Remote Access to the WebUI 122

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|8
Remote Access to the CLI 122
Using System Tools 123
Advanced Routing 127
BGP 127
OSPF 127
Inbound Route Filters 127
Route Redistribution 128
Routing Options 128
Routing Monitor 128
Configuring the Routing Table 129
Background 129
Routing Table Columns 130
Limitations 130
Adding a Specific IPv4 Static Route 131
Adding a Default IPv4 Static Route 133
Editing an Existing Static Route 134
Deleting an Existing Static Route 134
Enabling or Disabling an Existing Static Route 135
Managing Installed Certificates 135
Managing Internal Certificates 137
Configuring High Availability 138
Background 138
Limitations 139
Prerequisites 139
Configuration Workflow 140
Configuring a Primary Cluster Member 141
Configuring a Secondary Cluster Member 142
Viewing Cluster Interfaces 143
Viewing the Cluster Status 145
Failing Over Manually 145
Changing Network Configuration of Cluster Members 146
Resetting Cluster Configuration 146
Upgrading a Cluster Manually 147
Cluster Managed by Quantum Spark Portal 148
Advanced Settings 149

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|9
Filtering the List of Attributes 149
Configuring the Attribute Values 149
Restoring Default Values 149
Clarifications 150
Changes Between Versions 150
Managing the Access Policy 152
Configuring the Firewall Access Policy and Blade 152
Firewall Policy 153
Application & URL Filtering 154
Updates 155
User Awareness 156
Tracking 157
More Information 157
Working with the Firewall Access Policy 158
Firewall Policy 158
Configuring Access Rules 160
Updatable Objects 162
Customizing Messages 162
Defining Firewall Servers 164
Defining NAT Control 167
Advanced - Creating and Editing NAT Rules 172
Inspecting VoIP Traffic 175
Introduction 175
Configuration 177
Smart Accel 177
Configuring Smart Accel in R81.10.05 and higher 178
Smart Accel for Services 178
Smart Accel for Assets 178
Configuring Smart Accel in R81.10.00 179
Working with User Awareness 180
Workflow 180
Identity Sources 180
Enabling User Awareness 181
Active Directory Queries: 181
Browser-Based Authentication 182

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|10
Identity Collector 183
Configuring QoS 184
Introduction 184
Prerequisites 184
Configuration 184
Configuring the QoS Blade 185
QoS 185
QoS Default Policy 186
Configuring the QoS Policy 187
SSL Inspection Policy 190
SSL Inspection 190
Deploying SSL Inspection 190
SSL Inspection Bypass Policy 191
HTTPS Categorization 192
SSL Inspection Exceptions 193
SSL Inspection Advanced 194
Managing Threat Prevention 195
Configuring Threat Prevention Blade Control 195
Enabling and Disabling Threat Prevention 195
Enabling Threat Emulation Policy for the FTP Protocol 195
Configuring a Custom Policy for Threat Prevention 196
Scheduling Threat Prevention Updates 197
Configuring Threat Prevention Policy Exceptions 198
Threat Prevention Exceptions 198
allowlists 199
Threat Prevention - Horizon SOC 199
Viewing Infected Devices 201
Viewing the IPS Protections List 204
Advanced Threat Prevention Engine Settings 205
IPS 205
Anti-Virus 205
Anti-Bot 207
Threat Emulation 208
User Messages 209
Configuring the Anti-Spam Blade Control 211

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|11
Configuring Anti-Spam Exceptions 213
SSH Authentication 213
Managing VPN 216
Configuring VPN 217
Configuring Remote Access VPN 217
Introduction 217
Prerequisites 217
Remote Access Configuration 217
L2TP VPN Client configuration 218
Configuring Site to Site VPN with a Preshared Secret 219
Introduction 219
Prerequisites 219
Configuration 219
Monitoring 219
Configuring Site to Site VPN with a Certificate 219
Introduction 219
Prerequisites 219
Configuration 220
Trust Procedures 220
Monitoring VPN 221
Configuring the Remote Access Blade 222
Getting Started with VPN Remote Access 223
Advanced options 231
Changing the Default Remote Access VPN Port 231
Connections Between Remote Access VPN Clients in the Same Office Mode Pool 232
Configuring Remote Access Users 234
Remote Access - Connected Remote Users 238
Configuring Remote Access Authentication Servers 239
Configuring Advanced Remote Access Options 242
Office Mode 242
DNS Servers for Remote Access users 243
DNS Domain Name 243
SSL VPN bookmarks 244
Configuring the Site to Site VPN Blade 245
Harmony Connect 247

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|12
Configuring VPN Sites 248
Configuring Advanced Site to Site Community Settings 254
Viewing VPN Tunnels 255
Configuring Advanced Site to Site Settings 256
Configuring a Local Encryption Domain 256
Configuring the Appliance Interfaces 257
Tunnel Health Monitoring 258
Managing Trusted CAs 259
Managing Installed Certificates 261
Managing Internal Certificates 263
Managing Users and Objects 265
Working with User Awareness 265
Workflow 265
Identity Sources 265
Enabling User Awareness 266
Active Directory Queries: 266
Browser-Based Authentication 267
Identity Collector 268
Configuring Local Users and User Groups 269
Configuring Local and Remote System Administrators 271
Administrator Roles: 271
Local Administrators 271
Remote Administrators 273
Pairing a Mobile Device 274
Configuring a RADIUS Server for non-local Quantum Spark Appliance users 274
Managing Authentication Servers 278
RADIUS Server 279
TACACS+ Server 281
Active Directory 282
Managing Applications & URLs 285
Managing System Services 287
Managing Service Groups 290
Managing Network Objects 292
Managing Network Object Groups 296
Logs and Monitoring 298

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|13
Viewing Security Logs 298
Viewing System Logs 300
Configuring External Log Servers 301
External Check Point Log Server 301
Syslog Server Configuration 302
Secured Syslog 303
Notifications 304
Managing Active Devices 304
Blocking a Device Temporarily 304
Toobar Buttons 304
Revoking the Hotspot Access 305
Adding a New Network Object to Bypass SSL Inspection Based on the Host MAC Address 305
Wireless Active Devices 306
Paired Mobile Devices 306
Viewing Infected Devices 306
Viewing VPN Tunnels 307
Viewing Active Connections 308
Access Points 309
Viewing Monitoring Data 309
Viewing Reports 309
Dr. Spark 309
Using System Tools 312
SNMP 316
SNMP Traps Receivers 317
SNMP Traps 317
SNMPTraps for VPNTunnels 317
SNMP Traps for Hardware Sensors 317
Advanced Configuration 319
Upgrade Using a USB Drive 319
Upgrade Using an SD Card 320
Boot Loader 321
Upgrade Using Boot Loader 322
Restoring Factory Defaults 323
Custom Default Image 325
Fonic Bypass 325

Table of Contents
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|14
Configuring Bypass mode in the WebUI 326
Configuring Bypass mode in Gaia Clish 326
RESTful API 327
Enabling and disabling the REST API 327
Request Structure 327
Response Structure 328
Versioning 328
REST API Commands 329
(1) Login 329
(2) Logout 330
(3) Generate-Report 330
(4) Run-Clish-Command 331

Overview of Quantum Spark 1500, 1600, and 1800 Appliance Series
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|15
Overview of Quantum Spark 1500,
1600, and 1800 Appliance Series
1500 Appliances
Quantum Spark 1500 appliance series includes the 1530, 1550, 1570, 1590, and 1570R appliances. These
appliances support the Check Point Software Blade architecture and provide independent modular security
building blocks. You can quickly enable and configure the Software Blades to meet your specific security
needs. The 1535, 1555, 1575 and 1595 and 1595R appliances, which support WiFi6 and 5G, are
available.starting from R81.10.05.
Quantum Spark 1500 appliances deliver integrated unified threat management to protect your organization
from today's emerging threats. Based on proven Check Point security technologies such as Stateful
Inspection, Application Intelligence, and Security Management Architecture, the appliances provides
simplified deployment while delivering uncompromising levels of security.
These appliances run an embedded version of the Gaia operating system. The appliances include core
configuration elements such as Gaia Clish interface, SNMPv2/v3 and routing stack implementations. In
addition to the Gaia features, Gaia Embedded operating system contains support for built-in network
switches, wireless networks, 4G LTE Internet connectivity, multiple Internet connections (more than 2) in
High Availability or Load Sharing mode, Policy Based Routing, and DDNS support. Quick deployment with
USB is supported for all appliances, and with SD card and Dual SIM card for the 1570 / 1590 appliances.
This guide describes all aspects that apply to the Quantum Spark 1530 / 1550, 1570R, and 1570 / 1590
Appliances.
1600 and 1800 Appliances
The Quantum Spark 1600 / 1800 Security Appliances, part of the new 1600 / 1800 Appliance family, deliver
enterprise-grade security, run the R81.10 code base in an all-in-one security solution to protect Medium
Business employees, network and data from cyber-theft.
The 1600 / 1800 Security Gateways offer integrated, multi-layered security in a 1U form factor, a high
performance platform which is easy and simple to configure and manage. The Security Gateway offers
firewall, VPN, Anti-Virus, Application Visibility and Control, URL Filtering, Email Security, and SandBlast
Zero-Day Protection.
Quantum Spark 1600 / 1800 Security Appliances can be managed either locally in a Web interface, or
centrally by means of a cloud-based Quantum Spark Security Management Portal (Quantum Spark Portal).
Appliance Model Appliance Homepage
1800 V-83 (wired only) sk168880
1600 V-82 (wired only) sk168880
1570R V-81R, V-81WLR sk166654
1595R V91R, V91RC sk157412

Overview of Quantum Spark 1500, 1600, and 1800 Appliance Series
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|16
Appliance Model Appliance Homepage
1575 / 1595 V91, V91W, V91WC sk157412
1570 / 1590 V-81 Wired, V-81W WiFi, V-81WL WiFi-
LTE, V-81WD WiFi-DSL
sk157412
1535 / 1555 V91, V91W, V91WC
V-80*, V90W
sk157412
1530 / 1550 V-80 Wired, V-80W WiFi sk157412
For front, side, and back panel details for each appliance, see the relevant Getting Started Guide :
n
Getting Started Guide for 1600 / 1800 Appliances
n
Getting Started Guide for 1595R Appliances
n
Getting Started Guide for 1570R Appliances
n
Getting Started Guide for 1575 / 1595 Appliances
n
Getting Started Guide for 1570 / 1590 Appliances
n
Getting Started Guide for 1535 / 1555 Appliances
n
Getting Started Guide for 1530 / 1550 Appliances
Review these materials before doing the procedures in this Administration Guide:
nHome Page for your version:
lR81.10.08 Home Page
l
R81.10.07 Home Page
l
R81.10.05 Home Page
l
R81.10.00 Home Page
lR81.10.X Known Limitations and Resolved Issues
n
Quantum Spark R81.10.X Release Notes for 1500, 1600, 1800 Appliances
n
Quantum Spark R81.10.X Known Limitations and Resolved Issues
n
Small Business Cyber Security video channel
Note - Some topics only apply to specific appliances or models.

Getting Started with 1500, 1600, and 1800 Appliance Series
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|17
Getting Started with 1500, 1600, and
1800 Appliance Series
This Administration Guide describes:
nInstalling the appliance and connecting the cables.
nConfiguring Security Policies.
nConfiguring local users and administrators.
nConfiguring VPN.
nConfiguring a cluster.
nConfiguring advanced settings.
nLogging and monitoring.
Workflow:
1. Install the Quantum Spark appliance and connect all cables.
See the:
n
Getting Started Guide for 1600 / 1800 Appliances .
n
Getting Started Guide for 1570R Appliances .
n
Getting Started Guide for 1570 / 1590 Appliances .
n
Getting Started Guide for 1530 / 1550 Appliances .
n
"Setting Up the Quantum Spark Appliance" on page19 .
2. Follow the applicable First Time Deployment option.
See "First Time Deployment Options" on page21 .
3. Install the required licenses.
See "Managing Licenses" on page40
4. Configure the required users and objects.
See "Managing Users and Objects" on page265 .
5. Configure required appliance settings.
See "Managing the Device" on page54 .
6. Configure and install the required Security Policies.
See:
n
"Managing the Access Policy" on page152 .
n
"Managing Threat Prevention" on page195 .
7. Make sure the appliance works as required.

Getting Started with 1500, 1600, and 1800 Appliance Series
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|18
See "Logs and Monitoring" on page298 .
8. Configure other required settings, such as:
nVPN (see
"Configuring VPN" on page217 and "Managing VPN" on page216 ).
nClusters (see
"Configuring High Availability" on page138 ).
nQoS (see
"Configuring QoS" on page184 ).

Setting Up the Quantum Spark Appliance
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|19
Setting Up the Quantum Spark
Appliance
To set up the Quantum Spark 1530 / 1550, 1570 / 1590, 1570R, 1600, and 1800 Appliance:
1. Remove the Quantum Spark Appliance from the shipping carton and place it on a tabletop.
2. Identity the network interface marked as LAN1.
This interface is preconfigured with the IPv4 Address 192.168.1.1 and Subnet Mask 255.255.255.0.
Connecting the Cables:
1. Connect the power cable to the appliance. The appliance is connected directly to the power source.
1530 / 1550 appliances only: Turn on the power switch located on the back panel.
2. When the appliance is turned on, the Power LED on the front panel lights up in red for a short period.
The LED then turns blue and starts to blink. This shows a boot is in progress and firmware is being
installed.
When the LED turns a solid blue, the appliance is ready for login.
Note - The LED is red if there is an alert or error.
nIf you use an external modem:
Connect the Ethernet cable to the WAN port on the appliance back panel and plug it into your
external modem or router's PC/LAN network port. The Internet LED on the appliance front
panel lights up when the Ethernet is connected.
nIf you do not use an external modem:
Connect the telephone cable to the DSL port on the appliance back panel and plug it into the
DSL line socket. The DSL LED as well as the Internet Link LED remains off until you configure
the appliance, including setting up the DSL as an internet connection.
3. Connect the standard network cable to the LAN1 port on the appliance and to the network adapter on
your PC.
Note - Wait 10 seconds between power cycles (off and on).
Using Default WiFi
Starting in version R81.10.07, you can use the default SSID for a WiFi connection.

Setting Up the Quantum Spark Appliance
Quantum Spark 1500, 1600, and 1800 Appliances R81.10.X Locally Managed Administration Guide|20
Note -
nThis option is only available when connecting the appliance for the first time and the First
Time Configuration Wizard did not yet run.
nOnly available for one hour.
1. Connect the appliance cable and the WAN cable.
2. Use the SSID and password printed on the appliance sticker to connect to WiFi.
Note - Skip this step if you are connecting through LAN.
3. Browse to default gateway IP address: https://192.168.1.1:4434
The Welcome screen of the First Time Configuration Wizard appears.
4. Click Fetch Settings from the Cloud.
5. In the new window, click Yes to confirm that you want to proceed.
6. The Internet connection page of the First Time Configuration Wizard
7. From the Connection type drop-down menu, select Static IP.
8. Click Connect.
The One Touch status bar is running.
Note - If you were connected to WiFi: After the One Touch script finishes running, the WiFi
network you were connected to is deleted. As a result, you are disconnected from the appliance.