Checkpoint R80.20 User manual

28 December 2020
Guide
NEXT GENERATION
SECURITY GATEWAY
R80.20
Classification: [Protected]

C H A P TE R 1
2020 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part
of this product or related documentation may be reproduced in any form or by any means without
prior written authorization of Check Point. While every precaution has been taken in the
preparation of this book, Check Point assumes no responsibility for errors or omissions. This
publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page https://www.checkpoint.com/copyright/ for a list of our trademarks.
Refer to the Third Party copyright notices
https://www.checkpoint.com/about-us/third-party-trademarks-and-copyrights/ for a list of
relevant copyrights and third-party licenses.

Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date
with the latest functional improvements, stability fixes, security enhancements and
protection against new and evolving attacks.
Certifications
For third party independent certification of Check Point products, see the Check Point
Certifications page
https://www.checkpoint.com/products-solutions/certified-check-point-solutions/.
Check Point R80.20
For more about this release, see the R80.20 home page
http://supportcontent.checkpoint.com/solutions?id=sk122485.
Latest Version of this Document
Open the latest version of this document in a Web browser
https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_
NextGenSecurityGateway_Guide/html_frameset.htm.
Download the latest version of this document in PDF format
http://downloads.checkpoint.com/dc/download.htm?ID=61492.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments
mailto:[e-mail]?subject=Feedback on Next Generation
Security Gateway R80.20 Guide.
Revision History
Date Description
Updated:
Important:
•Load Sharing modes are only supported with the required R80.20
Jumbo Hotfix Accumulator. For instructions, see sk162637
https://supportcontent.checkpoint.com/solutions?id=sk162637.
•To upgrade a ClusterXL that works in a Load Sharing mode from a
lower version to R80.20, follow these steps in the same
maintenance window:
a) Upgrade the ClusterXL to R80.20.
b) Install the required R80.20 Jumbo Hotfix Accumulator. For
instructions, see sk162637
https://supportcontent.checkpoint.com/solutions?id=sk162637.

Date
Description
28 December 2020 Updated fw up_execute (on page 517)
28 October 2019 Updated:
•Load-Balancing Methods (on page 293) - "Domain" and "Round Trip"
load balancing methods are not supported for Logical Servers
22 September 2019 Added to the applicable topics:
Warning -The R80.20 ClusterXL does
not support the Load Sharing
modes (R80.20 Known Limitation MB-30)
26 March 2019 Updated:
•IPS Updates (on page 185)
•Kernel Debug Syntax (on page 557) - added information about the
unified log file
Added:
•Automatically Saving Messages During a Crash
28 November 2018 Updated:
•Working with Kernel Parameters on Security Gateway (on page 547)
•Kernel Debug on Security Gateway (on page 557)
27 November 2018 Updated:
•Command Line Reference (on page 312) (added syntax for
commands)
Added:
•Working with Kernel Parameters on Security Gateway (on page 547)
•Kernel Debug on Security Gateway (on page 557)
04 October 2018 Improved formatting and document layout for HTML guide
26 September 2018 First release of this document

Important Information
Next Generation Security Gateway Guide R80.20 | 5
SmartConsole Toolbars
For a guided tour of SmartConsole, click What's New in the left bottom corner of SmartConsole.
Global Toolbar (top left of SmartConsole)
Description and Keyboard Shortcut
The main SmartConsole Menu
The Objects menu.
Also leads to the Object Explorer Ctrl+E
Install policy on managed gateways
Ctrl+Shift+Enter
Navigation Toolbar (left side of SmartConsole)
Description and Keyboard Shortcut
Gateways & Servers configuration view
Ctrl+1
Security Policies Access Control view
Security Policies Threat Prevention view
Ctrl+2
Logs & Monitor view
Ctrl+3
Manage & Settings view - review and configure the Security Management
Server settings
Ctrl+4
Command Line Interface Button (left bottom corner of SmartConsole)
Description and Keyboard Shortcut
Open a command line interface for management scripting and API
F9
What's New Button (left bottom corner of SmartConsole)
Description and Keyboard Shortcut
Open a tour of the SmartConsole
Objects and Validations Tabs (right side of SmartConsole)
Description
Objects Manage security and network objects
Validations Validation warnings and errors

Important Information
Next Generation Security Gateway Guide R80.20 | 6
System Information Area (bottom of SmartConsole)
Description
Task List Management activities, such as policy installation tasks
Server Details The IP address of the Security Management Server
Connected
Users
The administrators that are connected to the Security Management Server

Contents
Important Information ......................................................................................................3
SmartConsole Toolbars................................................................................................5
Terms...............................................................................................................................16
Check Point Next Generation Security Gateway Solution .............................................18
Overview of Firewall Features ...................................................................................18
How to Use this Guide .................................................................................................18
Components of the Check Point Firewall Solution....................................................20
Mirror and Decrypt..........................................................................................................21
Introduction to Mirror and Decrypt ............................................................................21
Mirror and Decrypt Requirements.............................................................................24
Configuring Mirror and Decrypt in Gateway mode ....................................................25
Preparing the Security Gateway................................................................................. 26
Configuring Mirror and Decrypt in SmartConsole....................................................... 27
Configuring Mirror and Decrypt in VSX mode............................................................32
Preparing the VSX Gateway ....................................................................................... 34
Configuring Mirror and Decrypt in SmartConsole for One Virtual System.................... 35
Configuring Mirror and Decrypt in SmartConsole for Several Virtual Systems ............ 40
Mirror and Decrypt Logs.............................................................................................45
ICAP Client.......................................................................................................................46
Introduction to ICAP....................................................................................................46
ICAP Client in Check Point Security Gateway ............................................................51
ICAP Client User Disclaimer.......................................................................................52
Configuring ICAP Client in Gateway mode .................................................................53
Configuring ICAP Client in VSX mode.........................................................................54
The ICAP Client Configuration File.............................................................................55
Example of the ICAP Client Configuration File..........................................................67
Advanced ICAP Client Configuration..........................................................................70
Configuring Additional ICAP Response Headers for Enforcement............................... 70
Configuring Additional HTTPS Status Code, which ICAP Client Sends in RESPMOD...... 76
Configuring Connection Timeout for ICAP Connections............................................... 78
Configuring ICAP Client Data Trickling Parameters.................................................... 79
Hardware Security Module (HSM) ..................................................................................82
Why Use an HSM? .......................................................................................................82
The Check Point Environment with Gemalto SafeNet HSM Appliance .....................83
Workflow for Setting Up Your HSM Environment......................................................83
Step 1: Extracting the Gemalto Help Package...........................................................84
Step 2: Configuring the Gemalto HSM Appliance Server to Work with Check Point
Security Gateway ........................................................................................................84
Step 3: Configuring the Gemalto HSM Client Workstation........................................85
Step 4: Creating the CA Certificate on the Gemalto HSM Appliance Server ............86
Step 5: Configuring the Check Point Security Gateway to Work with the Gemalto
HSM Appliance Server ................................................................................................87
(A) Installing the Gemalto HSM Simplified Client Software Packages on the Check Point
Security Gateway ...................................................................................................... 88
(B) Establishing a Trust Link between the Check Point Security Gateway and the Gemalto
HSM Appliance Server............................................................................................... 88

Configuring HTTPS Inspection on the Check Point Security Gateway to Work with the
Gemalto HSM Appliance Server................................................................................. 90
Additional Actions for a Gemalto HSM Appliance Server..........................................91
Disabling Communication from the Check Point Gateway to the Gemalto HSM Appliance
Server ...................................................................................................................... 91
Deleting a Trust Link with the HSM Appliance Server................................................. 91
Configuring a Second Interface on a Gemalto HSM Appliance for NTLS....................... 92
Monitoring HTTPS Inspection on Check Point Gateway When Working with the
Gemalto HSM Appliance Server .................................................................................92
SmartConsole logs.................................................................................................... 93
SNMP ....................................................................................................................... 95
cpstat https_inspection ........................................................................................... 101
Creating an Access Control Policy ...............................................................................107
Managing Gateways ..................................................................................................107
Manually Updating the Gateway Topology ................................................................ 107
Dynamically Updating the Topology ......................................................................... 107
Introducing the Unified Access Control Policy ........................................................108
Creating a Basic Access Control Policy ...................................................................109
Basic Rules............................................................................................................. 109
Use Case - Basic Access Control.............................................................................. 109
Use Case - Inline Layer for Each Department........................................................... 110
Creating Application Control and URL Filtering Rules ........................................... 112
Monitoring Applications........................................................................................... 112
Blocking Applications and Informing Users.............................................................. 113
Limiting Application Traffic ..................................................................................... 113
Using Identity Awareness Features in Rules ............................................................ 114
Blocking Sites......................................................................................................... 115
Blocking URL Categories......................................................................................... 116
Ordered Layers and Inline Layers............................................................................117
The Need for Ordered Layers and Inline Layers ....................................................... 117
Order of Rule Enforcement in Inline Layers ............................................................. 117
Order of Rule Enforcement in Ordered Layers ......................................................... 118
Creating an Inline Layer .......................................................................................... 119
Creating a Ordered Layer ........................................................................................ 120
Enabling Access Control Features........................................................................... 121
Types of Rules in the Rule Base............................................................................... 122
Administrators for Access Control Layers................................................................ 124
Sharing Layers........................................................................................................ 124
Visual Division of the Rule Base with Sections.......................................................... 125
Exporting Layer Rules to a .CSV File ........................................................................ 125
Managing Policies and Layers ................................................................................. 125
The Columns of the Access Control Rule Base .......................................................126
Source and Destination Column............................................................................... 126
VPN Column............................................................................................................ 127
Services & Applications Column .............................................................................. 128
Content Column...................................................................................................... 131
Actions Column....................................................................................................... 132
Tracking Column..................................................................................................... 134
Unified Rule Base Use Cases ...................................................................................134
Use Case - Application Control and Content Awareness Ordered Layer .................... 134
Use Case - Inline Layer for Web Traffic.................................................................... 135
Use Case - Content Awareness Ordered Layer......................................................... 136

Use Case - Application & URL Filtering Ordered Layer............................................. 138
Rule Matching in the Access Control Policy ............................................................139
Examples of Rule Matching ..................................................................................... 139
Best Practices for Access Control Rules .................................................................142
Installing the Access Control Policy ........................................................................143
Analyzing the Rule Base Hit Count...........................................................................144
Enabling or Disabling Hit Count ............................................................................... 144
Configuring the Hit Count Display ............................................................................ 145
Preventing IP Spoofing .............................................................................................146
Configuring Anti-Spoofing....................................................................................... 146
Anti-Spoofing Options ............................................................................................. 148
Translating IP Addresses (NAT)...............................................................................148
To Learn More About NAT ....................................................................................... 149
UserCheck Interactions in the Access Control Policy .............................................149
Configuring the Security Gateway for UserCheck ..................................................... 149
Blocking Applications and Informing Users.............................................................. 151
UserCheck for Access Control Default Messages ..................................................... 151
Creating a UserCheck Interaction Object.................................................................. 152
Example UserCheck Message Using Field Variables ................................................ 153
Localizing and Customizing the UserCheck Portal.................................................... 153
UserCheck Frequency and Scope............................................................................. 153
UserCheck Settings................................................................................................. 154
UserCheck CLI ........................................................................................................ 155
Revoking Incidents.................................................................................................. 156
UserCheck Client .................................................................................................... 157
Blade Settings...........................................................................................................165
Inspection Settings.................................................................................................. 165
Configuring Inspection Settings............................................................................... 165
Creating a Threat Prevention Policy ............................................................................168
Threat Prevention Components ...............................................................................168
IPS.......................................................................................................................... 169
Anti-Bot.................................................................................................................. 170
Anti-Virus ............................................................................................................... 171
SandBlast ............................................................................................................... 172
Assigning Administrators for Threat Prevention ....................................................174
Analyzing Threats .....................................................................................................174
Out-of-the-Box Protection from Threats.................................................................175
Getting Quickly Up and Running with the Threat Prevention Policy ........................... 175
Enabling the Threat Prevention Software Blades ..................................................... 175
Installing the Threat Prevention Policy .................................................................... 178
Introducing Profiles ................................................................................................ 178
Optimized Protection Profile Settings ...................................................................... 179
Predefined Rule...................................................................................................... 180
The Threat Prevention Policy ...................................................................................181
Workflow for Creating a Threat Prevention Policy.................................................... 181
Threat Prevention Policy Layers.............................................................................. 181
Threat Prevention Rule Base................................................................................... 183
Creating Threat Prevention Rules ...........................................................................184
Configuring IPS Profile Settings .............................................................................. 184
Blocking Viruses..................................................................................................... 185
Configuring Anti-Bot Settings.................................................................................. 186
Configuring Threat Emulation Settings.................................................................... 188

Configuring Threat Extraction Settings.................................................................... 191
Configuring a Malware DNS Trap............................................................................. 192
Exception Rules ...................................................................................................... 193
The Check Point ThreatCloud...................................................................................195
Updating IPS Protections......................................................................................... 196
Threat Prevention Scheduled Updates..................................................................... 197
Updating Threat Emulation...................................................................................... 197
To Learn More About Threat Prevention .................................................................197
Creating Shared Policies ..............................................................................................198
Shared Policies .........................................................................................................198
Configuring HTTPS Inspection .................................................................................199
Inspecting HTTPS Packets....................................................................................... 199
Configuring Gateways to inspect outbound and inbound HTTPS................................ 200
Configuring the Geo Policy .......................................................................................208
Adding Users to the Policy............................................................................................210
Using Identity Awareness .........................................................................................210
Identity Sources...................................................................................................... 210
Enabling Identity Awareness ................................................................................... 211
Creating Access Roles............................................................................................. 212
Using Identity Awareness in the Access Control Policy............................................. 213
Redirecting to a Captive Portal ................................................................................ 214
Sample Identity Awareness Rules............................................................................ 214
Using User Directory ................................................................................................216
User Directory Features.......................................................................................... 216
Deploying User Directory ........................................................................................ 216
Account Units.......................................................................................................... 217
Working with LDAP Account Units ........................................................................... 217
Enabling User Directory .......................................................................................... 220
Managing LDAP Information.................................................................................... 220
To Learn More About Adding Users to the Policy....................................................221
Logging and Monitoring ................................................................................................222
Log Analysis ..............................................................................................................223
Configuring Logging................................................................................................ 223
Enabling Log Indexing............................................................................................. 225
Sample Log Analysis............................................................................................... 226
Tracking Options..................................................................................................... 227
Log Sessions........................................................................................................... 229
Views and Reports ....................................................................................................230
Enabling Views and Reports .................................................................................... 231
Catalog of Views and Reports .................................................................................. 231
Views...................................................................................................................... 232
Reports................................................................................................................... 232
Automatic View and Report Updates ........................................................................ 234
Opening a View or Report ........................................................................................ 235
Exporting Views and Reports................................................................................... 235
Scheduling a View or Report.................................................................................... 236
To Learn More About Logging and Monitoring ........................................................236
Maximizing Network Performance and Redundancy ..................................................238
Solutions for Enhancing Network Performance and Redundancy .........................238
CoreXL .......................................................................................................................238
Configuring CoreXL................................................................................................. 239
To Learn More About CoreXL................................................................................... 239

About SecureXL.........................................................................................................239
Configuring SecureXL ............................................................................................. 241
To Learn More About SecureXL ............................................................................... 242
Multi-Queue ..............................................................................................................242
ClusterXL...................................................................................................................243
The Need for Clusters ............................................................................................. 243
ClusterXL Solution .................................................................................................. 243
IPv6 Support for ClusterXL...................................................................................... 244
How ClusterXL Works ............................................................................................. 244
Installation and Platform Support............................................................................ 244
High Availability and Load Sharing in ClusterXL....................................................... 245
Configuring ClusterXL............................................................................................. 253
VRRP Cluster.............................................................................................................257
How VRRP Failover Works....................................................................................... 258
Internal Network High Availability ........................................................................... 258
Preparing a VRRP Cluster ....................................................................................... 260
Configuring Monitored Circuit/Simplified VRRP - Gaia Portal ................................... 262
Configuring the VRRP Security Gateway Cluster in SmartConsole ............................ 264
Configuring VRRP Rules for the Security Gateway.................................................... 265
To Learn More About Maximizing Network Performance ...................................... 265
Simplifying Security for Private Clouds .......................................................................266
Introduction to Virtual Systems (VSX)......................................................................266
VSX Overview.......................................................................................................... 266
How VSX Works....................................................................................................... 267
VSX Architecture and Concepts................................................................................269
Virtual Devices........................................................................................................ 270
Interfaces ............................................................................................................... 271
VSX Clusters........................................................................................................... 272
Configuring a VSX Cluster ........................................................................................275
An Example VSX cluster .......................................................................................... 275
Step 1 - Creating a VSX Cluster................................................................................ 276
Step 2 - Creating a Virtual Switch ............................................................................ 279
Step 3 - Creating Virtual System 1 ........................................................................... 279
Step 4 - Creating a New Virtual System 2................................................................. 280
Step 5 - Configuring the Policy on the Virtual Systems ............................................. 280
To Learn More About VSX .........................................................................................281
Securing Data ................................................................................................................282
Overview....................................................................................................................282
Data Loss Prevention Features................................................................................ 282
Using a Mail Relay and Mail Server.......................................................................... 283
Enabling DLP.............................................................................................................283
Adding Data Owners................................................................................................ 284
Notifying Data Owners............................................................................................. 284
Using DLP with Microsoft Exchange......................................................................... 285
DLP Rule Base ..........................................................................................................286
Managing the DLP Rule Base................................................................................... 286
DLP Rule Exceptions............................................................................................... 287
DLP Rule Actions .................................................................................................... 287
Sample Rule Base................................................................................................... 288
Analyzing and Tracking DLP.....................................................................................288
Analyzing DLP Incidents in the Logs ........................................................................ 289
Event Analysis Views Available in SmartConsole...................................................... 289

To Learn More About Data Loss Prevention ............................................................289
ConnectControl - Server Load Balancing ....................................................................291
ConnectControl Packet Flow....................................................................................291
Logical Server Types ................................................................................................292
Persistent Server Mode............................................................................................292
Persistent Server Timeout .......................................................................................293
Load-Balancing Methods..........................................................................................293
Server Availability.....................................................................................................294
End to End ConnectControl ......................................................................................294
IPv6 Neighbor Discovery...............................................................................................296
Managing Ethernet Protocols.......................................................................................296
Deploying a Security Gateway in Monitor Mode...........................................................298
Configuring Link State Propagation (LSP) ...................................................................299
Troubleshooting Specific Problems .............................................................................302
Resetting SIC in Security Gateways .........................................................................302
Security Before Firewall Activation..............................................................................303
Boot Security.............................................................................................................304
Control of IP Forwarding on Boot............................................................................. 304
The Default Filter.................................................................................................... 304
Selecting the Default Filter...................................................................................... 305
Defining a Custom Default Filter.............................................................................. 306
Using the Default Filter for Maintenance.................................................................. 307
The Initial Policy........................................................................................................308
Monitoring Security ..................................................................................................309
Unloading Default Filter or Initial Policy .................................................................310
Troubleshooting: Cannot Complete Reboot.............................................................311
Command Line Reference ............................................................................................312
comp_init_policy.......................................................................................................313
control_bootsec ........................................................................................................317
cp_conf ......................................................................................................................320
cp_conf auto ........................................................................................................... 322
cp_conf corexl ........................................................................................................ 323
cp_conf fullha......................................................................................................... 325
cp_conf ha .............................................................................................................. 326
cp_conf intfs........................................................................................................... 327
cp_conf lic .............................................................................................................. 328
cp_conf sic.............................................................................................................. 330
cpconfig .....................................................................................................................331
cpinfo .........................................................................................................................334
cplic ...........................................................................................................................335
cplic check.............................................................................................................. 337
cplic contract .......................................................................................................... 339
cplic del.................................................................................................................. 340
cplic print ............................................................................................................... 341
cplic put.................................................................................................................. 342
cpprod_util................................................................................................................344
cpstart .......................................................................................................................347
cpstat.........................................................................................................................348
cpstop ........................................................................................................................355
cpview........................................................................................................................356

Overview of CPView................................................................................................. 356
CPView User Interface............................................................................................. 356
Using CPView.......................................................................................................... 356
dynamic_objects .......................................................................................................358
cpwd_admin ..............................................................................................................360
cpwd_admin config ................................................................................................. 362
cpwd_admin del...................................................................................................... 365
cpwd_admin detach ................................................................................................ 366
cpwd_admin exist ................................................................................................... 367
cpwd_admin flist..................................................................................................... 368
cpwd_admin getpid................................................................................................. 369
cpwd_admin kill...................................................................................................... 370
cpwd_admin list...................................................................................................... 371
cpwd_admin exist ................................................................................................... 373
cpwd_admin start ................................................................................................... 374
cpwd_admin start_monitor ..................................................................................... 376
cpwd_admin stop.................................................................................................... 377
cpwd_admin stop_monitor...................................................................................... 379
fw ...............................................................................................................................380
fw -i........................................................................................................................ 383
fw amw................................................................................................................... 384
fw ctl ...................................................................................................................... 387
fw defaultgen.......................................................................................................... 436
fw fetch................................................................................................................... 437
fw fetchlogs............................................................................................................ 439
fw getifs.................................................................................................................. 441
fw hastat................................................................................................................. 442
fw isp_link .............................................................................................................. 444
fw kill ..................................................................................................................... 445
fw lichosts .............................................................................................................. 446
fw log ..................................................................................................................... 447
fw logswitch............................................................................................................ 455
fw lslogs................................................................................................................. 459
fw mergefiles.......................................................................................................... 462
fw monitor .............................................................................................................. 464
fw repairlog ............................................................................................................ 476
fw sam.................................................................................................................... 477
'fw sam_policy' and 'fw6 sam_policy'....................................................................... 484
fw showuptables..................................................................................................... 503
fw stat .................................................................................................................... 507
fw tab ..................................................................................................................... 509
fw unloadlocal ........................................................................................................ 514
fw up_execute......................................................................................................... 517
fw ver ..................................................................................................................... 520
fwboot bootconf.........................................................................................................521
fwboot bootconf ...................................................................................................... 523
fwboot corexl.......................................................................................................... 526
fwboot cpuid ........................................................................................................... 531
fwboot default......................................................................................................... 533
fwboot fwboot_ipv6 ................................................................................................. 534
fwboot fwdefault ..................................................................................................... 535
fwboot ha_conf ....................................................................................................... 536
fwboot ht ................................................................................................................ 537

fwboot multik_reg................................................................................................... 539
fwboot post_drv ...................................................................................................... 540
sam_alert..................................................................................................................541
usrchk........................................................................................................................544
Working with Kernel Parameters on Security Gateway ..............................................547
Introduction to Kernel Parameters..........................................................................548
FireWall Kernel Parameters ....................................................................................549
SecureXL Kernel Parameters ..................................................................................554
Kernel Debug on Security Gateway ..............................................................................557
Kernel Debug Syntax ................................................................................................557
Kernel Debug Filters ................................................................................................563
Kernel Debug Procedure ..........................................................................................567
Kernel Debug Procedure with Connection Life Cycle .............................................569
Kernel Debug Modules and Debug Flags.................................................................574
Module 'accel_apps' (Accelerated Applications)....................................................... 576
Module 'accel_pm_mgr' (Accelerated Pattern Match Manager)................................ 577
Module 'APPI' (Application Control Inspection)......................................................... 578
Module 'BOA' (Boolean Analyzer for Web Intelligence)............................................. 579
Module 'CI' (Content Inspection) .............................................................................. 580
Module 'cluster' (ClusterXL).................................................................................... 581
Module 'cmi_loader' (Context Management Interface/Infrastructure Loader)........... 583
Module 'CPAS' (Check Point Active Streaming) ........................................................ 584
Module 'cpcode' (Data Loss Prevention - CPcode) .................................................... 585
Module 'dlpda' (Data Loss Prevention - Download Agent for Content Awareness) ..... 586
Module 'dlpk' (Data Loss Prevention - Kernel Space) ............................................... 587
Module 'dlpuk' (Data Loss Prevention - User Space) ................................................ 588
Module 'fg' (FloodGate-1 - QoS) ............................................................................... 589
Module 'FILEAPP' (File Application)......................................................................... 590
Module 'fw' (Firewall).............................................................................................. 591
Module 'gtp' (GPRS Tunneling Protocol)................................................................... 595
Module 'h323' (VoIP H.323) ...................................................................................... 596
Module 'ICAP_CLIENT' (Internet Content Adaptation Protocol Client) ....................... 597
Module 'IDAPI' (Identity Awareness API) .................................................................. 598
Module 'kiss' (Kernel Infrastructure)....................................................................... 599
Module 'kissflow' (Kernel Infrastructure Flow) ........................................................ 601
Module 'MALWARE' (Threat Prevention) .................................................................. 602
Module 'multik' (Multi-Kernel Inspection - CoreXL).................................................. 603
Module 'MUX' (Multiplexer for Applications Traffic).................................................. 604
Module 'NRB' (Next Rule Base)................................................................................ 605
Module 'PSL' (Passive Streaming Library) ............................................................... 606
Module 'RAD_KERNEL' (Resource Advisor - Kernel Space) ...................................... 607
Module 'RTM' (Real Time Monitoring) ...................................................................... 608
Module 'seqvalid' (TCP Sequence Validator and Translator) ..................................... 610
Module 'SFT' (Stream File Type) .............................................................................. 611
Module 'SGEN' (Struct Generator) ........................................................................... 612
Module 'synatk' (Accelerated SYN Defender) ........................................................... 613
Module 'UC' (UserCheck)......................................................................................... 614
Module 'UP' (Unified Policy)..................................................................................... 615
Module 'upconv' (Unified Policy Conversion) ............................................................ 617
Module 'UPIS' (Unified Policy Infrastructure) ........................................................... 618
Module 'VPN' (Site-to-Site VPN and Remote Access VPN)......................................... 620
Module 'WS' (Web Intelligence) ............................................................................... 622

Module 'WS_SIP' (Web Intelligence VoIP SIP Parser) ............................................... 624
Module 'WSIS' (Web Intelligence Infrastructure)...................................................... 626

Terms
Anti-Bot
1. An application that prevents computers
from being controlled by hackers.
2. Check Point Software Blade that inspects
network traffic for malicious bot software.
Anti-Virus
A solution to protect a computer or network
against self-propagating programs or
processes that can cause damage.
Block
1. To stop traffic before it reaches its
destination.
2. To stop a command from execution.
3. To deny access by rule (though allowed by
permission).
Bot
Malicious software that neutralizes
Anti-Virus defenses, connects to a Command
and Control center for instructions from
cyber criminals, and carries out the
instructions.
CoreXL
A performance-enhancing technology for
Security Gateways on multi-core processing
platforms. Multiple Check Point Firewall
instances are running in parallel on multiple
CPU cores.
Data Type
A classification of data. The Firewall
classifies incoming and outgoing traffic
according to Data Types, and enforce the
Policy accordingly.
DLP
Data Loss Prevention. Detects and prevents
the unauthorized transmission of confidential
information.
Drop
To not allow packets through the gateway,
blocking the connection.
Event
1. A record of a security incident that is
based on one or more logs, and on a
customizable set of rules that are defined in
the Event Policy. 2. In Media Encryption, a
device connects to an endpoint computer. 3.
In SmartLSM, an object with schedule
settings for the Security Gateway to fetch its
security policy. 4. In Endpoint Security, an
object with schedule settings for Active and
Standby server synchronization.
Firewall
The software and hardware that protects a
computer network by analyzing the incoming
and outgoing network traffic (packets).
ICAP Client
The ICAP Client functionality in your Security
Gateway or Cluster enables it to interact with
an ICAP Server responses (see RFC 3507),
modify their content, and block the matched
HTTP connections.
IKE
Internet Key Exchange. An Encryption key
management protocol for IPSec that creates
a shared key to encrypt and decrypt IP
packets and establishes a VPN tunnel and
Security Association.
IPS
Intrusion Prevention System. Check Point
Software Blade that inspects and analyzes
packets and data for numerous types of
risks.
Mirror and Decrypt
The Mirror and Decrypt feature on your
Security Gateway or Cluster performs these
actions:
•Mirror only of all traffic - Clones all traffic
(including HTTPS without decryption) that
passes through, and sends it out of the
designated physical interface.
•Mirror and Decrypt of HTTPS traffic -
Clones all HTTPS traffic that passes

through, decrypts it, and sends it in
clear-text out of the designated physical
interface.
Remote Access Community
A group of computers, appliances, and
devices that access, with authentication and
encryption, the internal protected network
from physically remote sites.
Remote Access VPN
An encryption tunnel between a Security
Gateway and remote access clients, such as
Endpoint Security VPN, and communities.
Rule
A set of traffic parameters and other
conditions that cause specified actions to be
taken for a communication session.
Rule Base
The database that contains the rules in a
security policy and defines the sequence, in
which they are enforced.
SecureXL
Check Point product that accelerates IPv4
and IPv6 traffic. Installed on Security
Gateways for significant performance
improvements.
Security Gateway
A computer that runs Check Point software
to inspect traffic and enforces Security
Policies for connected network resources.
Security Management Server
A computer that runs Check Point software
to manage the objects and policies in Check
Point environment.
Security Policy
A collection of rules that control network
traffic and enforce organization guidelines
for data protection and access to resources
with packet inspection.
SmartEvent Server
Physical server that hosts the events
database.
Software Blade
A software blade is a security solution based
on specific business needs.
Each blade is independent, modular and
centrally managed. To extend security,
additional blades can be quickly added.
ThreatCloud Repository
A cloud database with more than 250 million
Command and Control (C&C) IP, URL, and
DNS addresses and over 2,000 different
botnet communication patterns, used by the
ThreatSpect engine to classify bots and
viruses.
ThreatSpect Engine
A unique multi-tiered engine that analyzes
network traffic and correlates data across
multiple layers (reputation, signatures,
suspicious mail outbreaks, behavior
patterns) to detect bots and viruses.
UserCheck
Gives users a warning when there is a
potential risk of data loss or security
violation. This helps users to prevent security
incidents and to learn about the
organizational security policy.

Next Generation Security Gateway Guide R80.20 | 18
C H A P TE R 2
Check Point Next Generation Security
Gateway Solution
In This Section:
Overview of Firewall Features.............................................................................. 18
How to Use this Guide.......................................................................................... 18
Components of the Check Point Firewall Solution................................................ 20
Overview of Firewall Features
The Check Point Next Generation Security Gateway includes:
•Access Control
•Firewall (network-level filtering)
•Application Control
•Internet access and filtering
•Content Awareness
•Site to Site VPN
•Mobile Access and VPN Remote Access
•Intrusion and Threat Prevention
•Identity Awareness (network, user, and machine awareness, for Access Control and Threat
Prevention)
•Data Loss Prevention
How to Use this Guide
To configure an effective security solution, you must understand how to configure the Next
Generation Security Gateway features, and how to add rules to your security policy. This guide
helps you understand the general principles of the Check Point Next Generation Security Gateway,
and how to configure it.
To learn more about each feature, look at the administration guide for the feature. There is a link
to the appropriate administration guide at the end of each section of this guide. To find the link,
search for "To Learn More".
Chapter Feature Section
Creating an Access
Control Policy (on page
107)
Firewall Basic Access Control (on page 109)
Application Control
Creating a Unified Access Control Policy:
URL Filtering
Content Awareness

Check Point Next Generation Security Gateway Solution
Next Generation Security Gateway Guide R80.20 | 19
Chapter Feature Section
Mobile Access
IPsec VPN
Creating a Threat
Prevention Policy (on page
168)
IPS
Anti-Bot
Anti-Virus
Threat Emulation
Threat Extraction
Creating Shared Policies
(on page 198)
HTTPS Inspection Configuring HTTPS Inspection (on page
199)
Geo Policy Configuring the Geo Policy (on page 208)
Adding Users to the Policy
(on page 210)
Identity Awareness
Monitoring and Logging
(on page 222)
Logging & Status
SmartEvent
Maximizing Network
Performance (on page
238)
Advanced
Networking &
Clustering
CoreXL (on page 238), SecureXL (on page
239) and Multi-Queue (on page 242)
ClusterXL (on page 243) and VRRP (on
page 257)
Simplifying Security for
Private Clouds (on page
266) Virtual Systems
Appendix: Securing Data
(on page 282) Data Loss
Prevention

Check Point Next Generation Security Gateway Solution
Next Generation Security Gateway Guide R80.20 | 20
Components of the Check Point Firewall Solution
Item Description
1 SmartConsole
2 Security Management Server
3 Internet and external networks
4 Security Gateway
5 Internal network
These are the primary components of a Check Point firewall solution:
•Security Gateway - The engine that enforces the organization’s security policy, is an entry point
to the LAN, and is managed by the Security Management Server.
•Security Management Server - The application that manages, stores, and distributes the
security policy to Security Gateways.
•SmartConsole - A Check Point GUI application used to manage security policies, monitor
products and events, install updates, provision new devices and appliances, and manage a
multi-domain environment.