Checkpoint 910 User manual

3 September 2018
Getting Started Guide
CHECK POINT
910 APPLIANCE
LOCALLY MANAGED
Model: LU-72 Classification: [Protected]

© 2018 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part
of this product or related documentation may be reproduced in any form or by any means without
prior written authorization of Check Point. While every precaution has been taken in the
preparation of this book, Check Point assumes no responsibility for errors or omissions. This
publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page http://www.checkpoint.com/copyright.html for a list of our
trademarks.
Refer to the Third Party copyright notices http://www.checkpoint.com/3rd_party_copyright.html
for a list of relevant copyrights and third-party licenses.

Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date
with the latest functional improvements, stability fixes, security enhancements and
protection against new and evolving attacks.
Check Point R77.20.80
For more about this release, see the R77.20.80 home page
http://supportcontent.checkpoint.com/solutions?id=sk133732.
Latest Version of this Document
Open the latest version of this document in a Web browser
https://sc1.checkpoint.com/documents/R77.20.80/910_Appliance_GettingStartedGuide
/html_frameset.htm.
Download the latest version of this document in PDF format
http://downloads.checkpoint.com/dc/download.htm?ID=67303.
To learn more, visit the Check Point Support Center
http://supportcenter.checkpoint.com.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments
mailto:[e-mail]?subject=Feedback on Check Point 910
Appliance Locally Managed Getting Started Guide.
Revision History
Date
Description
03 September 2018 First release of this document

Contents
Important Information ......................................................................................................3
Introduction.......................................................................................................................5
Shipping Carton Contents.................................................................................................5
Setting up the Appliance...................................................................................................6
Connecting the Cables ......................................................................................................6
Appliance Diagrams and Specifications...........................................................................7
Front Panel....................................................................................................................7
Back Panel ..................................................................................................................10
Using the First Time Configuration Wizard....................................................................11
Starting the First Time Configuration Wizard ...........................................................11
Welcome......................................................................................................................12
Authentication Details ................................................................................................14
Appliance Date and Time Settings .............................................................................15
Appliance Name ..........................................................................................................16
Internet Connection ....................................................................................................17
Local Network .............................................................................................................18
Administrator Access .................................................................................................20
Appliance Registration ...............................................................................................22
Software Blade Activation ..........................................................................................24
Summary .....................................................................................................................25
Health and Safety Information........................................................................................26
Health and Safety Information ...................................................................................26
Health and Safety Information ...................................................................................32
Support ............................................................................................................................38

Check Point 910 Appliance Getting Started Guide Locally Managed | 5
C H A P TE R 1
Introduction
Thank you for choosing Check Point's Internet Security Product Suite. Check Point products
provide your business with the most up to date and secure solutions available today.
Check Point also delivers worldwide technical services including educational, professional, and
support services through a network of Authorized Training Centers, Certified Support Partners,
and Check Point technical support personnel to ensure that you get the most out of your security
investment.
For more information about the appliance, see the
Check Point R77.20.80 600/700/900 Appliance
Administration Guide
http://downloads.checkpoint.com/dc/download.htm?ID=70207 .
For more technical information, go to: http://support.checkpoint.com
Shipping Carton Contents
Item Description
Appliance A single 910 appliance
Power Supply and Accessories •1 power cord
•2 standard network cables
•1 serial console cable
•1 mini USB console cable
•Steel ear mount brackets
Guide Check Point 910 Appliance Quick Start Guide
Sticker LEDs behavior
License Agreement End user license agreement

Setting up the Appliance
Check Point 910 Appliance Getting Started Guide Locally Managed | 6
Setting up the Appliance
1.
Remove the Check Point 910 Appliance from the shipping carton and place it on a tabletop.
2.
Identity the network interface marked as LAN1. This interface is preconfigured with the IP
address 192.168.1.1.
Connecting the Cables
1.
Connect the power cable to the appliance. The appliance is connected directly to the power
source.
2.
Turn on the power switch located on the back panel.
The Power LED on the front panel lights up when the appliance is on.
The Alert LED on the front panel starts to blink. This indicates that the appliance is booting up.
When the Alert LED turns off, the appliance is ready for login.
3.
Connect the standard network cable to the LAN1 port on the appliance and to the network
adapter on your PC.

Check Point 910 Appliance Getting Started Guide Locally Managed | 7
C H A P TE R 2
Appliance Diagrams and Specifications
In This Section:
Front Panel...........................................................................................................7
Back Panel.......................................................................................................... 10
The Check Point 910 Appliance is a wired model.
This section describes the front and back panels.
Front Panel
Front Panel - All
Key
Item
Description
1 Ear mount bracket Use to mount the appliance to a rack.
2 Left side of panel Contains LAN, WAN, DMZ ports and reset push
buttons.
3 Right side of panel Contains Network Interface LEDs, SD-card slot, Serial
console and USB ports.

Appliance Diagrams and Specifications
Check Point 910 Appliance Getting Started Guide Locally Managed | 8
Front Panel - Left
Key
Item
Description
1 WAN port RJ45 Ethernet ports.
2 Factory Default button Restore the appliance to its factory defaults.
3 Reboot button Forcibly reboot the appliance.
4 DMZ ports Ethernet ports:
•Left - RJ45
•Right - SFP (1GbE)
5 LAN1 - 16 ports RJ45 Ethernet ports.

Appliance Diagrams and Specifications
Check Point 910 Appliance Getting Started Guide Locally Managed | 9
Front Panel - Right
Key
Item
Description
1 Serial console port RJ45 or Mini USB Serial connection configured to
115200 baud rate by default.
Note - When both the RJ45 and Mini USB cables are
connected, the Mini USB takes precedence.
2 Alert LED •Green during normal operation.
•Blinking green during boot.
•Red when the appliance has a resource problem such as memory
shortage.
3 SD LED Blinking green when SD is inserted.
4 LAN1 – LAN16, DMZ, WAN
LEDs
Speed Indicator:
•Orange when the port speed is 1000 Mbps.
•Green when the port speed is 100 Mbps.
•Not lit when the port speed is 10 Mbps.
Activity Indicator:
•Not lit when there is no link.
•Green when there is a link but no traffic encountered.
•
Blinking green when encountering traffic.
5 Internet LED •Green when connected to the Internet.
•Blinking red when the Internet connection is configured but fails
to connect.
6 USB LED Blinking green when a USB device is connected.
7 Power LED •Green when the appliance is turned on.
•Red when there is a boot error or the appliance is in maintenance
mode.

Appliance Diagrams and Specifications
Check Point 910 Appliance Getting Started Guide Locally Managed | 10
Key
Item
Description
8 USB1 and USB2 ports USB ports that are used for:
•Cellular and analog modems.
•Reinstalling the appliance with new firmware.
•Running a first-time configuration script.
9 Micro SD Insert SD card here.
Back Panel
Back Panel - All
Key
Item
Description
1 Left side of panel Contains switch, plug outlet, and fan.
Back Panel - Left
Key
Item
Description
1 Socket Plug the cable in here. AC input voltage and current:
100-240V ~ 50-60 Hz 1.7A.
2 Switch On/off switch
3 Fan System fan

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 11
Using the First Time Configuration
Wizard
Configure the Check Point 910 Appliance with the First Time Configuration Wizard.
To close the wizard and save configured settings, click Quit.
Note - In the First Time Configuration Wizard, you may not see all the pages described in this
guide. The pages that show in the wizard depend on your appliance model and the options you
select.
Starting the First Time Configuration Wizard
To configure the Check Point 910 Appliance for the first time after you complete the hardware
setup, use the First Time Configuration Wizard.
If you do not complete the wizard because of one of these conditions, the wizard will run again the
next time you connect to the appliance:
•The browser window is closed.
•The appliance is restarted while you run the wizard.
After you complete the wizard, you can use the WebUI (Web User Interface) to change settings
configured with the First Time Configuration Wizard and to configure advanced settings.
To open the WebUI, enter one of these addresses in the browser:
•http://my.firewall
•http://192.168.1.1:4434
If a security warning message shows, confirm it and continue.
The First Time Configuration Wizard runs.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 12
Welcome
The Welcome page introduces the product and shows the name of your appliance.
On this page, you can change the language of the WebUI application.
You can connect to the Zero Touch server to fetch settings automatically from the cloud.
To change the language of the WebUI application:
Select the language link at the top of the page.
Note that only English is allowed as the input language.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 13
Zero Touch
Zero Touch enables a gateway to automatically fetch settings from the cloud when it is connected
to the internet for the first time.
Note - You cannot use Zero Touch if you connect to the internet with a proxy server.
If the gateway connects to the internet through DHCP, the gateway will fetch the Zero Touch
settings without any additional action. If no DHCP service is available, you must run the First Time
Configuration Wizard, configure the Internet Connection settings, and then fetch the settings from
the Zero Touch server.
To connect to the Zero Touch server:
1.
In the Welcome page, click Fetch Settings from the cloud.
2.
In the window that opens, click OK to confirm that you want to proceed.
3.
The Internet connection page opens. Configure your Internet connection and click Connect.
4.
The Fetching settings from the cloud window opens and shows the Connecting to the service
provider status. This process may take several minutes.
5.
If you fail to connect, an error message appears. Possible errors include:
•Internet configuration is not configured correctly.
•Internet connection is through a proxy server.
•Zero Touch is already running.
•Zero Touch service already completed.
•The First Time Configuration Wizard already completed.
•Zero Touch service disabled.
Where applicable, click Retry now to connect again.
6.
After you connect to the server, the settings are automatically downloaded and installed. The
status is shown in the Fetching settings from the cloud window. It may take several minutes
until the installation is complete.
7.
Click Finish.
Note - If a collision is detected between an internal network (LAN) and an IP returned using DHCP
(WAN), the conflicting LAN address is changed automatically. If a colliding LAN IP address is
changed, a message appears in the system logs.
When you reconnect to the WebUI or click Refresh, the browser opens to show the status of the
installation process.
After the gateway downloads and successfully applies the settings, it does not connect to the Zero
Touch server again.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 14
Authentication Details
In the Authentication Details page, enter the required details to log in to the Check Point 910
Appliance WebUI application or if the wizard terminates abnormally:
•Administrator Name - We recommend that you change the default "admin" login name of the
administrator. The name is case sensitive.
•Password - A strong password has a minimum of 6 characters with at least one capital letter,
one lower case letter, and a special character. Use the Password strength meter to measure
the strength of your password.
Note - The meter is only an indicator and does not enforce creation of a password with a
specified number of character or character combination. To enforce password complexity,
click the check box.
•Confirm Password - Enter the password again.
•Country - Select a country from the list (for wireless network models).

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 15
Appliance Date and Time Settings
In the Appliance Date and Time Settings page, configure the appliance's date, time, and time zone
settings manually or use the Network Time Protocol option.
When you set the time manually, the host computer's settings are used for the default date and
time values. If necessary, change the time zone setting to show your correct location. Daylight
Savings Time is automatically enabled by default. You can change this in the WebUI application on
the Device > Date and Time page.
•Date - The host computer's date appears by default. If required, set a different date.
•Time - The host computer's time appears by default. If required, set a different time.
•Time Zone - The host computer's time zone appears by default. If required, select a time zone
setting to reflect your exact location.
•Primary NTP server - The IP or host name of the primary NTP server. The default server is
ntp.checkpoint.com
•Secondary NTP server - The IP or host name of the secondary NTP server. The default server
is ntp2.checkpoint.com

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 16
Appliance Name
In the Appliance Name page, enter a name to identify the appliance, and enter a domain name
(optional).
When the gateway performs DNS resolving for a specified object’s name, the domain name is
appended to the object name. This lets hosts in the network look up hosts by their internal names.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 17
Internet Connection
In the Internet Connection page, configure your Internet connectivity details or select Configure
Internet connection later.
For IPv6 Internet connections, select the option to configure later.
To configure Internet connection now:
1.
Select Configure Internet connection now.
2.
From the Connection Protocol drop down list, select the protocol used to connect to the
Internet.
3.
Enter the fields for the selected connection protocol. The information you must enter is
different for each protocol. You can get it from your Internet Service Provider (ISP).
•Static IP - A fixed (non-dynamic) IP address.
•DHCP - Dynamic Host Configuration Protocol (DHCP) automatically issues IP addresses
within a specified range to devices on a network. This is a common option when you
connect through a cable modem.
•PPPoE (PPP over Ethernet) - A network protocol for encapsulating Point-to-Point Protocol
(PPP) frames inside Ethernet frames. It is used mainly with DSL services where individual
users connect to the DSL modem over Ethernet and Metro Ethernet networks. Enter the
ISP login user name and ISP login password. Note - In the First Time Configuration
Wizard, only dynamic IP is supported.
•PPTP - The Point-to-Point Tunneling Protocol (PPTP) implements virtual private networks.
PPTP uses a control channel over TCP and a GRE tunnel operating to encapsulate PPP
packets.
•L2TP - Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual
private networks (VPNs). It does not provide any encryption or confidentiality. It relies on an
encryption protocol that it passes within the tunnel to provide privacy.
•Cellular Modem - Connect to the Internet using a wireless modem to a cellular ISP
through the USB port.
•Analog Modem - Connect to the Internet using an analog modem through a USB port. In
the WebUI application, you can configure to use an analog modem through the serial port.
•Bridge - Connects multiple network segments at the data link layer (Layer 2).
•DNS Server (Static IP and Bridge connections) - Enter the DNS server address information
in the relevant fields. For DHCP, PPPoE, PPTP, L2TP, Analog Modem, and Cellular Modem,
the DNS settings are supplied by your service provider. You can override these settings
later in the WebUI application, under Device > DNS.
We recommend that you configure the DNS as the appliance needs to perform DNS resolving
for different functions. For example, to connect to Check Point User Center during license
activation or when Application Control, Web Filtering, Anti-Virus, or Anti-Spam services are
enabled.
To test your ISP connection status:
Click Connect.
The appliance connects to your ISP. Success or failure shows at the bottom of the page.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 18
Local Network
In the Local Network page, select to enable or disable switch on LAN ports and configure your
network settings. By default, they are enabled. You can change the IP address and stay connected
as the appliance's original IP is kept as an alias IP until the first time you boot the appliance.
Tell me about the fields...
•Enable switch on LAN ports - Aggregates all LAN ports to act as a switch with one IP address
for the switch. If this option is disabled (checkbox is cleared), the local network is defined as
LAN1 only.
•Network name -Enter the network name.
•IP address - You can modify the IP address and maintain connectivity. The appliance's original
IP is kept as an alias IP to maintain connectivity until the wizard is completed.
•Subnet mask - Enter the subnet mask.
•DHCP server and range fields - DHCP is enabled by default with a default network range.
Make sure to set the appropriate range and do not include predefined static IPs in your
network.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 19
•Exclusion range - Set the exclusion range for IP addresses that are not defined by the DHCP
server. Define the range of IP addresses that the DHCP excludes when IP addresses are
assigned in the network. The appliance's IP address is automatically excluded from the range.
For example, if the appliance IP is 1.1.1.1 the range also starts from 1.1.1.1, but excludes its
own IP address.
Important - If you choose to disable the switch on LAN ports (clear the checkbox), make
sure your network cable is placed in the LAN1 port. Otherwise, connectivity will be lost
when you click Next.

Using the First Time Configuration Wizard
Check Point 910 Appliance Getting Started Guide Locally Managed | 20
Administrator Access
In the Administrator Access page, configure if administrators can use the appliance from a
specified IP address or any IP address.
To configure administrator access:
1.
Select the sources from where administrators are allowed access:
•LAN - All internal physical ports.
•VPN - Using encrypted traffic through VPN tunnels from a remote site or using a remote
access client.
•Internet - Clear traffic from the Internet (not recommended).
2.
Select the IP address from which the administrator can access the appliance:
•Any IP address
•Specified IP addresses only - Select this option to let administrators access the appliance
from a specified IP address or network. Click New to configure the IP address information.
•Specified IP addresses from the Internet and any IP address from other sources - Select
this option to allow administrator access from the Internet from specific IP addresses only
and access from other selected sources from any IP address. This option is the default.
To specify IP addresses:
1.
Click New.
2.
In the IP Address Configuration window, select an option:
•Specific IP address - Enter the IP address or click Get IP from my computer.
•Specific network - Enter the Network IP address and Subnet mask.
3.
Click Apply.