Checkpoint NGX R66 User manual

Connectra Appliance
Getting Started Guide
NGX R66
702365 November 5, 200

Health and Safety Information
Read the following warnings before setting up or using the appliance.
To prevent damage to any system board, it is important to handle it with care. The
following measures are generally sufficient to protect your equipment from static
electricity discharge:
•When handling the board, to use a grounded wrist strap designed for static
discharge elimination.
•Touch a grounded metal object before removing the board from the antistatic bag.
•Handle the board by its edges only. Do not touch its components, peripheral chips,
memory modules or gold contacts.
•When handling processor chips or memory modules, avoid touching their pins or
gold edge fingers.
•Restore the communications appliance system board and peripherals back into the
antistatic bag when they are not in use or not installed in the chassis. Some
circuitry on the system board can continue operating even though the power is
switched off.
•Under no circumstances should the Lithium battery cell used to power the
real-time clock be allowed to short. The battery cell may heat up under these
conditions and present a burn hazard.
Warning - Do not block air vents. A minimum 1/2-inch clearance is
required.
Warning - This appliance does not contain any user-serviceable parts.
Do not remove any covers or attempt to gain access to the inside of the
product. Opening the device or modifying it in any way has the risk of
personal injury and will void your warranty. The following instructions
are for trained service personnel only.
Warning - DANGER OF EXPLOSION IF BATTERY IS INCORRECTLY
REPLACED. REPLACE ONLY WITH SAME OR EQUIVALENT TYPE
RECOMMENDED BY THE MANUFACTURER. DISCARD USED
BATTERIES ACCORDING TO THE MANUFACTURER'S INSTRUCTIONS

•Disconnect the system board power supply from its power source before you
connect or disconnect cables or install or remove any system board components.
Failure to do this can result in personnel injury or equipment damage.
•Avoid short-circuiting the lithium battery; this can cause it to superheat and cause
burns if touched.
•Do not operate the processor without a thermal solution. Damage to the processor
can occur in seconds.

5
© 2003-2008 Check Point Software Technologie Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part of
this product or related documentation may be reproduced in any form or by any means without prior
written authorization of Check Point. hile every precaution has been taken in the preparation of
this book, Check Point assumes no responsibility for errors or omissions. This publication and
features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Please refer to http://www.checkpoint.com/copyright.html for a list of our trademarks.
For third party notices, see http://www.checkpoint.com/3rd_party_copyright.html.

6

7
Content
Chapter 1
Introduction to Connectra
Welcome.................................................................................12
Overview ................................................................................. 13
Shipping Carton Contents .........................................................14
Terminology ............................................................................15
Chapter 2
Deploying Connectra
Deployment Overview ...............................................................1
Deploying Connectra in the DMZ ...............................................19
Deploying Connectra on a LAN ..................................................20
Deploying a Connectra Cluster................................................... 21
Chapter 3
In talling and Configuring Connectra
Installation and Configuration Workflow .....................................24
Installation and Initial Configuration Stages ...................... 24
Installation and Initial Configuration Procedures .........................26
Step 1: Preparing for Centrally Managed Connectra............ 26
Step 2: Installing Connectra............................................. 2
Step 3: Identifying the Default Management Interface........ 31
Step 4: Connecting the Cables and Turning On.................. 31
Step 5: Connecting to the Administration User Interface..... 32
Step 6: Running the First Time Configuration Wizard ......... 34
Step 7: Installing the SmartConsole GUI Clients ................ 36
Step : Logging In for the First Time ................................ 37
Step 9: Defining Connectra Objects (Centrally Managed
Connectra) ..................................................................... 3

Post-Installation Procedures......................................................41
Step 10: Connecting Connectra to the Network .................. 41
Step 11: Configuring Access Control ................................. 41
Step 12: Performing a SmartDefense Update (Locally Managed
Connectra)...................................................................... 43
Step 13: Checking Your Setup.......................................... 44
Installing the NGX R66 Plug-in .................................................45
Installing the Plug-in on a SmartCenter ............................. 45
Installing the Plug-in on Provider-1/SiteManager-1 ............. 47
Uninstalling Connectra Plug-ins........................................ 50
Cluster Configuration—Deployment Tips ....................................51
SSL Acceleration Card Installation.............................................53
Enabling the Card ........................................................... 53
Disabling the Card........................................................... 53
SSL Acceleration Card Command Syntax ........................... 54
Further Information ..................................................................55
Chapter 4
Connectra Hardware
Overview .................................................................................57
Front Panel Components .................................................. 5
Rear Panel Components................................................... 64
Customer Replaceable Parts......................................................66
Power Supply.................................................................. 67
Cooling Fan .................................................................... 6
Expansion Line Card........................................................ 69
Hard Disk Drive............................................................... 71
Restoring Factory Defaults ........................................................74
Restoring Using the WebUI .............................................. 74
Restoring Using the Console Boot Menu ............................ 75
Restoring Using the LCD Panel......................................... 77

Table of Contents 9
Chapter 5
Upgrading Connectra
Introduction to Advanced Upgrade ............................................ 2
Advanced Upgrade to Locally Managed R66 .............................. 3
Preparing for Advanced Upgrade to Locally Managed R66 .. 3
Advanced Upgrade Procedure to Locally Managed R66 ...... 3
Completing the Advanced Upgrade to R66........................ 5
Upgrade to Centrally Managed R66 from R61/62/62CM ............. 7
Setting Up the SmartCenter and Installing the R66 Plug-in 7
Setting Up SIC Trust ...................................................... 90
Installing Policy ............................................................. 91
Completing the Upgrade by Merging Manual Changes ........ 91
Upgrading a Connectra Cluster to R66 ...................................... 92
Chapter 6
Unin talling Connectra Plug-in
Overview ................................................................................ 93
Uninstalling the R66 Plug-in for Central Management ................ 94
Before Uninstalling the R66 Plug-in:................................ 94
Uninstalling the R66 Plug-in ........................................... 94
Removing the R66 Compatibility Package......................... 95
Uninstalling the Connectra NGX R62CM Plug-in ........................ 97
Removing the R62CM Compatibility Package .................... 9
Uninstalling Plug-ins in Provider-1............................................ 99
Deactivating Plug-ins on the MDS .................................... 99
Uninstalling the R62CM Plug-in in Provider-1................... 99
Chapter 7
Regi tration and Support
Registration .......................................................................... 101
For Connectra Cluster Users .......................................... 101

10
Support.................................................................................102
Where To From Here? .............................................................103
Chapter 8
Note
My Connectra Appliance .........................................................105
Index .................................................................. 109

11
Chapter 1
Introduction to Connectra
In This Chapter
Welcome page 12
Overview page 13
Shipping Carton Contents page 14
Terminology page 15

Welcome
12
Welcome
Thank you for choosing Check Point’s Connectra appliance. We hope
that you will be satisfied with this solution and our support services.
Check Point products provide your business with the most up to date
and secure solutions available today.
Check Point also delivers worldwide technical services including
educational, professional and support services through a network of
Authorized Training Centers, Certified Support Partners and Check
Point technical support personnel to ensure that you get the most out
of your security investment.
For additional information on the NGX Internet Security Product Suite
and other security solutions, refer to: http://www.checkpoint.com or
call Check Point at 1( 00) 429-4391. For additional technical
information, refer to: http://support.checkpoint.com.
Welcome to the Check Point family. We look forward to meeting all of
your current and future network, application, and management
security needs.

Overview
Chapter 1 Introduction to Connectra 13
Overview
Check Point Connectra is a comprehensive and unified remote access
solution that makes corporate applications and network resources
securely available to mobile and remote users. With Connectra NGX
R66, remote and mobile employees, contractors, business partners,
and customers can access network resources and applications through
either a lightweight VPN client or simply through a Web browser. By
unifying SSL and IPSec VPN technologies into a single gateway and
management console, Connectra provides flexible access for end
users and simple, streamlined deployment for the IT organization.
Connectra offers administrators tight access controls to help ensure
that only authorized users using clean hosts will gain access to
corporate resources. To that end Connectra features multiple strong
authentication methods and tight integration with directory services.
Comprehensive endpoint security capabilities enable malware scans,
compliance checks. A virtual Secure Workspace provides session
confidentiality on both managed and unmanaged endpoints, such as
laptops, home PCs, internet kiosks, and more.
Connectra can be deployed as either a turnkey appliance, as software
on open servers, or as a virtual machine on VMware ESX Server.
Connectra gateways can be managed either locally or centrally
through a single Check Point SMART management console, reducing
the administration time required to configure, monitor, update, and
audit remote access policies.

Shipping Carton Contents
14
Shipping Carton Content
This section describes the contents of the shipping carton.
Table 1-1 Contents of the Shipping Carton
Item Description
Appliance A single Connectra appliance:
•Connectra 3070 or
•Connectra 270 or
•Connectra 9072
Rack Mounting Accessories Hardware mounting kit.
Cables • Power cable/s
•1 for Connectra 3070 or 270
•2 for Connectra 9072
• 1 Standard RJ-45 network cable
• 1 Serial console cable
• 1 RJ-45 loopback plug
CD Includes the following:
• Getting Started Guide
• Connectra Local Management
Administration Guide
• Connectra Central Management
Administration Guide
• Connectra Appliance Administration
Guide Supplement
Certifications, Regulations
and Documentation
Certification data sheet and user license
agreement.

Terminology
Chapter 1 Introduction to Connectra 15
Terminology
The following Connectra terms are used throughout this chapter:
• Gateway: The Connectra engine that enforces the organization’s
access policy and acts as a remote access server.
• access Policy: The policy created by the system administrator
that makes corporate applications and network resources
securely available to mobile and remote users.
• SmartCenter Server: The server used by the system administrator
to manage the access policy in a centrally managed deployment.
The organization’s databases and access policies are stored on
the SmartCenter server and downloaded to the gateway.
•SmartConsole: GUI applications that are used to manage various
aspects of access policy enforcement. For example, SmartView
Tracker is a SmartConsole application that manages logs.
• SmartDashboard: A SmartConsole GUI application that is used
by the system administrator to create and manage the access
policy.
• Locally Managed Deployment: When all Check Point components
responsible for both the management and enforcement of the
access policy (the SmartCenter server and the gateway) are
installed on the same machine.
• Centrally Managed Deployment: When the gateway and the
SmartCenter server are installed on separate machines.
• Management Plug-ins Management plug-ins allow you to
dynamically add new features and support for new products.
Plug-ins supply new and separate packages that consist only of
those components necessary for managing new gateway products
or specific features, thus avoiding a full upgrade to the next
release.

Terminology
16

17
Chapter 2
Deploying Connectra
In This Chapter
Deployment Overview page 1
Deploying Connectra in the DMZ page 19
Deploying Connectra on a LAN page 20
Deploying a Connectra Cluster page 21

Deployment Overview
1
Deployment Overview
In general, it is recommended to deploy Connectra in the DMZ.
Connectra can, however, also be deployed in other places, such as on
the internal LAN. In both scenarios, SSL termination takes place at
the Connectra Gateway. Web Intelligence, Application Intelligence,
authentication, and authorization schemes on the Connectra Gateway
are employed to protect the internal network and to inspect the traffic
for harmful content before it reaches the internal servers.
Connectra differs from other remote access solutions in that it has
gateway based application-level and network-level protection. For
example, it incorporates the Malicious Code Protector to protect
against worms.

Deploying Connectra in the DMZ
Chapter 2 Deploying Connectra 19
Deploying Connectra in the DMZ
Figure 2-1 shows a typical Connectra deployment in the DMZ:
Figure 2-1 Connectra Deployment in the DMZ
When Connectra is placed in the DMZ, traffic initiated both from the
Internet and from the LAN to Connectra is subject to firewall
restrictions. By deploying Connectra in the DMZ, the need to enable
direct access from the Internet to the LAN is avoided. Remote users
initiate an SSL connection to the Connectra Gateway. The firewall
must be configured to allow traffic from the user to the Connectra
server, where SSL termination, Web and Application Intelligence
inspection, authentication, and authorization take place. Requests are
then forwarded to the internal servers via the firewall. Administration
traffic is always SSL encrypted.

Deploying Connectra on a LAN
20
Deploying Connectra on a LAN
Figure 2-2 shows how Connectra can be deployed on the LAN
alongside the internal servers:
Figure 2-2 Connectra Deployment in the LAN
The remote user opens a browser and initiates an HTTPS request to
the Connectra server. The SSL connection is terminated within the
LAN and the clear text requests are forwarded to the internal servers.
The internal servers reply “in the clear” to Connectra, which encrypts
the reply back to the remote user. In the scenario shown in
Figure 2-2, the perimeter firewall must be configured to allow
encrypted SSL traffic to Connectra.
In this scenario, the SSL VPN traffic passes through the Firewall as
encrypted traffic, thus unavailable for inspection with traditional
solutions. With Connectra, the network is fully protected with
Application Intelligence and Web Intelligence.