2012 Best Practice Seminar. Presented by David Rawle

Transcription

1 2012 Best Practice Seminar Presented by David Rawle

2 Welcome

3 Housekeeping Mobiles on Silent please Toilets are Fire exits are

4 Agenda Introduction What's new R75.45 R75.40VS E80.40 with integrated management Best Practices IPv6 and Check Point

5 Introduction Who am I? David Rawle Technical Director of Bytes Security Partnerships 15 years working within the industry Who are we? 6th biggest Check Point reseller in the UK Platinum Partner

6 Introduction We will remain an autonomous part of Bytes We are currently focused on growing SPARC Fundamental to keep the current Direct to Engineer model Will be consulting with customers and seeking feedback; your opinions matter

7 R75.45

8 R75.45 New Gaia features: Ability to configure 6in4 tunnels. Backup and restore, including scheduled backups. Policy Based Routing Support for PPPoE interfaces. See sk Ability to configure SNMP traps for RAID issues. TACACS+ authentication. e1000 driver updated to version Monitor mode on 10GbE ports, with automatic "one legged" bridge creation appliances automatic license fetch during the First Time Wizard. ISP Redundancy. See sk Automatic Software Updates Get updates for licensed Check Point products directly through the Operating System. Download and install R75.45 more easily and quickly. For R75.45 installation using Automatic Software Updates for Gaia, refer to sk81680 Aggregation of logs of the IPS Non Compliant HTTP and Non Compliant DNS protections. Log Server performance improvements enables writing logs in a more efficient way. This solved capacity issues in specific scenarios Anti-Malware report Expose the severity and category of the malwares found in the overview and additional pages to allow better high level understanding of Anti-Bot and Anti-Virus Blade findings.

9 R75.45 Very few customers have upgraded to it Provides specific fixes

10 R75.40VS

11 R75.40VS Otherwise know as main-train R7X VSX Simple Virtual System configuration Lets have a look

12 Demo R75.40 VS

13 Any Questions?

14 E80.40

15 New in E80.40 What's new? To many things to list!

16 E80.40 with integrated Management

17 E80.40 with integrated Management Endpoint Security Management E80.40 Endpoint Policy Network Policy Alongside with Network Security management R75.40 SMART-1 Security Management

18 E80.40 Additional features in Endpoint Security E80.40 Manage 80,000 seats full E80 suite Manage 150,000 seats of FDE & ME Getting Started Wizard Scan Multiple AD trees Set alerts & notifications including alerts Configure & preview user messages Custom image in full disk Encryption Web-remote help to remediate passwords

19 E80.40 Demo

20 What else is coming?

21 Introducing Document Security Simple to protect & Share documents

22 Select authorised users & classification to protect your document Restricted

23 Mobile Security Jan 2013

24 Secure access from smartphones Business Container VPN App Secure access from PC & Mac Web Portal for Business Applications VPN Client

25 What is Check Point Mobile Business Application? Protect Business Data Bring Your Own Device Part of the Mobile Access Software Blade

26 Any Questions?

27 Coffee

28 Best Practices

29 Best Practices Recover Laptops How to recover a broken FDE Laptop Demo

30 Best Practices FDE Boot Protection SSD s don t all require full encryption But you cant just configure pre-boot protection Demo

31 Best Practices - Syslogging Use Check Point SMC as a Syslog Server

32 Best Practices Check Point VE Check Point Virtual Edition What is it useful for? How about DLP Check Point VE DLP Linked to SmartCentre Cheap, supported way of deploying DLP

33 Best Practices Check Point VE Available for the following Hypervisors ESX v4.0 ESX v4.1 ESXi v4.0 ESXi v4.1 ESXi v5.0 ESXi v5.1 Available in the following license breaks 8 Core 16 Core 48 Core

34 Best Practices Check Point VE

35 Best Practices - Backups We talk about this every year SPLAT backup n --ftp ipaddress username password backup n --scp ipaddress username password Use crontab e to edit the cron job and schedule Gaia To save a backup locally: add backup local To save a backup on a remote server using ftp: add backup ftp ip VALUE username VALUE password plain To save a backup on a remote server using tftp: add backup tftp ip VALUE To save a backup on a remote server using scp: add backup scp ip VALUE username VALUE password plain

36 Best Practices - Backups Gaia Restores To restore a backup from a locally held file: set backup restore local <TAB> To restore a backup from a remote server using ftp: set backup restore ftp ip VALUE username VALUE password plain To restore a backup from a remote server using tftp: set backup restore tftp ip VALUE file VALUE To restore a backup from a remote server using scp: set backup restore scp ip VALUE username VALUE password plain

37 Best Practices - Backups Gaia Scheduled Backups To add a scheduled backup locally: add backup-scheduled name VALUE local To add a scheduled backup on a remote server using ftp: add backup-scheduled name VALUE ftp ip VALUE username VALUE password plain To add a scheduled backup on a remote server using scp: add backup-scheduled name VALUE scp ip VALUE username VALUE password plain To add a scheduled backup on a remote server using tftp: add backup-scheduled name VALUE tftp ip VALUE To configure a daily backup schedule: set backup-scheduled name VALUE recurrence daily time VALUE To configure a monthly backup schedule: set backup-scheduled name VALUE recurrence monthly month VALUE days VALUE time VALUE To configure a weekly backup schedule: set backup-scheduled name VALUE recurrence weekly days VALUE time VALUE To show the details of the scheduled backup: show backup-scheduled VALUE To delete a scheduled backup: delete backup-scheduled VALUE

38 Best Practices - Backups Speaking of Backups VMWare Gaia has VM Tools on-board

39 Best Practices Gaia Commands Expert Mode activation set expert-password plain When not in expert mode Type command then press <TAB> i.e. set <TAB> returns

40 Best Practices Gaia Commands Some other commands available show interface <TAB> set interface <TAB> add user <TAB> save config show commands show commands feature <TAB> show configuration expert There are lots of them

41 Best Practices Gaia Commands One nice Cisco type touch show configuration Copy the output into Notepad Paste into the console on a new box

42 Best Practices table.def Gets flagged as part of the upgrade process If you modify this file it will be over written at upgrade Why would you? See sk31832 for traffic hiding behind Virtual IP NTP typically fails from secondary DNS typically fails from secondary If NTP and DNS fails the clock will not be right on your secondary box which means it won t failover cleanly

43 Best Practices What to Log (or not) Large amounts of logging kill performance DO LOG Web Protocols VPN Traffic (except that below) DO NOT LOG Microsoft/NetBIOS Traffic DNS (except external lookups for browsing) Needlessly clogs log files

44 Best Practices What to Log (or not) Ensure Log Management is configured

45 Best Practices Tidy up after yourself We have customers spending large amounts of money on firewall audits Sometimes compliance means they have to be done If you just disable a rule when you don t need it anymore and delete objects when you don t need them your lives will be much easier

46 Best Practices Tidy up after yourself What are Check Point doing to help Hit Count

47 Best Practices Tidy up after yourself What are other people doing to help Algosec

48 Best Practices Monitor Performance Don t just monitor CPU Check Point has a whole SNMP stack built in Use it monitor other metrics

49 Best Practices VPN Cert Renewal

50 Best Practices VPN Cert Renewal Quick Demo

51 IPv6

52 A year ago we said Check Point and IPv6 Not ready for Prime Time.

53 IPv6 Gaia Supports IPv6 About to EA IPv6 Support in ALL Blades IPv6 Support for Management

54 R75.45 New Gaia features: Ability to configure 6in4 tunnels. Backup and restore, including scheduled backups. Policy Based Routing Support for PPPoE interfaces. See sk Ability to configure SNMP traps for RAID issues. TACACS+ authentication. e1000 driver updated to version Monitor mode on 10GbE ports, with automatic "one legged" bridge creation appliances automatic license fetch during the First Time Wizard. ISP Redundancy. See sk Automatic Software Updates Get updates for licensed Check Point products directly through the Operating System. Download and install R75.45 more easily and quickly. For R75.45 installation using Automatic Software Updates for Gaia, refer to sk81680 Aggregation of logs of the IPS Non Compliant HTTP and Non Compliant DNS protections. Log Server performance improvements enables writing logs in a more efficient way. This solved capacity issues in specific scenarios Anti-Malware report Expose the severity and category of the malwares found in the overview and additional pages to allow better high level understanding of Anti-Bot and Anti-Virus Blade findings.

55 R75.45 New Gaia features: Ability to configure 6in4 tunnels. Backup and restore, including scheduled backups. Policy Based Routing Support for PPPoE interfaces. See sk Ability to configure SNMP traps for RAID issues. TACACS+ authentication. e1000 driver updated to version Monitor mode on 10GbE ports, with automatic "one legged" bridge creation appliances automatic license fetch during the First Time Wizard. ISP Redundancy. See sk Automatic Software Updates Get updates for licensed Check Point products directly through the Operating System. Download and install R75.45 more easily and quickly. For R75.45 installation using Automatic Software Updates for Gaia, refer to sk81680 Aggregation of logs of the IPS Non Compliant HTTP and Non Compliant DNS protections. Log Server performance improvements enables writing logs in a more efficient way. This solved capacity issues in specific scenarios Anti-Malware report Expose the severity and category of the malwares found in the overview and additional pages to allow better high level understanding of Anti-Bot and Anti-Virus Blade findings.

56 An Introduction to IPv6

57 IPv6 Addresses An IPv6 address has 8 "hextets" rather than 4 octets : not. 2001:05c0:9168:0000:0000:0000:0000:0001/1 28 Leading zeros may be dropped one time, and one time only, you may drop contiguous zeros completely 2001:5c0:9168::1/128

58 IPv6 Subnets All done in /XX notation 2001:05c0:9168:0000:0000:0000:0000:0001/ :05c0:9168:5234::/ :05c0:9168::/48 Machine IP s typically use the last 4 "hextets Tunnelbroker.net will give you a /64 or /48 subnet One /48 contains 65k /64 subnets 2001:05c0:9168::/48 Contains 2001:05c0:9168:1::/64 to 2001:05c0:9168:ffff::/64

59 IPv6 auto assigned addresses NOT Random IP = 2001:470:1f09:128a:225:22ff:fe61:47fe MAC = 00:25:22:61:47:fe What about the FE80 Address? IPv6 equivalent of a address

60 IPv6 With 6in4 tunnels here and full support for all blades immanent now is the right time to start planning your IPv6 tests and roll-outs