CheckPoint Software Technologies LTD. How to Install and Configure SecureClient and SecureServer

Transcription

1 CheckPoint Software Technologies LTD. How to Install and Configure SecureClient and SecureServer Event: Partner Exchange Conference Date: October 19, 1999 Revision 1.0 Author: Richard Devera, Southern Region Technical Consultant Credits: Joe Dipietro, Mark Elliot

2 Table of Contents Equipment Needed:... 3 Configuration overview:... 5 Configuration Details... 6 Install and Configure SecureServer... 6 Install and Configure SecureClient Appendix A - Troubleshooting Tips and New Features Appendix A cont Authenticated Topology Downloads Appendix B Tables

3 Configure a SecureClient and SecureServer network This document explains the how to setup and configure SecureClient and SecureServer with Check Point VPN-1 Version 4.1. Basic knowledge of the Check Point architecture is a prerequisite. For further information on how to install the product, please refer to Getting Started for VPN-1/Firewall-1 guide. Configure SecureClient and SecureServer Web/FTP Server NT PDC - Domain CS NT Server Software SP4 IP: Netmask: DG: NONE SecuClient NT Server SP4 IP: Netmask: DG: NONE Meta IP - DHCP/DNS/UAM IP: Netmask: DG: NONE INTERNAL NETWORK IP Network: Netmask: LDAP Server IP Network: Netmask: DG: NONE Solaris - Secure Server IP Network: Netmask: DG: NONE Secure Client Win 95/98 IP: Netmask: DG:NONE NOTE: All subnet masks are All IP Addresses are for Subnet and Host IP Address ie = DG = Default Gateway Goal of the Demo: To show steps on how to deploy a VPN between a client and server using SecureClient and SecureServer. Equipment Needed: Firewall-1 version 4.1 or greater (Unix or NT) x86 platform running NT 4.0 Server SP 4 x86 platform running Windows 98 Sun platform w/solaris 2.6 NT or Solaris based platform 128 MB RAM, 2GB diskspace 3

4 4

5 Configuration overview: 1. Interconnect systems and hubs as per topology diagram. 2. Install Windows 98 on one client, Windows NT Server for the Management console, Solaris 2.6 for the SecureServer. 3. Create user account bob (password abcd1234) on the SecureServer. 4. Configure Network interfaces and routing. Verify connectivity by using ping to each host. 5. Install SecureServer on a Solaris machine 6. Install the management console on an Windows NT server machine 7. Install SecureClient on the Windows 98 machine 8. Create a SecureClient VPN rule to the SecureServer 9. Define and install a policy for the services to be tested. 10. Initiate an FTP session 11. Verify an encrypted FTP connection using log viewer 5

6 Configuration Details Install and Configure SecureServer 1. Install SecureServer 2. Insert the VPN Enterprise CD v4.1 into the disk drive. 3. Change directory to /cdrom/cpstrongsuite_41 4. Run./InstallU 5. Install VPN-1 / FW-1 Product PRODUCT MENU [*] 1. VPN-1 / FireWall-1 [ ] 2. FloodGate-1 [ ] 3. (Compression Module - not available) [ ] 4. Meta IP

7 6. For Setup type, Select Distributed Installation SETUP TYPE [ ] 1. STAND ALONE INSTALLATION This option installs all components of the products you have selected on a single machine. [*] 2. DISTRIBUTED INSTALLATION This option allows you to assign specific product components (management server software,enforcement points and management clients) for each products that you are installing to different machines For Distributed Installation, select Management Server/Enforcement Point Software DISTRIBUTED INSTALLATION [*] 1. Management Server/Enforcement Point Software The required components will be installed for this machine to function as a management server and/or as an enforcement point for the product(s) you have selected. [ ] 2. User Interface The required components will be installed for this machine to function as a client for the product(s) you have selected Enter N to when asked for backward compatibility 9. When asked to install in base directory, answer Y. 10. If you will be using MetaIP UAM, select Y, you will have to supply IP address of the UAM server, otherwise, select N to for MetaIP configuration Would you like to configure your MetaIP products with VPN-1/FireWall-1? If so - the installation will complete now the required setup Please enter [y]es or [n]o. y Enter your UAM HOST IP ADDRESS

8 11. After accepting the license agreement, you will be asked to choose the type of installation and module you want to install. Choose VPN-1 & Firewall-1 Distributed Installation for the installation selection Choose VPN-1 & Firewall-1 Gateway/Server Module for the module selection Choose VPN-1 & Firewall-1 SecureServer as the kernel module selection Choosing Installation (1) VPN-1 & FireWall-1 Stand Alone Installation (2) VPN-1 & FireWall-1 Distributed Installation Option (1) will install VPN-1 & FireWall-1 Internet GateWay (Management Server and Enforcement Module) on a single machine. Option (2) will allow you to install specific components of the VPN-1 & FireWall-1 Enterprise Products on different machines. Enter your selection (1-2/a): 2 Installing VPN-1 & FireWall-1 Distributed Installation. Which Module would you like to install? (1) VPN-1 & FireWall-1 Enterprise Management and Gateway/Server Module (2) VPN-1 & FireWall-1 Gateway/Server Module (3) VPN-1 & FireWall-1 Enterprise Management Enter your selection (1-3/a) [1]: 2 Which Module would you like to install? (1) VPN-1 & FireWall-1 - Limited hosts (25, 50, 100 or 250) (2) VPN-1 & FireWall-1 - Unlimited hosts (3) VPN-1 & FireWall-1 - SecureServer Enter your selection (1-3/a) [2]: 3 **************** VPN-1 & FireWall-1 kernel module installation **************** installing VPN-1 & FireWall-1 kernel module... Done. 12. Choose Y to automatically start the software from /etc/rc3.d. Do you wish to start VPN-1 & FireWall-1 automatically from /etc/rc3.d (y/n) [y]? y VPN-1 & FireWall-1 startup code installed in /etc/rc3.d 8

9 13. You will be asked to enter in a license, enter y You will need to register the certificate issued with this software at After receive your registered license via , you will need to enter the appropriate data at the prompts. Configuring Licenses... ======================= The following licenses are installed on this host: Do you want to add licenses (y/n) [n]? y Host: Date: 13Oct1999 String: axegjl3ue-78jpjsjfj-mjftnxkjc-lnmkusv8o Features: CPFW-EVAL-1-3DES-v41 CPTC-ETF-U-v41 CK-FW-FG-4.1-BETA-USE-ONLY 14. Next you will be asked to configure the masters (management stations), enter y to add Management Stations Enter an IP address Secret Key: abcd1234 (this key can be any random alphanumeric characters) On the Management Station, remember to type in the following: # cd $FWDIR/bin # fw putkey p abcd Configuring Masters... ====================== Masters are trusted Management Stations which will control this Check Point Module. Do you want to add Management Stations (y/n) [y]? y Please enter the list of hosts that will be Management Stations. Enter hostname or IP address, one per line, terminating with CTRL-D or your EOF character Is this correct (y/n) [y]? y You will now be prompted to enter a secret key that will be used to authenticate the communication between this Module and the Management Stations that you have selected. Enter secret key: Again secret key: 15. Configure the SMTP server, select N for NO 16. Configure for SNMP extension, select N 17. Configure for Groups, select the default values (none, y) 18. Configure IP forwarding, select Y 9

10 19. When configuring the default filter, configure to allow only traffic necessary for boot. Configuring Default Filter... ============================= Do you wish to modify your /etc/rcs.d boot scripts to allow a default filter to be automatically installed during boot (y/n) [y]? y Which default filter do you wish to use? (1) Allow only traffic necessary for boot (2) Drop all traffic NOTE: If you are installing the VPN-1 & FireWall-1 module, and not reconfiguring, it is recommended you choose option (1) in order to allow communications with the VPN-1 & FireWall-1 management. After installing a policy on the module from the management, you can reconfigure the default filter to option (2) Enter your selection (1-2) [1]: 20. After successful installation, the script will ask to reboot, select y 21. On the management console, create a network object named secureserver. Configure with IP address Workstation type is host and check box VPN-1 & Firewall enabled with version 4.1 Hints: If DNS or the host file is defined, Get Address will return the IP address defined for the server. The Get button in Modules Installed will get the version of the enforcement point. Gateway type does not have to be selected for SecureServer. 10

11 22. Select the Interfaces tab and select Get. 11

12 23. Select the Authentication tab, uncheck all boxes. Note: In this configuration we are using IKE pre-shared secrets. An authentication scheme does not need to be defined, unless this server will be performing multiple authentication methods. 24. Click on the OK button to save. 25. Double click on the secureserver network object and select the VPN tab. 26. Check the box labeled Exportable for SecuRemote 27. Under Encryption schemes defined, check the IKE box and highlight IKE, select Edit 12

13 28. Under Key Negotiation Encryption Methods, enable all methods. 29. Under Hash Method, enable both methods. 30. Under Authentication Method, check Pre- Shared secret Note: If you check Public Key Signatures, you will have to create a certificate and configure a CA server. For this demo, we will only use Pre-Shared Secret. 31. Check Supports Aggressive Mode, since we are only supporting a host we do not need to enable Supports Subnets. 32. Click on OK and save the changes. 33. Select Manage->Users from the menu bar on the Policy Editor 34. Create a user, bob. 13

14 35. In the authentication tab, select VPN-1 & Firewall-1 Password 36. Select the encryption tab and check Log Successful Authentication Track. 37. Select IKE in Client Encryption Methods and Edit. 14

15 38. Under the Authentication tab, check Password (for pre-shared secret) and type in a password. (Remember this password for SecureClient use) 39. Select the Encryption tab. Check ESP, SHA1, and 3DES. 15

16 40. Create a user group, finance-dept, and add bob to this group. 16

17 41. Go to Manage->Servers and select New->Policy Server 42. Create a policy server called accounting-server. 43. Select secureserver as the host this policyserver will be assigned to. 44. Select finance-dept as the user group assigned to the policy server. 45. Select OK and Close the Server object manager. 17

18 46. Go to Manage->Properties and select the Desktop Security tab. 47. Check the following: Respond to Unauthenticated Cleartext Topology Requests (See Appendix on Authenticated Topology Requests) Desktop is Enforcing Required Policy Policy is Installed on All Interfaces Generate Log Notify Desktop User 48. Allow Outgoing & Encrypted will be used as the Required Policy for All Desktops. (See Appendix B for information on all Required Policy for All Desktop options) 18

19 49. Create two rules like the following diagram: Source Dest Service Action Track InstallOn Time Any telnet, ftp Client Encrypt Long secureserver any Any Any Any drop Long secureserver any The first rule allows users within the finance department telnet and ftp access to any node using the client vpn (SecureClient). The second rule drops all users who do not meet the first rule. (This is always the last rule, this is only showed as the last rule to track for logging) NOTE: Please note that on Rule #1, by Clicking with the right mouse button on the "Client Encrypt", you now have the option to ENFORCE the client's desktop parameters before allowing this connection. This means if the client disables or reconfigures their desktop machines, the SecureServer module will not allow the desktop to get access to the server. That is what the "Apply Rule Only if Desktop Configuration Options are Verified Means" 19

20 50. Select Policy->Install to install the policy to secureserver 51. A successfully policy install will produce an output similar to the following diagram. 20

21 Install and Configure SecureClient 1. Install SecureClient on a Windows 98 client. See demo architecture. 2. Insert the Enterprise CD into the Windows 98 client and follow the following steps 3. The installation will auto play the installation script. Select Next 4. Click on Yes if you agree with the terms of the license agreement. 21

22 5. Select Mobile Desktop Components 6. Select VPN-1 SecuRemote/SecureClient. Please note that the same code is used for both SecuRemote and SecureClient, if you install "Install Desktop Security Support" during the installation. The only difference is the configuration on the SecureServer or Firewall Module that will push the policy into the SecureClient Desktop. This will be a great advantage in the future, because the Customer will be able to add "SecureClient" Functionality without having to reinstall new software! 22

23 7. Setup application will display the products you want to install. Select Next to continue. 8. Choose the default destination directory. 9. Choose Install Desktop Security Support. This is for the SecureClient support. 23

24 10. Install SecureClient on all network adapters 11. Reboot the computer when setup is complete 12. After rebooting the machine, move the mouse down to the task bar and double-click on the SecureClient envelope. 24

25 13. Create a site, and Press OK to save site data. 14. A dialog box will appear asking to download a security policy. Select Ok, canceling this will defer loading a loading a security policy. Note: You can see that a policy has been loaded into your desktop by the "Envelop with a Lock" Icon in your task bar 15. At the User Authentication dialog box enter the username bob and password abcd

26 16. A dialog box will verify successful logon. 17. Open up a DOS command line and initiate an FTP session with the secureserver. Logon with a valid username and password. (This example uses bob as the username and abcd1234 as the password). 18. Go to the management console and startup the log viewer to verify session. 26

27 19. Startup a DOS command-line prompt on another workstation on the LAN and run a ping test against SecureClient desktop. Verify blocked traffic to the desktop. 20. On the SecureClient desktop, double-click on the envelope. Go to Policy->Dis able Policy. 21. Go to back to command-line prompt on another workstation and run a ping test against the SecureClient desktop. 22. Verify successful ping test. 23. Configuration complete. 27

28 Appendix A - Troubleshooting Tips and New Features 1 Error messages to SecureClient and SecureServer can be found in the document titled Check Point Virtual Private Networks Version Please note that SecuRemote/SecureClient can rebind to the adapters in version 4.1, so that you do not need to reinstall SecuRemote/SecureClient as shown to the Right. Figure 1. Rebinding Adapters 3 Also note, that in version 4.1, you have the ability to dynamically disable sites. This could be useful if two sites have the same encryption domains (step #28 - Encdomain), but using two different management stations. SecuRemote/SecureClient will then encrypt to site and note This is shown below: Figure 2. Disabling Sites 4 This is a version 4.0 feature that can also be used in version 4.1 which is to configure Single-Sign-On (SSO) on an NT Workstation or NT Server. This will save the username/password for SecuRemote/SecureClient and the NT Domain username/password, so that you don't have to type these in. This will handle the automatic key negotiation to establish the VPN Tunnel. 28

29 Appendix A cont. Authenticated Topology Downloads Starting in version 4.0, the site s topology can be downloaded in encrypted format. In earlier releases, the topology was downloaded in clear text. The topology information includes information about what the gateway supports FWZ or IKE or both. To setup topology downloads, 1. Disable/Uncheck Respond to Unauthenticated Cleartext Topology Requests 2. Go to the VPN host/gateway network object 3. Click on the VPN tab 4. Select FWZ 5. Edit to generate an RSA key. 6. Save the changes and download the policy. 29

30 7. After successfully downloading the policy to SecureServer, download a new topology from SecuRemote/SecureClient 8. You will be prompted to enter a username and password. On a successful download, configuration is complete. 30

31 Appendix B Tables The Desktop Policy options and Desktop Configurations options were taken directly from the Check Point Virtual Private Networks Version 4.1 document. These are the only policies for Phase I SecureClient in version 4.1. In a future version, the desktop security policy will be able to be configured in a very granular fashion. 31