SofaWare Technologies SBX-11GWLAN-7 Safe@office/VPN-1 Edge User Manual Check Point Safe Office User Guide

Download:
Mirror Download [FCC.gov]
Document ID	1184424
Application ID	nSgEEw2SbKTE/B8Pq1US4w==
Document Description	manual part 2
Short Term Confidential	No
Permanent Confidential	No
Supercede	No
Document Type	User Manual
Display Format	Adobe Acrobat PDF - pdf
Filesize	375.19kB (4689927 bits)
Date Submitted	2009-10-16 00:00:00
Date Available	2009-10-19 00:00:00
Creation Date	2008-04-29 20:39:49
Producing Software	Acrobat Distiller 8.1.0 (Windows)
Document Lastmod	2009-10-13 18:54:14
Document Title	Check Point Safe@Office User Guide
Document Creator	Acrobat PDFMaker 8.1 for Word
Document Author:	Part No: 700797, April 2008

Using NAT Rules
•
Static NAT is configured for a network object (for information, see Using
Network Objects on page 185)
•
NAT rules are received from the Service Center
Implicitly defined NAT rules can only be edited or deleted indirectly. For example, in
order to remove a NAT rule created when a certain network object was defined, you must
modify the relevant network object.
The Address Translation page displays both custom NAT rules and implicitly defined NAT
rules, and it allows you to create, edit, and delete custom NAT rules.
How Does Hide NAT Work?
In Hide NAT, traffic to and from the internal networks traverses an enforcement module.
When a packet from an internal network passes through the gateway, the source IP address
is changed to the hiding IP address, and the source port is changed to a dynamically
assigned port that uniquely identifies the connection. The relationship between the
dynamically assigned port and the internal IP address is recorded in the gateway’s state
tables. When reply packets arrive, the enforcement module uses the destination port to
determine to which connection the packet belongs, and then adjusts the destination port
and IP address accordingly.
388
Check Point Safe@Office User Guide
Using NAT Rules
Adding and Editing NAT Rules
This procedure explains how to add and edit custom NAT rules. You cannot add or edit an
implicitly defined NAT rule directly.
To add or edit a custom NAT rule
1.
Click Security in the main menu, and click the NAT tab.
The Address Translation page appears.
2.
Do one of the following:
•
To add a new rule, click New.
•
To edit an existing rule, click
Chapter 13: Setting Your Security Policy
next to the desired rule.
389
Using NAT Rules
The Address Translation wizard opens, with the Step 1 of 3: Original Connection Details
dialog box displayed.
3.
Complete the fields using the relevant information in the following table.
4.
Click Next.
The Step 2 of 3: Translations to Perform dialog box appears.
5.
390
Complete the fields using the relevant information in the following table.
Check Point Safe@Office User Guide
Using NAT Rules
6.
Click Next.
The Step 3 of 3: Save Address Translation dialog box appears.
7.
If desired, type a description of the rule in the field provided.
8.
Click Finish.
The new rule appears in the Address Translation page.
Table 67: Address Translation Wizard Fields
Field
The source is
Description
Select the original source of the connections you want to translate. This
list includes network objects.
To specify an IP address, select Specified IP and type the desired IP
address in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
Chapter 13: Setting Your Security Policy
391
Using NAT Rules
Field
Description
And the
Select the original destination of the connections you want to translate.
destination is
This list includes network objects.
To specify an IP address, select Specified IP and type the desired IP
address in the text box.
To specify an IP address range, select Specified Range and type the
desired IP address range in the fields provided.
To specify the Safe@Office IP addresses, select This Gateway.
To specify any destination except the Safe@Office Portal IP addresses,
select ANY.
And the service is
Select the original service used for the connections you want to translate.
This list includes network service objects.
Change the
Select the new source to which the original source should be translated.
source to
This list includes network objects.
To specify an IP address, select Specified IP and type the desired IP
address in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify that the original source should not be translated, select Don't
Change.
392
Check Point Safe@Office User Guide
Using NAT Rules
Field
Description
Change the
Select the new destination to which the original destination should be
destination to
translated. This list includes network objects.
To specify an IP address, select Specified IP and type the desired IP
address in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify that the original destination should not be translated, select
Don't Change.
Change the
Select the new service to which the original service should be translated.
service to
This list includes network service objects.
To specify that the original service should not be translated, select Don't
Change.
Viewing and Deleting NAT Rules
This procedure explains how to view all NAT rules and how to delete custom NAT rules.
You cannot delete implicitly defined NAT rules directly.
To view and delete NAT rules
1.
Click Security in the main menu, and click the NAT tab.
The Address Translation page appears with a list of all existing NAT rules.
Implicitly defined NAT rules are marked Automatic Rule in the right-most column.
2.
To delete a custom NAT rule, do the following.
a.
In the desired rule's row, click
Chapter 13: Setting Your Security Policy
393
Using the EAP Authenticator
A confirmation message appears.
b.
Click OK.
The rule is deleted.
Using the EAP Authenticator
Wi-Fi Protected Access Enterprise (WPA-Enterprise) and 802.1x are Network Access
Control (NAC) protocols that can be used to authenticate users connecting to the Check
Point Safe@Office appliance. Both WPA-Enterprise and 802.1x can be used to control
access to the wireless network; however, WPA-Enterprise has the added capability of
encrypting transmitted data, and 802.1x can be used to secure connections to the
Safe@Office appliance's LAN and DMZ ports as well.
Traditionally, WPA-Enterprise and 802.1x require installing an external Remote
Authentication Dial-In User Service (RADIUS) server. When a user tries to authenticate
using 802.1x or WPA-Enterprise, the Safe@Office appliance sends the entered user
credentials to the RADIUS server. The server then checks whether the RADIUS database
contains a matching set of credentials. If so, then the user is logged in.
While purchasing and configuring a RADIUS server may pose little challenge for a large
enterprise, such a solution may be costly and complex, and may therefore be unsuitable for
smaller networks. In such cases, it is recommended to configure the Safe@Office
appliance's built-in Extended Authentication Protocol (EAP) authenticator, which allows
using the local user database, enabling the use of WPA-Enterprise or 802.1x without an
external RADIUS server.
394
Check Point Safe@Office User Guide
Using the EAP Authenticator
Workflows
The Safe@Office built-in EAP authenticator can be used to authenticate wireless clients or
wired clients connecting to appliance ports.
Using the EAP Authenticator for Authentication of Wireless Clients
To use the EAP authenticator for authentication of wireless clients
1.
Configure the Safe@Office appliance as follows:
a.
Configure the desired wireless network for use with the EAP
authenticator.
For information on configuring the primary WLAN, see Manually Configuring a
Wireless Network on page 280. For information on configuring a VAP, see
Configuring Virtual Access Points on page 294.
Note: The Security field must set to 802.1x or WPA-Enterprise, and the Authentication
Server field must be set to Internal User Database.
b.
Ensure that the Safe@Office appliance has a certificate installed in the
Safe@Office Portal's VPN > Certificate page.
The certificate can be any of the following:
ƒ
A self-signed certificate generated by the Safe@Office appliance, version
8.0 or later.
If a self-signed certificate is installed on the appliance, but was generated by
an earlier firmware version, you must generate a new certificate. For
instructions on generating a self-signed certificate, see Generating a
Certificate on page 621.
ƒ
c.
A certificate received from the Service Center.
Export the Safe@Office appliance's CA certificate.
See Exporting the Safe@Office Appliance CA Certificate on page 630.
Chapter 13: Setting Your Security Policy
395
Using the EAP Authenticator
d.
For each client that should be allowed to connect to the Safe@Office
appliance, add a user with Network Access permissions to the local user
database.
See Adding and Editing Users on page 643.
e.
2.
Provide each of the users with the authentication credentials you
configured for them.
Configure each wireless client as follows:
a.
Configure the client for server authentication.
See Configuring Clients for Server Authentication on Wireless Connections on
page 398.
b.
3.
Install the Safe@Office appliance's CA certificate as a trusted root CA.
See Installing the Safe@Office Appliance's CA Certificate on Clients on page
403.
Connect the wireless client to the wireless network.
See Connecting Clients to the Safe@Office Appliance on page 408.
Using the EAP Authenticator for Authentication of Wired Clients
To use the EAP authenticator for authentication of wired clients
1.
Configure the Safe@Office appliance as follows:
a.
Configure the desired port for port-based security using the Safe@Office
EAP authenticator.
See Configuring Port-Based Security on page 375.
Note: The Port Security field must set to 802.1x, and the Authentication Server field must
be set to Internal User Database.
b.
396
Ensure that the Safe@Office appliance has a certificate installed in the
Safe@Office Portal's VPN > Certificate page.
Check Point Safe@Office User Guide
Using the EAP Authenticator
The certificate can be any of the following:
ƒ
A self-signed certificate generated by the Safe@Office appliance, version
8.0 or later.
If a self-signed certificate is installed on the appliance, but was generated by
an earlier firmware version, you must generate a new certificate. For
instructions on generating a self-signed certificate, see Generating a
Certificate on page 621.
ƒ
c.
A certificate received from the Service Center.
Export the Safe@Office appliance's CA certificate.
See Exporting the Safe@Office Appliance CA Certificate on page 630.
d.
For each client that should be allowed to connect to the Safe@Office
appliance, add a user with Network Access permissions to the local user
database.
See Adding and Editing Users on page 643.
e.
2.
Provide each of the users with the authentication credentials you
configured for them.
Configure each wireless client as follows:
a.
Configure the client for server authentication.
See Configuring Clients for Server Authentication on Wired Connections on
page 401.
b.
3.
Install the Safe@Office appliance's CA certificate as a trusted root CA.
See Installing the Safe@Office Appliance's CA Certificate on Clients on page
403.
Connect the client directly to the port, and enter the Network Access user's
authentication credentials when prompted.
Chapter 13: Setting Your Security Policy
397
Using the EAP Authenticator
Configuring Clients for Server Authentication on
Wireless Connections
To configure a Microsoft Windows client for server authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
3.
Double-click on the wireless network connection.
4.
Do one of the following:
•
If the Choose a Wireless Network screen appears, click Change Advanced
Settings.
• If you are already connected to a wireless network, click Properties.
The Wireless Network Connection Properties dialog box appears displaying the General
tab.
5.
Click the Wireless Networks tab.
The Wireless Networks tab appears.
6.
398
Click Add and add your network.
Check Point Safe@Office User Guide
Using the EAP Authenticator
The Wireless network properties dialog box appears displaying the Association tab.
7.
In the Network name (SSID) field, type the Safe@Office appliance wireless
network name.
8.
In the Network Authentication drop-down list, select WPA.
Note: You must select WPA, regardless of whether the Safe@Office appliance is
configured to use the WPA-Enterprise or 802.1x security protocol.
9.
In the Data encryption drop-down list, select AES.
10. Click the Authentication tab.
Chapter 13: Setting Your Security Policy
399
Using the EAP Authenticator
The Authentication tab appears.
11. In the EAP type drop-down list, select Protected EAP (PEAP).
12. Select the Authenticate as computer when computer information is available
check box.
13. Click Properties.
The Protected EAP Properties dialog box appears.
14. Make sure that the Validate server certificate check box is selected.
400
Check Point Safe@Office User Guide
Using the EAP Authenticator
15. In the Select Authentication Method drop-down list, select Secured password
(EAP-MSCHAP v2).
16. If the user credentials for connecting to the Safe@Office appliance differ from
the user credentials for connecting to Windows, do the following:
a.
Click Configure.
The EAP MSCHAPv2 Properties dialog box appears.
b.
Clear the check box.
c. Click OK.
17. Click OK in all open windows.
Configuring Clients for Server Authentication on Wired
Connections
To configure a Microsoft Windows client for server authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
3.
Right-click on Local Area Connection, and click Properties in the popup menu
that appears.
The Local Area Connection Properties dialog box appears displaying the General tab.
4.
Click the Authentication tab.
Chapter 13: Setting Your Security Policy
401
Using the EAP Authenticator
The Authentication tab appears.
5.
Select the Enable IEEE 802.1x authentication for this network check box.
6.
In the EAP type drop-down list, select Protected EAP (PEAP).
7.
Select the Authenticate as computer when computer information is available
check box.
8.
Click Properties.
The Protected EAP Properties dialog box appears.
9.
402
Make sure that the Validate server certificate check box is selected.
Check Point Safe@Office User Guide
Using the EAP Authenticator
10. In the Select Authentication Method drop-down list, select Secured password
(EAP-MSCHAP v2).
11. If the user credentials for connecting to the Safe@Office appliance differ from
the user credentials for connecting to Windows, do the following:
a.
Click Configure.
The EAP MSCHAPv2 Properties dialog box appears.
b.
Clear the check box.
c. Click OK.
12. Click OK in all open windows.
Installing the Safe@Office Appliance's CA Certificate on
Clients
To install the Safe@Office appliance's CA certificate on a Microsoft Windows client
1.
On the client, right-click on the Safe@Office appliance's CA certificate you
exported, and click Install PFX in the pop-up menu that appears.
For information on exporting the CA certificate, see Exporting the Safe@Office
Appliance CA Certificate on page 630.
Chapter 13: Setting Your Security Policy
403
Using the EAP Authenticator
The Certificate Import Wizard opens displaying the Welcome to Certificate Import Wizard
screen.
2.
Click Next.
The File to Import dialog box appears.
3.
Browse to the Safe@Office appliance's CA certificate (*.p12 file).
4.
Click Next.
404
Check Point Safe@Office User Guide
Using the EAP Authenticator
The Password dialog box appears.
Do not type a password.
5.
Click Next.
The Certificate Store dialog box appears.
6.
Click Automatically select the certificate store based on the type of certificate.
7.
Click Next.
Chapter 13: Setting Your Security Policy
405
Using the EAP Authenticator
The Completing the Certificate Import Wizard screen appears.
8.
Click Finish.
If the Safe@Office appliance certificate was self-signed, a warning message appears.
Do the following:
a.
Click Yes.
A success message appears.
9.
b. Click OK.
To check that the certificate was successfully installed as a trusted root CA, do
the following:
a.
On the client, open Internet Explorer.
b.
In the Tools menu, click Internet Options.
The Internet Options dialog box appears displaying the General tab.
c.
406
Click the Content tab.
Check Point Safe@Office User Guide
Using the EAP Authenticator
The Content tab appears.
d.
Click Certificates.
The Certificates dialog box appears.
e.
Click the Trusted Root Certification Authorities tab.
The Trusted Root Certification Authorities tab appears.
f.
In the list, locate the Safe@Office appliance's CA certificate.
Chapter 13: Setting Your Security Policy
407
Using the EAP Authenticator
The certificate's name is in the format CA-, where
 is the Safe@Office appliance's MAC address or gateway
name.
g.
To view further information about the certificate, double-click on it.
The Certificate dialog box appears with additional information.
Connecting Wireless Clients to the Safe@Office
Appliance
To connect a Microsoft Windows wireless client to the Safe@Office appliance with
WPA Enterprise authentication
1.
In the START menu, click Control Panel.
2.
Click Network Connections.
A list of wireless networks appears.
3.
Select the Safe@Office appliance wireless network.
4.
Click Connect.
408
Check Point Safe@Office User Guide
Using the EAP Authenticator
A popup message appears asking you to supply credentials.
5.
Click on the popup message.
The Enter Credentials dialog box appears.
6.
Type the Network Access user's user name and password in the fields
provided.
7.
Click OK.
The wireless client attempts to connect to the network.
Upon successful connection, the client indicates that it is connected to the network.
Chapter 13: Setting Your Security Policy
409
Overview
Chapter 14
Using SmartDefense
This chapter explains how to use Check Point SmartDefense Services.
This chapter includes the following topics:
Overview ..................................................................................................410
Configuring SmartDefense .......................................................................411
SmartDefense Categories .........................................................................419
Resetting SmartDefense to its Defaults ....................................................464
Overview
The Safe@Office appliance includes Check Point SmartDefense Services, based on Check
Point Application Intelligence. SmartDefense provides a combination of attack safeguards
and attack-blocking tools that protect your network in the following ways:
•
Validating compliance to standards
•
Validating expected usage of protocols (Protocol Anomaly Detection)
•
Limiting application ability to carry malicious data
•
Controlling application-layer operations
In addition, SmartDefense aids proper usage of Internet resources, such as FTP, instant
messaging, Peer-to-Peer (P2P) file sharing, file-sharing operations, and File Transfer
Protocol (FTP) uploading, among others.
410
Check Point Safe@Office User Guide
Configuring SmartDefense
Configuring SmartDefense
You can configure SmartDefense using the following tools:
•
SmartDefense Wizard. Resets all SmartDefense settings to their defaults, and then
creates a SmartDefense security policy according to your network and security
preferences. See Using the SmartDefense Wizard on page 411.
•
SmartDefense Tree. Enables you to fine tune individual settings in the
SmartDefense policy. You can use the SmartDefense tree instead of, or in
addition to, the wizard. See Using the SmartDefense Tree on page 417.
Using the SmartDefense Wizard
The SmartDefense Wizard allows you to configure your SmartDefense security policy
quickly and easily through its user-friendly interface.
Note: The SmartDefense wizard clears any existing SmartDefense settings.
After using the wizard, you can fine tune the policy settings using the SmartDefense tree.
See Using the SmartDefense Tree on page 417.
Chapter 14: Using SmartDefense
411
Configuring SmartDefense
To configure the SmartDefense policy using the wizard
1.
Click Security in the main menu, and click the SmartDefense tab.
The SmartDefense page appears.
2.
412
Click SmartDefense Wizard.
Check Point Safe@Office User Guide
Configuring SmartDefense
The SmartDefense Wizard opens, with the Step 1: SmartDefense Level dialog box
displayed.
3.
Drag the lever to the desired level of SmartDefense enforcement.
For information on the levels, see the following table.
4.
Click Next.
The Step 2: Application Intelligence Server Types dialog box appears.
Chapter 14: Using SmartDefense
413
Configuring SmartDefense
5.
Select the check boxes next to the types of public servers that are running on
your network.
6.
Click Next.
The Step 3: Application Blocking dialog box appears.
7.
Select the check boxes next to the types of applications you want to block
from running on your network.
8.
Click Next.
414
Check Point Safe@Office User Guide
Configuring SmartDefense
The Step 4: Confirmation dialog box appears.
9.
Click Finish.
Existing SmartDefense settings are cleared, and the security policy is applied.
Chapter 14: Using SmartDefense
415
Configuring SmartDefense
Table 68: SmartDefense Security Levels
This level…
Does this…
Minimal
Disables all SmartDefense protections, except those that cannot be disabled.
Normal
Enables the following:
•
Teardrop
•
Ping of Death
•
LAND
•
Packet Sanity
•
Max Ping Size (set to 1500)
•
Welchia
•
Cisco IOS
•
Null Payload
•
IGMP
•
Small PMTU (Log Only)
This level blocks the most common attacks.
High
Extra Strict
416
Enables the same protections as Normal level, as well as the following:
•
Host Port Scan
•
Sweep Scan
•
HTTP Header Rejection
•
Strict TCP (Log Only)
Enables the same protections as High level, as well as the following:
•
Strict TCP (Log + Block)
•
Small PMTU (Log + Block)
•
Max Ping Size (set to 512)
•
Network Quota
Check Point Safe@Office User Guide
Configuring SmartDefense
Using the SmartDefense Tree
For convenience, SmartDefense is organized as a tree, in which each branch represents a
category of settings.
When a category is expanded, the settings it contains appear as nodes. For information on
each category and the nodes it contains, see SmartDefense Categories on page 419.
Each node represents an attack type, a sanity check, or a protocol or service that is
vulnerable to attacks. To control how SmartDefense handles a specific attack, you must
configure the relevant node's settings.
Chapter 14: Using SmartDefense
417
Configuring SmartDefense
To configure a SmartDefense node
1.
Click Security in the main menu, and click the SmartDefense tab.
The SmartDefense page appears.
The left pane displays a tree containing SmartDefense categories.
•
2.
To expand a category, click the
icon next to it.
• To collapse a category, click the icon next to it.
Expand the relevant category, and click on the desired node.
The right pane displays a description of the node, followed by fields.
3.
To modify the node's current settings, do the following:
a)
Complete the fields using the relevant information in SmartDefense
Categories on page 419.
b) Click Apply.
418
Check Point Safe@Office User Guide
SmartDefense Categories
4.
To reset the node to its default values:
a)
Click Default.
A confirmation message appears.
b) Click OK.
The fields are reset to their default values, and your changes are saved.
SmartDefense Categories
SmartDefense includes the following categories:
•
Denial of Service on page 420
•
FTP on page 446
•
HTTP on page 451
•
IGMP on page 455
•
Instant Messaging Traffic on page 461
•
IP and ICMP on page 426
•
Microsoft Networks on page 453
•
Peer-to-Peer on page 459
•
Port Scan on page 444
•
TCP on page 437
•
VoIP on page 456
•
Games on page 463
Chapter 14: Using SmartDefense
419
SmartDefense Categories
Denial of Service
Denial of Service (DoS) attacks are aimed at overwhelming the target with spurious data,
to the point where it is no longer able to respond to legitimate service requests.
This category includes the following attacks:
•
DDoS Attack on page 425
•
LAND on page 422
•
Non-TCP Flooding on page 423
•
Ping of Death on page 421
•
Teardrop on page 420
Teardrop
In a Teardrop attack, the attacker sends two IP fragments, the latter entirely contained
within the former. This causes some computers to allocate too much memory and crash.
You can configure how Teardrop attacks should be handled.
420
Check Point Safe@Office User Guide
SmartDefense Categories
Table 69: Teardrop Fields
In this field…
Do this…
Action
Specify what action to take when a Teardrop attack occurs, by selecting one
of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log Teardrop attacks, by selecting one of the following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Ping of Death
In a Ping of Death attack, the attacker sends a fragmented PING request that exceeds the
maximum IP packet size (64KB). Some operating systems are unable to handle such
requests and crash.
You can configure how Ping of Death attacks should be handled.
Chapter 14: Using SmartDefense
421
SmartDefense Categories
Table 70: Ping of Death Fields
In this field…
Do this…
Action
Specify what action to take when a Ping of Death attack occurs, by selecting
one of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log Ping of Death attacks, by selecting one of the
following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
LAND
In a LAND attack, the attacker sends a SYN packet, in which the source address and port
are the same as the destination (the victim computer). The victim computer then tries to
reply to itself and either reboots or crashes.
You can configure how LAND attacks should be handled.
422
Check Point Safe@Office User Guide
SmartDefense Categories
Table 71: LAND Fields
In this field…
Do this…
Action
Specify what action to take when a LAND attack occurs, by selecting one of
the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log LAND attacks, by selecting one of the following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Non-TCP Flooding
Advanced firewalls maintain state information about connections in a State table. In NonTCP Flooding attacks, the attacker sends high volumes of non-TCP traffic. Since such
traffic is connectionless, the related state information cannot be cleared or reset, and the
firewall State table is quickly filled up. This prevents the firewall from accepting new
connections and results in a Denial of Service (DoS).
You can protect against Non-TCP Flooding attacks by limiting the percentage of state table
capacity used for non-TCP connections.
Chapter 14: Using SmartDefense
423
SmartDefense Categories
Table 72: Non-TCP Flooding Fields
In this field…
Do this…
Action
Specify what action to take when the percentage of state table capacity used
for non-TCP connections reaches the Max. percent non TCP traffic threshold.
Select one of the following:
Track
•
Block. Block any additional non-TCP connections.
•
None. No action. This is the default.
Specify whether to log non-TCP connections that exceed the Max. Percent
Non-TCP Traffic threshold, by selecting one of the following:
•
Log. Log the connections.
•
None. Do not log the connections. This is the default.
Max. Percent
Type the maximum percentage of state table capacity allowed for non-TCP
Non-TCP Traffic
connections.
The default value is 10%.
424
Check Point Safe@Office User Guide
SmartDefense Categories
DDoS Attack
In a distributed denial-of-service attack (DDoS attack), the attacker directs multiple hosts
in a coordinated attack on a victim computer or network. The attacking hosts send large
amounts of spurious data to the victim, so that the victim is no longer able to respond to
legitimate service requests.
You can configure how DDoS attacks should be handled.
Table 73: Distributed Denial of Service Fields
In this field…
Do this…
Action
Specify what action to take when a DDoS attack occurs, by selecting one of
the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log DDoS attacks, by selecting one of the following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Chapter 14: Using SmartDefense
425
SmartDefense Categories
IP and ICMP
This category allows you to enable various IP and ICMP protocol tests, and to configure
various protections against IP and ICMP-related attacks. It includes the following:
•
Checksum Verification on page 436
•
Cisco IOS DOS on page 433
•
IP Fragments on page 429
•
Max Ping Size on page 428
•
Network Quota on page 431
•
Null Payload on page 435
•
Packet Sanity on page 426
•
Welchia on page 432
Packet Sanity
Packet Sanity performs several Layer 3 and Layer 4 sanity checks. These include verifying
packet size, UDP and TCP header lengths, dropping IP options, and verifying the TCP
flags.
You can configure whether logs should be issued for offending packets.
426
Check Point Safe@Office User Guide
SmartDefense Categories
Table 74: Packet Sanity Fields
In this field…
Do this…
Action
Specify what action to take when a packet fails a sanity test, by selecting
one of the following:
Track
•
Block. Block the packet. This is the default.
•
None. No action.
Specify whether to issue logs for packets that fail the packet sanity tests, by
selecting one of the following:
•
Log. Issue logs. This is the default.
•
None. Do not issue logs.
Disable relaxed
The UDP length verification sanity check measures the UDP header length
UDP length
and compares it to the UDP header length specified in the UDP header. If
verification
the two values differ, the packet may be corrupted.
However, since different applications may measure UDP header length
differently, the Safe@Office appliance relaxes the UDP length verification
sanity check by default, performing the check but not dropping offending
packets. This is called relaxed UDP length verification.
Specify whether the Safe@Office appliance should relax the UDP length
verification sanity check or not, by selecting one of the following:
•
True. Disable relaxed UDP length verification. The Safe@Office
appliance will drop packets that fail the UDP length verification
check.
•
False. Do not disable relaxed UDP length verification. The
Safe@Office appliance will not drop packets that fail the UDP
length verification check. This is the default.
Chapter 14: Using SmartDefense
427
SmartDefense Categories
Max Ping Size
PING (ICMP echo request) is a program that uses ICMP protocol to check whether a
remote machine is up. A request is sent by the client, and the server responds with a reply
echoing the client's data.
An attacker can echo the client with a large amount of data, causing a buffer overflow.
You can protect against such attacks by limiting the allowed size for ICMP echo requests.
Table 75: Max Ping Size Fields
In this field…
Do this…
Action
Specify what action to take when an ICMP echo response exceeds the Max
Ping Size threshold, by selecting one of the following:
Track
•
Block. Block the request. This is the default.
•
None. No action.
Specify whether to log ICMP echo responses that exceed the Max Ping Size
threshold, by selecting one of the following:
428
•
Log. Log the responses. This is the default.
•
None. Do not log the responses.
Check Point Safe@Office User Guide
SmartDefense Categories
In this field…
Do this…
Max Ping Size
Specify the maximum data size for ICMP echo response.
The default value is 548.
IP Fragments
When an IP packet is too big to be transported by a network link, it is split into several
smaller IP packets and transmitted in fragments. To conceal a known attack or exploit, an
attacker might imitate this common behavior and break the data section of a single packet
into several fragmented packets. Without reassembling the fragments, it is not always
possible to detect such an attack. Therefore, the Safe@Office appliance always
reassembles all the fragments of a given IP packet, before inspecting it to make sure there
are no attacks or exploits in the packet.
You can configure how fragmented packets should be handled.
Chapter 14: Using SmartDefense
429
SmartDefense Categories
Table 76: IP Fragments Fields
In this field…
Do this…
Forbid IP Fragments
Specify whether all fragmented packets should be dropped, by selecting
one of the following:
•
True. Drop all fragmented packets.
•
False. No action. This is the default.
Under normal circumstances, it is recommended to leave this field set to
False. Setting this field to True may disrupt Internet connectivity, because
it does not allow any fragmented packets.
Max Number of
Type the maximum number of fragmented packets allowed. Packets
Incomplete Packets
exceeding this threshold will be dropped.
The default value is 300.
Timeout for
When the Safe@Office appliance receives packet fragments, it waits for
Discarding
additional fragments to arrive, so that it can reassemble the packet.
Incomplete Packets
Type the number of seconds to wait before discarding incomplete
packets.
The default value is 10.
Track
Specify whether to log fragmented packets, by selecting one of the
following:
430
•
Log. Log all fragmented packets.
•
None. Do not log the fragmented packets. This is the default.
Check Point Safe@Office User Guide
SmartDefense Categories
Network Quota
An attacker may try to overload a server in your network by establishing a very large
number of connections per second. To protect against Denial Of Service (DoS) attacks,
Network Quota enforces a limit upon the number of connections per second that are
allowed from the same source IP address.
You can configure how connections that exceed that limit should be handled.
Table 77: Network Quota Fields
In this field…
Do this…
Action
Specify what action to take when the number of network connections
from the same source reaches the Max. Connections/Second per Source IP
threshold. Select one of the following:
Track
•
Block. Block all new connections from the source. Existing
connections will not be blocked. This is the default.
•
None. No action.
Specify whether to log connections from a specific source that exceed
the Max. Connections/Second per Source IP threshold, by selecting one of
the following:
•
Log. Log the connections. This is the default.
•
None. Do not log the connections.
Chapter 14: Using SmartDefense
431
SmartDefense Categories
In this field…
Do this…
Max.
Type the maximum number of network connections allowed per second
Connections/Second
from the same source IP address.
from Same Source IP
The default value is 100.
Set a lower threshold for stronger protection against DoS attacks.
Note: Setting this value too low can lead to false alarms.
Welchia
The Welchia worm uses the MS DCOM vulnerability or a WebDAV vulnerability. After
infecting a computer, the worm begins searching for other live computers to infect. It does
so by sending a specific ping packet to a target and waiting for the reply that signals that
the target is alive. This flood of pings may disrupt network connectivity.
You can configure how the Welchia worm should be handled.
432
Check Point Safe@Office User Guide
SmartDefense Categories
Table 78: Welchia Fields
In this field…
Do this…
Action
Specify what action to take when the Welchia worm is detected, by selecting
one of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log Welchia worm attacks, by selecting one of the
following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Cisco IOS DOS
Cisco routers are configured to process and accept Internet Protocol version 4 (IPv4)
packets by default. When a Cisco IOS device is sent a specially crafted sequence of IPv4
packets (with protocol type 53 - SWIPE, 55 - IP Mobility, 77 - Sun ND, or 103 - Protocol
Independent Multicast - PIM), the router will stop processing inbound traffic on that
interface.
You can configure how Cisco IOS DOS attacks should be handled.
Chapter 14: Using SmartDefense
433
SmartDefense Categories
Table 79: Cisco IOS DOS
In this field…
Do this…
Action
Specify what action to take when a Cisco IOS DOS attack occurs,
by selecting one of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log Cisco IOS DOS attacks, by selecting one of
the following:
Number of Hops to Protect
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Type the number of hops from the enforcement module that Cisco
routers should be protected.
The default value is 10.
Action Protection for
Specify what action to take when an IPv4 packet of the specific
SWIPE - Protocol 53 /
protocol type is received, by selecting one of the following:
IP Mobility - Protocol 55 /
•
Block. Drop the packet. This is the default.
SUN-ND - Protocol 77 /
•
None. No action.
PIM - Protocol 103
434
Check Point Safe@Office User Guide
SmartDefense Categories
Null Payload
Some worms, such as Sasser, use ICMP echo request packets with null payload to detect
potentially vulnerable hosts.
You can configure how null payload ping packets should be handled.
Table 80: Null Payload Fields
In this field…
Do this…
Action
Specify what action to take when null payload ping packets are detected, by
selecting one of the following:
Track
•
Block. Block the packets. This is the default.
•
None. No action.
Specify whether to log null payload ping packets, by selecting one of the
following:
•
Log. Log the packets. This is the default.
•
None. Do not log the packets.
Chapter 14: Using SmartDefense
435
SmartDefense Categories
Checksum Verification
SmartDefense identifies any IP, TCP, or UDP packets with incorrect checksums. You can
configure how these packets should be handled.
Table 81: Checksum Verification Fields
In this field…
Do this…
Action
Specify what action to take when packets with incorrect checksums are
detected, by selecting one of the following:
Track
•
Block. Block the packets. This is the default.
•
None. No action.
Specify whether to log packets with incorrect checksums, by selecting one of
the following:
436
•
Log. Log the packets.
•
None. Do not log the packets. This is the default.
Check Point Safe@Office User Guide
SmartDefense Categories
TCP
This category allows you to configure various protections related to the TCP protocol. It
includes the following:
•
Flags on page 443
•
Sequence Verifier on page 442
•
Small PMTU on page 438
•
Strict TCP on page 437
•
SynDefender on page 440
Strict TCP
Out-of-state TCP packets are SYN-ACK or data packets that arrive out of order, before the
TCP SYN packet.
Note: In normal conditions, out-of-state TCP packets can occur after the
Safe@Office restarts, since connections which were established prior to the reboot
are unknown. This is normal and does not indicate an attack.
Note: Certain SmartDefense protections implicitly apply the Strict TCP protection to
relevant connections. In such cases, "TCP Out-of-State" log messages may appear
in the Security Log, even though the Strict TCP protection is disabled.
You can configure how out-of-state TCP packets should be handled.
Chapter 14: Using SmartDefense
437
SmartDefense Categories
Table 82: Strict TCP
In this field…
Do this…
Action
Specify what action to take when an out-of-state TCP packet arrives, by
selecting one of the following:
Track
•
Block. Block the packets.
•
None. No action. This is the default.
Specify whether to log null payload ping packets, by selecting one of the
following:
•
Log. Log the packets. This is the default.
•
None. Do not log the packets.
Small PMTU
Small PMTU (Packet MTU) is a bandwidth attack in which the client fools the server into
sending large amounts of data using small packets. Each packet has a large overhead that
creates a "bottleneck" on the server.
You can protect against this attack by specifying a minimum packet size for data sent over
the Internet.
438
Check Point Safe@Office User Guide
SmartDefense Categories
Table 83: Small PMTU Fields
In this field…
Do this…
Action
Specify what action to take when a packet is smaller than the Minimal MTU
Size threshold, by selecting one of the following:
Track
•
Block. Block the packet.
•
None. No action. This is the default.
Specify whether to issue logs for packets are smaller than the Minimal MTU
Size threshold, by selecting one of the following:
•
Log. Issue logs. This is the default.
•
None. Do not issue logs.
Minimal MTU
Type the minimum value allowed for the MTU field in IP packets sent by a
Size
client.
An overly small value will not prevent an attack, while an overly large value
might degrade performance and cause legitimate requests to be dropped.
The default value is 300.
Chapter 14: Using SmartDefense
439
SmartDefense Categories
SynDefender
In a SYN attack, the attacker sends many SYN packets without finishing the three-way
handshake. This causes the attacked host to be unable to accept new connections.
You can protect against this attack by specifying a maximum amount of time for
completing handshakes.
Table 84: SynDefender Fields
In this field…
Do this…
Action
Specify what action to take when a SYN attack occurs, by selecting one of
the following:
•
Block. Block the packet. This is the default.
•
None. No action.
A SYN attack is when more than 5 incomplete TCP handshakes are
detected within 10 seconds. A handshake is considered incomplete when it
exceeds the Maximum time for completing the handshake threshold.
Track
Specify whether to issue logs for the events specified by the Log Mode
parameter, by selecting one of the following:
440
•
Log. Issue logs. This is the default.
•
None. Do not issue logs.
Check Point Safe@Office User Guide
SmartDefense Categories
In this field…
Do this…
Log mode
Specify upon which events logs should be issued, by selecting one of the
following:
•
None. Do not issue logs.
•
Log per attack. Issue logs for each SYN attack. This is the default.
•
Log individual unfinished handshakes. Issue logs for each incomplete
handshake.
This field is only relevant if the Track field is set to Log.
Maximum Time
Type the maximum amount of time in seconds after which a TCP handshake
for Completing
is considered incomplete.
the Handshake
The default value is 10 seconds.
Protect external
Specify whether SynDefender should be enabled for external (WAN)
interfaces only
interfaces only, by selecting one of the following:
•
Disabled. Enable SynDefender for all the firewall interfaces. This
is the default.
•
Enabled. Enable SynDefender for external interfaces only.
Chapter 14: Using SmartDefense
441
SmartDefense Categories
Sequence Verifier
The Safe@Office appliance examines each TCP packet's sequence number and checks
whether it matches a TCP connection state. You can configure how the appliance handles
packets that match a TCP connection in terms of the TCP session but have incorrect
sequence numbers.
Table 85: Strict TCP
In this field…
Do this…
Action
Specify what action to take when TCP packets with incorrect sequence
numbers arrive, by selecting one of the following:
Track
•
Block. Block the packets.
•
None. No action. This is the default.
Specify whether to log TCP packets with incorrect sequence numbers, by
selecting one of the following:
442
•
Log. Log the packets. This is the default.
•
None. Do not log the packets.
Check Point Safe@Office User Guide
SmartDefense Categories
Flags
The URG flag is used to indicate that there is urgent data in the TCP stream, and that the
data should be delivered with high priority. Since handling of the URG flag is inconsistent
between different operating systems, an attacker can use the URG flag to conceal certain
attacks.
You can configure how the URG flag should be handled.
Table 86: Flags Fields
In this field…
Do this…
URG Flag
Specify whether to clear or allow the URG flag, by selecting one of the
following:
•
Clear. Clear the URG flag on all incoming packets. This is the
default.
•
Allow. Allow the URG flag.
Chapter 14: Using SmartDefense
443
SmartDefense Categories
Port Scan
An attacker can perform a port scan to determine whether ports are open and vulnerable to
an attack. This is most commonly done by attempting to access a port and waiting for a
response. The response indicates whether or not the port is open.
This category includes the following types of port scans:
•
Host Port Scan. The attacker scans a specific host's ports to determine which of
the ports are open.
•
Sweep Scan. The attacker scans various hosts to determine where a specific port
is open.
You can configure how the Safe@Office appliance should react when a port scan is
detected.
444
Check Point Safe@Office User Guide
SmartDefense Categories
Table 87: Port Scan Fields
In this field…
Do this…
Number of ports
SmartDefense detects ports scans by measuring the number of ports
accessed
accessed over a period of time. The number of ports accessed must exceed
the Number of ports accessed value, within the number of seconds specified by
the In a period of [seconds] value, in order for SmartDefense to consider the
activity a scan.
Type the minimum number of ports that must be accessed within the In a
period of [seconds] period, in order for SmartDefense to detect the activity as
a port scan.
For example, if this value is 30, and 40 ports are accessed within a specified
period of time, SmartDefense will detect the activity as a port scan.
For Host Port Scan, the default value is 30. For Sweep Scan, the default
value is 50.
In a period of
SmartDefense detects ports scans by measuring the number of ports
[seconds]
accessed over a period of time. The number of ports accessed must exceed
the Number of ports accessed value, within the number of seconds specified by
the In a period of [seconds] value, in order for SmartDefense to consider the
activity a scan.
Type the maximum number of seconds that can elapse, during which the
Number of ports accessed threshold is exceeded, in order for SmartDefense to
detect the activity as a port scan.
For example, if this value is 20, and the Number of ports accessed threshold is
exceeded for 15 seconds, SmartDefense will detect the activity as a port
scan. If the threshold is exceeded for 30 seconds, SmartDefense will not
detect the activity as a port scan.
The default value is 20 seconds.
Chapter 14: Using SmartDefense
445
SmartDefense Categories
In this field…
Do this…
Track
Specify whether to issue logs for scans, by selecting one of the following:
•
Log. Issue logs. This is the default.
•
None. Do not issue logs. This is the default.
Detect scans
Specify whether to detect only scans originating from the Internet, by
from Internet only
selecting one of the following:
•
False. Do not detect only scans from the Internet. This is the
default.
•
True. Detect only scans from the Internet.
FTP
This category allows you to configure various protections related to the FTP protocol. It
includes the following:
•
Block Known Ports on page 448
•
Block Port Overflow on page 449
•
Blocked FTP Commands on page 450
•
FTP Bounce on page 447
446
Check Point Safe@Office User Guide
SmartDefense Categories
FTP Bounce
When connecting to an FTP server, the client sends a PORT command specifying the IP
address and port to which the FTP server should connect and send data. An FTP Bounce
attack is when an attacker sends a PORT command specifying the IP address of a third
party instead of the attacker's own IP address. The FTP server then sends data to the victim
machine.
You can configure how FTP bounce attacks should be handled.
Table 88: FTP Bounce Fields
In this field…
Do this…
Action
Specify what action to take when an FTP Bounce attack occurs, by selecting
one of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log FTP Bounce attacks, by selecting one of the
following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Chapter 14: Using SmartDefense
447
SmartDefense Categories
Block Known Ports
You can choose to block the FTP server from connecting to well-known ports.
Note: Known ports are published ports associated with services (for example, SMTP
is port 25).
This provides a second layer of protection against FTP bounce attacks, by preventing such
attacks from reaching well-known ports.
Table 89: Block Known Ports Fields
In this field…
Do this…
Action
Specify what action to take when the FTP server attempts to connect to a
well-known port, by selecting one of the following:
448
•
Block. Block the connection.
•
None. No action. This is the default.
Check Point Safe@Office User Guide
SmartDefense Categories
Block Port Overflow
FTP clients send PORT commands when connecting to the FTP sever. A PORT command
consists of a series of numbers between 0 and 255, separated by commas.
To enforce compliance to the FTP standard and prevent potential attacks against the FTP
server, you can block PORT commands that contain a number greater than 255.
Table 90: Block Port Overflow
In this field…
Do this…
Action
Specify what action to take for PORT commands containing a number
greater than 255, by selecting one of the following:
•
Block. Block the PORT command. This is the default.
•
None. No action.
Chapter 14: Using SmartDefense
449
SmartDefense Categories
Blocked FTP Commands
Some seldom-used FTP commands may compromise FTP server security and integrity.
You can specify which FTP commands should be allowed to pass through the security
server, and which should be blocked.
To enable FTP command blocking
•
In the Action drop-down list, select Block.
The FTP commands listed in the Blocked Commands box will be blocked.
FTP command blocking is enabled by default.
To disable FTP command blocking
•
In the Action drop-down list, select None.
All FTP commands are allowed, including those in the Blocked Commands box.
To block a specific FTP command
1.
In the Allowed Commands box, select the desired FTP command.
2.
Click Block.
The FTP command appears in the Blocked Commands box.
3.
Click Apply.
When FTP command blocking is enabled, the FTP command will be blocked.
450
Check Point Safe@Office User Guide
SmartDefense Categories
To allow a specific FTP command
1.
In the Blocked Commands box, select the desired FTP command.
2.
Click Accept.
The FTP command appears in the Allowed Commands box.
3.
Click Apply.
The FTP command will be allowed, regardless of whether FTP command blocking is
enabled or disabled.
HTTP
This category allows you to configure various protections related to the HTTP protocol. It
includes the following:
•
Header Rejection on page 451
•
Worm Catcher on page 452
Header Rejection
Some exploits are carried in standard HTTP headers with custom values (for example, in
the Host header), or in custom HTTP headers. You can protect against such exploits by
rejecting HTTP requests that contain specific headers and header values.
Chapter 14: Using SmartDefense
451
SmartDefense Categories
Table 91: Header Rejection Fields
In this field…
Do this…
Action
Specify what action to take when an HTTP header-based exploit is
detected, by selecting one of the following:
Track
•
Block. Block the attack.
•
None. No action. This is the default.
Specify whether to log HTTP header-based exploits, by selecting one of
the following:
HTTP header values
•
Log. Log the attack.
•
None. Do not log the attack. This is the default.
Select the HTTP header values to detect.
list
Worm Catcher
A worm is a self-replicating malware (malicious software) that propagates by actively
sending itself to new machines. Some worms propagate by using security vulnerabilities in
the HTTP protocol.
You can specify how HTTP-based worm attacks should be handled.
452
Check Point Safe@Office User Guide
SmartDefense Categories
Table 92: Worm Catcher Fields
In this field…
Do this…
Action
Specify what action to take when an HTTP-based worm attack is
detected, by selecting one of the following:
Track
•
Block. Block the attack.
•
None. No action. This is the default.
Specify whether to log HTTP-based worm attacks, by selecting one of
the following:
HTTP-based worm
•
Log. Log the attack.
•
None. Do not log the attack. This is the default.
Select the worm patterns to detect.
patterns list
Microsoft Networks
This category includes File and Print Sharing.
Microsoft operating systems and Samba clients rely on Common Internet File System
(CIFS), a protocol for sharing files and printers. However, this protocol is also widely used
by worms as a means of propagation.
You can configure how CIFS worms should be handled.
Chapter 14: Using SmartDefense
453
SmartDefense Categories
Table 93: File Print and Sharing Fields
In this field…
Do this…
Action
Specify what action to take when a CIFS worm attack is detected, by
selecting one of the following:
Track
•
Block. Block the attack.
•
None. No action. This is the default.
Specify whether to log CIFS worm attacks, by selecting one of the
following:
•
•
CIFS worm patterns
list
454
Log. Log the attack.
None. Do not log the attack. This is the default.
Select the worm patterns to detect.
Patterns are matched against file names (including file paths but
excluding the disk share name) that the client is trying to read or
write from the server.
Check Point Safe@Office User Guide
SmartDefense Categories
IGMP
This category includes the IGMP protocol.
IGMP is used by hosts and routers to dynamically register and discover multicast group
membership. Attacks on the IGMP protocol usually target a vulnerability in the multicast
routing software/hardware used, by sending specially crafted IGMP packets.
You can configure how IGMP attacks should be handled.
Table 94: IGMP Fields
In this field…
Do this…
Action
Specify what action to take when an IGMP attack occurs, by selecting
one of the following:
Track
•
Block. Block the attack. This is the default.
•
None. No action.
Specify whether to log IGMP attacks, by selecting one of the following:
•
Log. Log the attack. This is the default.
•
None. Do not log the attack.
Chapter 14: Using SmartDefense
455
SmartDefense Categories
In this field…
Do this…
Enforce IGMP to
According to the IGMP specification, IGMP packets must be sent to
multicast addresses
multicast addresses. Sending IGMP packets to a unicast or broadcast
address might constitute and attack; therefore the Safe@Office appliance
blocks such packets.
Specify whether to allow or block IGMP packets that are sent to nonmulticast addresses, by selecting one of the following:
•
Block. Block IGMP packets that are sent to non-multicast
addresses. This is the default.
•
None. No action.
VoIP
Voice over IP (VoIP) traffic is subject to various threats, such as:
•
Call redirections, in which calls intended for one recipient are redirected to
another
•
Stealing calls, where the caller pretends to be someone else
•
System hacking, using ports that were opened for VoIP connections
This category allows you to configure various protections related to VoIP protocols. It
includes the following:
•
SIP on page 457
•
H.323 on page 458
456
Check Point Safe@Office User Guide
SmartDefense Categories
SIP
The SmartDefense SIP Application Level Gateway (ALG) processes the SIP protocol,
allows firewall and NAT traversal, and enables Traffic Shaper to operate on SIP
connections.
By default, the SIP ALG checks SIP sessions for RFC compliance. If desired, you can
allow non-RFC-compliant SIP connections, so that VoIP devices that initiate non-standard
SIP calls can communicate through the firewall. You can also disable the SIP ALG
altogether, if it is not needed by your SIP clients, or if it interferes with their operation.
Table 95: SIP Fields
In this field…
Do this…
SIP Protocol
Specify whether to enable SIP support, by selecting one of the following:
Handler
•
Enabled. Enable SIP support. This is the default.
•
Disabled. Disable SIP support.
RFC Non-
Specify what action to take when non-RFC-compliant SIP packets arrive, by
compliant
selecting one of the following:
Messages
•
Block. Block the packets. This is the default.
•
None. No action.
Chapter 14: Using SmartDefense
457
SmartDefense Categories
H.323
H.323 telephony is used by various devices and applications, such as Microsoft
Netmeeting. SmartDefense allows you to choose whether to disable or enable the H.323
Application Level Gateway (ALG), which allows firewall and NAT traversal of H.323
calls.
Table 96: H.323 Fields
In this field…
Do this…
Peer-to-peer
Specify whether to enable H.323 support, by selecting one of the following:
H.323 Support
•
Enabled. Enable H.323 support.
•
Disabled. Disabled H.323 support. This is the default.
458
Check Point Safe@Office User Guide
SmartDefense Categories
Peer-to-Peer
SmartDefense can block peer-to-peer file-sharing traffic, by identifying the proprietary
protocols and preventing the initial connection to the peer-to-peer networks. This prevents
not only downloads, but also search operations.
This category includes the following nodes:
•
BitTorrent
•
eMule
•
Gnutella
•
KaZaA
•
Winny
Note: SmartDefense can detect peer-to-peer traffic regardless of the TCP port being
used to initiate the session.
In each node, you can configure how peer-to-peer connections of the selected type should
be handled, using the following table.
Chapter 14: Using SmartDefense
459
SmartDefense Categories
Table 97: Peer to Peer Fields
In this field…
Do this…
Action
Specify what action to take when a connection is attempted, by selecting
one of the following:
Track
•
Block. Block the connection.
•
None. No action. This is the default.
Specify whether to log peer-to-peer connections, by selecting one of the
following:
•
Log. Log the connection.
•
None. Do not log the connection. This is the default.
Block proprietary
Specify whether proprietary protocols should be blocked on all ports, by
protocols on all ports
selecting one of the following:
•
Block. Block the proprietary protocol on all ports. This in effect
prevents all communication using this peer-to-peer
application. This is the default.
•
None. Do not block the proprietary protocol on all ports.
Block masquerading
Specify whether to block using the peer-to-peer application over HTTP,
over HTTP protocol
by selecting one of the following:
•
Block. Block using the application over HTTP. This is the
default.
•
None. Do not block using the application over HTTP.
This field is not relevant for eMule and Winny.
460
Check Point Safe@Office User Guide
SmartDefense Categories
Instant Messaging Traffic
SmartDefense can block instant messaging applications that use VoIP protocols, by
identifying the messaging application's fingerprints and HTTP headers.
This category includes the following nodes:
•
ICQ
•
MSN Messenger
•
Skype
•
Yahoo
Note: SmartDefense can detect instant messaging traffic regardless of the TCP port
being used to initiate the session.
Note: Skype versions up to 2.0.0.103 are supported.
In each node, you can configure how instant messaging connections of the selected type
should be handled, using the following table.
Chapter 14: Using SmartDefense
461
SmartDefense Categories
Table 98: Instant Messengers Fields
In this field…
Do this…
Action
Specify what action to take when a connection is attempted, by selecting
one of the following:
Track
•
Block. Block the connection.
•
None. No action. This is the default.
Specify whether to log instant messenger connections, by selecting one
of the following:
•
Log. Log the connection.
•
None. Do not log the connection. This is the default.
Block proprietary
Specify whether proprietary protocols should be blocked on all ports, by
protocol /
selecting one of the following:
Block proprietary
•
Block. Block the proprietary protocol on all ports. This in effect
prevents all communication using this instant messenger
application. This is the default.
•
None. Do not block the proprietary protocol on all ports.
protocols on all ports
Block masquerading
Specify whether to block using the instant messenger application over
over HTTP protocol
HTTP, by selecting one of the following:
462
•
Block. Block using the application over HTTP. This is the
default.
•
None. Do not block using the application over HTTP.
Check Point Safe@Office User Guide
SmartDefense Categories
Games
This category includes XBox LIVE.
XBox 360 requires gateways hosting XBox LIVE games to use the "Open NAT" method
rather than the normal "Strict NAT" method. Therefore, if you want to host online games
on an XBox 360 console, you must first configure your Safe@Office appliance to use the
"Open NAT" method.
Table 99: XBox LIVE Fields
In this field…
Do this…
Xbox Live OpenNAT
Specify whether the Safe@Office appliance should use the "Open NAT"
method, by selecting one of the following:
•
Enabled. Use the "Open NAT" method. You will be able to host
XBox LIVE games and join existing ones.
•
Disabled. Do not use the "Open NAT" method. You will not be
able to host XBox LIVE games, but you will still be able to join
existing ones. This is the default.
Chapter 14: Using SmartDefense
463
Resetting SmartDefense to its Defaults
Resetting SmartDefense to its Defaults
If desired, you can reset the SmartDefense security policy to its default settings. For
information on the default value of each SmartDefense setting, see SmartDefense
Categories on page 419.
For information on resetting individual nodes in the SmartDefense tree to their default
settings, see Using the SmartDefense Tree on page 417.
To reset SmartDefense to its defaults
1.
Click Security in the main menu, and click the SmartDefense tab.
The SmartDefense page appears.
2.
Click Reset to Defaults.
A confirmation message appears.
3.
Click OK.
The SmartDefense policy is reset to its default settings.
464
Check Point Safe@Office User Guide
Overview
Chapter 15
Using Antivirus and Antispam Filtering
This chapter explains how to use antivirus and antispam filtering.
This chapter includes the following topics:
Overview ..................................................................................................465
Using VStream Antivirus .........................................................................467
Using VStream Antispam.........................................................................487
Using Centralized Email Filtering ............................................................521
Overview
The Safe@Office appliance enables you to perform both antivirus and antispam filtering,
to ensure your network remains secure.
Antivirus Filtering Solutions
You can scan connections for viruses, by using VStream Antivirus and/or the Email
Antivirus subscription service (part of the centralized Email Filtering service). The
following table describes the main differences between VStream Antivirus and the Email
Antivirus service:
Table 100: Comparison of Antivirus Filtering Methods
VStream Antivirus
Email Antivirus
Supported
VStream Antivirus supports
Email Antivirus is specific to email,
Protocols
multiple protocols, including
scanning incoming POP3 and outgoing
incoming SMTP and outgoing
SMTP connections only.
POP3 connections.
Chapter 15: Using Antivirus and Antispam Filtering
465
Overview
Point of Enforcement
VStream Antivirus
Email Antivirus
VStream Antivirus scans for
Email Antivirus is centralized, redirecting
viruses in the Safe@Office
traffic through the Service Center for
gateway itself.
scanning.
You can use either antivirus solution, or both in conjunction.
Antispam Filtering Solutions
You can scan email messages for spam, by using VStream Antispam and/or the Email
Antispam subscription service (part of the centralized Email Filtering service). The
following table describes the main differences between VStream Antispam and the Email
Antispam service:
Table 101: Comparison of Antispam Filtering Methods
VStream Antispam
Email Antispam
Supported
VStream Antispam supports
Email Antispam scans incoming POP3
Protocols
both incoming and outgoing
and outgoing SMTP connections only.
POP3 and SMTP, as well as
POP3 and SMTP connections
between internal networks.
Point of Enforcement
VStream Antispam scans for
Email Antispam is centralized, redirecting
spam in the Safe@Office
traffic through the Service Center for
gateway itself.
scanning.
You can use either antispam solution, or both in conjunction.
466
Check Point Safe@Office User Guide
Using VStream Antivirus
Using VStream Antivirus
The Safe@Office appliance includes VStream Antivirus, an embedded stream-based
antivirus engine based on Check Point Stateful Inspection and Application Intelligence
technologies, that performs virus scanning at the kernel level.
VStream Antivirus scans files for malicious content on the fly, without downloading the
files into intermediate storage. This means minimal added latency and support for
unlimited file sizes; and since VStream Antivirus stores only minimal state information per
connection, it can scan thousands of connections concurrently. In order to scan archive
files on the fly, VStream Antivirus performs real-time decompression and scanning of ZIP,
TAR, and GZ archive files, with support for nested archive files.
If you are subscribed to the VStream Antivirus subscription service, VStream Antivirus
virus signatures are automatically updated, so that security is always up-to-date, and your
network is always protected.
VStream Antivirus Actions
When VStream Antivirus detects malicious content, the action it takes depends on the
protocol in which the virus was found. See the following table. In each case, VStream
Antivirus blocks the file and writes a log to the Event Log.
Table 102: VStream Antivirus Actions
If a virus if found in
VStream Antivirus does this...
The protocol is detected
HTTP
•
All ports on which VStream
this protocol...
Terminates the
connection
on this port...
Antivirus is enabled by the
policy, not only port 80
Chapter 15: Using Antivirus and Antispam Filtering
467
Using VStream Antivirus
If a virus if found in
VStream Antivirus does this...
The protocol is detected
POP3
•
Terminates the
connection
The standard TCP port 110.
•
Deletes the virusinfected email from the
server
•
Terminates the
connection
•
Replaces the virusinfected email with a
message notifying the
user that a virus was
found
•
Rejects the virusinfected email with error
code 554
•
Sends a "Virus
detected" message to
the sender
•
Terminates the data
connection
•
Sends a "Virus detected"
message to the FTP
client
•
Terminates the
connection
this protocol...
IMAP
SMTP
FTP
TCP and UDP
on this port...
The standard TCP port 143
The standard TCP port 25
The standard TCP port 21
Generic TCP and UDP ports,
other than those listed above
Note: In protocols that are not listed in this table, VStream Antivirus uses a "best
effort" approach to detect viruses. In such cases, detection of viruses is not
guaranteed and depends on the specific encoding used by the protocol.
468
Check Point Safe@Office User Guide
Using VStream Antivirus
Default Antivirus Policy
The VStream Antivirus default policy includes the following rules:
•
All SMTP connections are scanned, regardless of the connection's direction.
•
All POP3 connections are scanned, regardless of the connection's direction.
•
All IMAP connections are scanned, regardless of the connection's direction.
You can easily override the default antivirus policy, by creating user-defined rules. For
further information, see Configuring the VStream Antivirus Policy on page 471.
Enabling/Disabling VStream Antivirus
To enable/disable VStream Antivirus
1.
Click Antivirus in the main menu, and click the Antivirus tab.
Chapter 15: Using Antivirus and Antispam Filtering
469
Using VStream Antivirus
The VStream Antivirus page appears.
2.
Drag the On/Off lever upwards or downwards.
VStream Antivirus is enabled/disabled for all internal network computers.
Viewing VStream Antivirus Signature Database
Information
VStream Antivirus maintains two databases: a daily database and a main database. The
daily database is updated frequently with the newest virus signatures. Periodically, the
contents of the daily database are moved to the main database, leaving the daily database
empty. This system of incremental updates to the main database allows for quicker updates
and saves on network bandwidth.
You can view information about the VStream Antivirus signature databases currently in
use, in the VStream Antivirus page.
470
Check Point Safe@Office User Guide
Using VStream Antivirus
Table 103: VStream Antivirus Page Fields
This field…
Displays…
Main database
The date and time at which the main database was last updated,
followed by the version number.
Daily database
The date and time at which the daily database was last updated, followed
by the version number.
Next update
The next date and time at which the Safe@Office appliance will check for
updates.
Status
The current status of the database. This includes the following statuses:
•
Database Not Installed
•
OK
Configuring the VStream Antivirus Policy
VStream Antivirus includes a flexible mechanism that allows the user to define exactly
which traffic should be scanned, by specifying the protocol, ports, and source and
destination IP addresses.
VStream Antivirus processes policy rules in the order they appear in the Antivirus Policy
table, so that rule 1 is applied before rule 2, and so on. This enables you to define
exceptions to rules, by placing the exceptions higher up in the Rules table.
Chapter 15: Using Antivirus and Antispam Filtering
471
Using VStream Antivirus
For example, if you want to scan all outgoing SMTP traffic, except traffic from a specific
IP address, you can create a rule scanning all outgoing SMTP traffic and move the rule
down in the Antivirus Policy table. Then create a rule passing SMTP traffic from the
desired IP address and move this rule to a higher location in the Antivirus Policy table than
the first rule. In the figure below, the general rule is rule number 2, and the exception is
rule number 1.
The Safe@Office appliance will process rule 1 first, passing outgoing SMTP traffic from
the specified IP address, and only then it will process rule 2, scanning all outgoing SMTP
traffic.
472
Check Point Safe@Office User Guide
Using VStream Antivirus
The following rule types exist:
Table 104: VStream Antivirus Rule Types
Rule
Description
Pass
This rule type enables you to specify that VStream Antivirus should not scan
traffic matching the rule.
Scan
This rule type enables you to specify that VStream Antivirus should scan traffic
matching the rule.
If a virus is found, it is blocked and logged.
Adding and Editing VStream Antivirus Rules
To add or edit a VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
Chapter 15: Using Antivirus and Antispam Filtering
473
Using VStream Antivirus
The Antivirus Policy page appears.
2.
474
Do one of the following:
•
To add a new rule, click Add Rule.
•
To edit an existing rule, click
next to the desired rule.
Check Point Safe@Office User Guide
Using VStream Antivirus
The VStream Policy Rule Wizard opens, with the Step 1: Rule Type dialog box
displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Service dialog box appears.
The example below shows a Scan rule.
Chapter 15: Using Antivirus and Antispam Filtering
475
Using VStream Antivirus
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The Step 3: Destination & Source dialog box appears.
7.
To configure advanced settings, click Show Advanced Settings.
New fields appear.
476
Check Point Safe@Office User Guide
Using VStream Antivirus
8.
Complete the fields using the relevant information in the following table.
9.
Click Next.
The Step 4: Done dialog box appears.
10. If desired, type a description of the rule in the field provided.
11. Click Finish.
The new rule appears in the Antivirus Policy page.
Chapter 15: Using Antivirus and Antispam Filtering
477
Using VStream Antivirus
Table 105: VStream Antivirus Rule Fields
In this field…
Do this…
Any Service
Click this option to specify that the rule should apply to any service.
Standard
Click this option to specify that the rule should apply to a specific standard
Service
service or network service object.
You must then select the desired service or network service object from the
drop-down list.
Custom Service
Click this option to specify that the rule should apply to a specific nonstandard service.
The Protocol and Port Range fields are enabled. You must fill them in.
Protocol
Select the protocol (TCP, UDP, or ANY) for which the rule should apply.
Port Range
To specify the port range to which the rule applies, type the start port
number in the left text box, and the end port number in the right text box.
Note: If you do not enter a port range, the rule will apply to all ports. If you
enter only one port number, the range will include only that port.
If the
Select the source of the connections you want to allow/block. This list
connection
includes network objects.
source is
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify any source, select ANY.
478
Check Point Safe@Office User Guide
Using VStream Antivirus
In this field…
Do this…
And the
Select the destination of the connections you want to allow or block. This list
destination is
includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the text box.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify the Safe@Office IP addresses, select This Gateway.
To specify any destination except the Safe@Office Portal IP addresses,
select ANY.
Data Direction
Select the direction of connections to which the rule should apply:
•
Download and Upload data. The rule applies to downloaded and
uploaded data. This is the default.
•
Download data. The rule applies to downloaded data, that is, data
flowing from the destination of the connection to the source of the
connection.
•
Upload data. The rule applies to uploaded data, that is, data flowing
from the source of the connection to the destination of the
connection.
If the current time
Select this option to specify that the rule should be applied only during
is
certain hours of the day.
You must then use the fields and drop-down lists provided, to specify the
desired time range.
Chapter 15: Using Antivirus and Antispam Filtering
479
Using VStream Antivirus
Enabling/Disabling VStream Antivirus Rules
You can temporarily disable a VStream Antivirus rule.
To enable/disable a VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears.
2.
Next to the desired rule, do one of the following:
•
To enable the rule, click
The button changes to
•
To disable the rule, click
The button changes to
and the rule is enabled.
and the rule is disabled.
Reordering VStream Antivirus Rules
To reorder VStream Antivirus rules
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears.
2.
480
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Check Point Safe@Office User Guide
Using VStream Antivirus
Viewing and Deleting VStream Antivirus Rules
To view or delete an existing VStream Antivirus rule
1.
Click Antivirus in the main menu, and click the Policy tab.
The Antivirus Policy page appears with a list of existing VStream Antivirus rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
In the desired rule's row, click
A confirmation message appears.
b.
Click OK.
The rule is deleted.
Chapter 15: Using Antivirus and Antispam Filtering
481
Using VStream Antivirus
Configuring VStream Antivirus Advanced Settings
To configure VStream Antivirus advanced settings
1.
Click Antivirus in the main menu, and click the Advanced tab.
The Advanced Antivirus Settings page appears.
2.
Complete the fields using the following table.
3.
Click Apply.
4.
To restore the default VStream Antivirus settings, do the following:
a)
Click Default.
A confirmation message appears.
b) Click OK.
482
Check Point Safe@Office User Guide
Using VStream Antivirus
The VStream Antivirus settings are reset to their defaults. For information on the
default values, refer to the following table.
Table 106: Advanced Antivirus Settings Fields
In this field…
Do this…
File Types
Block potentially unsafe
Select this option to block all emails containing potentially unsafe
file types in email
attachments.
messages
Unsafe file types are:
•
DOS/Windows executables, libraries and drivers
•
Compiled HTML Help files
•
VBScript encoded files
•
Files with {CLSID} in their name
•
The following file extensions: ade, adp, bas, bat, chm,
cmd,com, cpl, crt, exe, hlp, hta, inf, ins, isp, js, jse,
lnk, mdb, mde, msc, msi, msp, mst, pcd, pif, reg, scr,
sct, shs,shb, url, vb, vbe, vbs, wsc, wsf, wsh.
To view a list of unsafe file types and their descriptions, click
Show next to this option.
Chapter 15: Using Antivirus and Antispam Filtering
483
Using VStream Antivirus
In this field…
Do this…
Pass safe file types
Select this option to accept common file types that are known to
without scanning
be safe, without scanning them.
Safe files types are:
•
GIF
•
BMP
•
JFIF standard
•
EXIF standard
•
PNG
•
MPEG video stream
•
MPEG sys stream
•
Ogg Stream
•
MP3 file with ID3 version 2
•
MP3
•
PDF
•
PostScript
•
WMA/WMV/ASF
•
RealMedia file
•
JPEG - only the header is scanned, and the rest of
the file is skipped
To view a list of safe file types, click Show next to this option.
Selecting this option reduces the load on the gateway by skipping
safe file types. This option is selected by default.
484
Check Point Safe@Office User Guide
Using VStream Antivirus
In this field…
Do this…
Archive File Handling
Maximum Nesting Level
Type the maximum number of nested content levels that
VStream Antivirus should scan.
Setting a higher number increases security. Setting a lower
number prevents attackers from overloading the gateway by
sending extremely nested archive files.
The default value is 5 levels.
Maximum Compression
Fill in the field to complete the maximum compression ratio of
Ratio 1:x
files that VStream Antivirus should scan.
For example, to specify a 1:80 maximum compression ratio, type
80.
Setting a higher number allows the scanning of highly
compressed files, but creates a potential for highly compressible
files to create a heavy load on the appliance. Setting a lower
number prevents attackers from overloading the gateway by
sending extremely compressible files.
The default value is 100.
When archived file
Specify how VStream Antivirus should handle files that exceed
exceeds limit or extraction
the Maximum nesting level or the Maximum compression ratio, and
fails
files for which scanning fails. Select one of the following:
•
Pass file without scanning. Scan only the number of
levels specified, and skip the scanning of more deeply
nested archives. Furthermore, skip scanning highly
compressible files, and skip scanning archives that
cannot be extracted because they are corrupt. This is
the default.
•
Block file. Block the file.
Chapter 15: Using Antivirus and Antispam Filtering
485
Using VStream Antivirus
In this field…
Do this…
When a password-protected
VStream Antivirus cannot extract and scan password-protected
file is found in archive
files inside archives. Specify how VStream Antivirus should handle
such files, by selecting one of the following:
•
Pass file without scanning. Accept the file without
scanning it. This is the default.
•
Block file. Block the file.
Corrupt Files
When a corrupt file is
Specify how VStream Antivirus should handle corrupt files and
found or decoding fails
protocol anomalies, by selecting one of the following:
•
Ignore and continue scanning. Log the corrupt file or
protocol anomaly, and scan the information on a besteffort basis. This is the default.
•
Block file. Block and log the corrupt file or protocol
anomaly.
Updating VStream Antivirus
When you are subscribed to the VStream Antivirus updates service, VStream Antivirus
virus signatures are automatically updated, keeping security up-to-date with no need for
user intervention. However, you can still check for updates manually, if needed.
To update the VStream Antivirus virus signature database
1.
Click Antivirus in the main menu, and click the Antivirus tab.
The VStream Antivirus page appears.
2.
Click Update Now.
The VStream Antivirus database is updated with the latest virus signatures.
486
Check Point Safe@Office User Guide
Using VStream Antispam
Using VStream Antispam
The Safe@Office appliance includes VStream Antispam, an embedded antispam engine
that scans emails for spam. VStream Antispam is composed three antispam engines, each
of which can be enabled or disabled separately:
•
IP Reputation
The IP Reputation engine protects mail servers by checking the email sender’s IP
address against an online and constantly updated IP reputation database, before
accepting the SMTP email connection. If the IP address belongs to a known spammer,
the connection can be immediately blocked at the TCP connection level, thereby
stopping the spam before it reaches your mail server.
Note: If you have a mail server in your network, it is recommended to enable the IP
Reputation engine as a first line of defense for incoming SMTP connections. When
enabled, the IP Reputation engine blocks emails that would otherwise reach your
mail server and require extensive analysis by the Content Based Antispam and
Block List engines, both of which examine email content and consume network,
gateway, and mail server resources. By reducing the amount of emails that require
in-depth analysis, the IP Reputation engine helps prevent Denial of Service (DoS)
attacks on your gateway or mail server.
If you do not have a mail server in your network, there is no need to enable the IP
Reputation engine. (If you do enable this engine anyway, it will have no negative
effects.)
•
Block List
VStream Antispam allows configuring a list of senders whose emails should be
blocked. When an email reaches your mail server, the Block List engine determines
whether the sender's email address appears on the list. If so, then VStream Antispam
blocks the emails.
•
Content Based Antispam
The Content Based Antispam engine calculates a “spam fingerprint” for each
incoming email message. The fingerprint is then sent to a VStream Antispam data
center and compared to a constantly updated database of spam messages. The data
center returns a "spam score", which is a value in percentages indicating the likelihood
Chapter 15: Using Antivirus and Antispam Filtering
487
Using VStream Antispam
that the message is spam. If the spam score exceeds a user-configurable threshold
called the “confidence level”, the message can be flagged as spam, or the message can
be deleted altogether.
In addition, VStream Antispam allows you to define a Safe Sender List, which consists of
senders who are exempt from the Block List and Content Based Antispam engines.
The following table provides a comparison of the VStream Antispam engines.
Table 107: Comparison of VStream Antispam Engines
IP Reputation
Content Based Antispam and
Block List
Supported
Protects mail servers only, and
Protects both mail servers and mail
Protocols
applies to the SMTP protocol only
clients, and applies to both POP3 and
SMTP protocols
Email Scanning Time
Detection Method
Scans the email before accepting
Scans the email after accepting the
the connection
connection
Examines the sender's IP address
Content Based Antispam examines the
email's content, and Block List examines
the email's Sender field.
SMTP Error Message
Mail Rejection
Does not return an SMTP error
Returns an SMTP error message to the
message to the email sender
email sender
Resets the TCP connection
Marks the email Subject line, marks the
Method
email header, rejects the email (SMTP
only), or deletes the email (POP3 only)
Server Overload
Prevents spammers from
Does not prevent spammers from
Protection
overloading gateway and mail
overloading gateway and mail server
server resources
resources
488
Check Point Safe@Office User Guide
Using VStream Antispam
Important: In order to use VStream Antispam, your Safe@Office appliance must be
subscribed to a Service Center.
How VStream Antispam Works
Figure 26: VStream Antispam Flow
VStream Antispam works as follows:
1.
A TCP connection arrives at the SMTP port (TCP 25) or the POP3 port (TCP
110).
2.
The connection is checked against the VStream Antispam policy, to determine
whether it should be scanned.
3.
If the IP Reputation engine is enabled, and the connection is an SMTP
connection:
a.
VStream Antispam sends the connection's source IP address to a VStream
Antispam data center.
b.
The VStream Antispam data center checks the reputation of this IP
address against a list of known spam sender IP addresses, and then
returns a spam score.
c.
One of the following things happens:
Chapter 15: Using Antivirus and Antispam Filtering
489
Using VStream Antispam
ƒ
If the spam score does not exceed the configured confidence level, the
email passes to the next enabled VStream Antispam engine for
processing.
ƒ
If the spam score exceeds the configured confidence level, VStream
Antispam determines that the email is spam and handles it as specified by
the IP Reputation engine's settings.
4.
d. VStream Antispam caches the results of the IP Reputation check.
VStream Antispam checks whether the email sender appears on the Safe
Sender List. If so, then the email is accepted.
5.
If the Block List engine is enabled:
6.
490
a.
VStream Antispam examines the email content and compares the sender
to the list of blocked senders.
b.
One of the following things happens:
ƒ
If the sender is not on the list of blocked senders, the email passes to the
next enabled VStream Antispam engine for processing.
ƒ
If the sender is on the list of blocked senders, VStream Antispam
determines that the email is spam and handles it as specified by the Block
List engine's settings.
By default, VStream Antispam marks the email subject.
If the Content Based Antispam engine is enabled:
a.
VStream Antispam examines the email content and creates a spam
fingerprint.
b.
VStream Antispam sends the fingerprint to a VStream Antispam data
center, where it is checked against an online database of spam messages.
c.
The VStream Antispam data center returns a spam score.
d.
One of the following things happens:
ƒ
If the spam score does not exceed the configured confidence level, the
email is accepted.
ƒ
If the spam score exceeds the configured confidence level, VStream
Antispam determines that email is spam and handles it and handles it as
specified by the Content Based Antispam engine's settings.
Check Point Safe@Office User Guide
Using VStream Antispam
7.
By default, VStream Antispam marks the email as spam.
One of the following things happen:
•
If the connection is an SMTP connection, the mail server forwards the email
to the recipient.
•
If the connection is a POP3 connection, the email client receives the email.
Header Marking
VStream Antispam adds the following headers to each email that is scanned by the Content
Based Antispam or Block List engine, but not blocked:
•
X-VStream-Spam-Level. Contains an integer between 0 and 100, where
100 indicates the highest likelihood that the email is spam.
•
X-VStream-Engine. The VStream Antispam engine, (either "Content Based
Antispam" or "Block List")
•
X-Spam-Level. Contains one to five asterisks, where five asterisks indicates
the highest likelihood that the email is spam.
•
X-Spam-Flag. Contains YES if the email is deemed to be spam, according to
the currently configured thresholds.
For example:
X-VStream-Spam-Level: 81%
X-VStream-Engine: Content Based Antispam
X-Spam-Level: ***
X-Spam-Flag: YES
If your email client allows defining rules based on message headers, you can create rules
specifying that emails with certain headers should be moved to specific folders. For
example, you can configure your email client to move all emails with the X-SpamFlag: YES header directly to a "Spam Email" folder.
Chapter 15: Using Antivirus and Antispam Filtering
491
Using VStream Antispam
Default Antispam Policy
The VStream Antispam default policy includes the following rules:
•
All incoming SMTP connections are scanned, unless they originate from VPN.
This protects mail servers in your network.
•
All outgoing POP3 connections are scanned. This protects mail clients in your
network.
You can easily override the default antispam policy, for example to exclude certain
addresses or networks from spam scanning, by creating user-defined rules. For further
information, see Configuring the VStream Antispam Policy on page 510.
Enabling/Disabling VStream Antispam
You must enable at least one VStream Antispam engine in order for VStream Antispam to
work. Once you have enabled the desired engines, you must configure them, using the
relevant sections in this guide.
To enable/disable VStream Antispam
1.
492
Click Antispam in the main menu, and click the Antispam tab.
Check Point Safe@Office User Guide
Using VStream Antispam
The VStream Antispam page appears.
2.
Complete the fields using the information in the following table.
Chapter 15: Using Antivirus and Antispam Filtering
493
Using VStream Antispam
Table 108: VStream Antispam Fields
In this field…
Do this…
Content Based
Specify the Content Based Antispam engine's mode, by dragging the
Antispam
lever to one of the following:
•
On. The Content Based Antispam engine is on. VStream
Antispam will check email fingerprints against an online spam
detection database. Emails that fail the check will be handled
according to configured Content Based Antispam settings.
•
Monitor Only. The Content Based Antispam engine is on.
VStream Antispam will check email fingerprints against an
online spam detection database. Emails that fail the check will
be logged only, and any action configured in the Content Based
Antispam Settings page will not be performed.
•
Off. The Content Based Antispam engine is off.
You can then click Settings to configure the Content Based Antispam
settings. For further information, see Configuring the Content Based
Antispam Engine on page 497.
Block List
Specify the Block List engine's mode, by dragging the lever to one of the
following:
•
On. The Block List engine is on. VStream Antispam will check
email messages against a list of blocked senders. Emails that
fail the check will be handled according to configured Block List
settings.
•
Monitor Only. The Block List engine is on. VStream Antispam
will check email messages against a list of blocked senders.
Emails that fail the check will be logged only, and any action
configured in the Antispam Block List Settings page will not be
performed.
•
Off. The Block List engine is off.
You can then click Settings to configure the Block List settings. For further
information, see Configuring the Block List Engine Settings on page
504.
494
Check Point Safe@Office User Guide
Using VStream Antispam
In this field…
Do this…
IP Reputation
Specify the IP Reputation engine's mode for SMTP connections, by
Checking
dragging the lever to one of the following:
•
On. The IP Reputation engine is on. VStream Antispam will
check the reputation of email senders against an online IP
reputation database prior to accepting the TCP connection.
Emails that fail the check will be handled according to
configured IP Reputation settings.
•
Monitor Only. The IP Reputation engine is on. VStream
Antispam will check the reputation of email senders against an
online IP reputation database. Emails that fail the check will be
logged only, and any action configured in the Antispam IP
Reputation Settings page will not be performed.
•
Off. The IP Reputation engine is off.
You can then click Settings to configure the IP Reputation settings. For
further information, see Configuring the IP Reputation Engine on page
507.
Viewing VStream Antispam Statistics
To view VStream Antispam statistics
•
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
Chapter 15: Using Antivirus and Antispam Filtering
495
Using VStream Antispam
Table 109: VStream Antispam Status Fields
This field…
Displays...
Email Messages
Statistics for the Content Based Antispam and Block List engines.
Pending
The number of SMTP and POP3 email messages pending for the Content
Based Antispam and Block List engines.
Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be spam.
Suspected Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be suspected spam.
Not scanned
The number of SMTP and POP3 email messages that were not scanned,
due to temporary loss of contact with the VStream Antispam data center,
or due to gateway resource overload.
Non Spam
The number of SMTP and POP3 email messages that the Content Based
Antispam and Block List engines determined to be legitimate.
Total
The total number of SMTP and POP3 email messages scanned by the
Content Based Antispam and Block List engines.
IP Reputation
Statistics for the IP Reputation engine.
Pending
The number of SMTP email connections currently pending for handling by
the IP Reputation engine.
Allowed
The number of SMTP email connections allowed by the IP Reputation
engine.
Blocked
The number of SMTP email connections blocked by the IP Reputation
engine.
496
Check Point Safe@Office User Guide
Using VStream Antispam
This field…
Displays...
Total
The total number of SMTP email connections scanned by the IP
Reputation engine.
Configuring the Content Based Antispam Engine
You can configure how VStream Antispam should handle spam and suspected spam that is
detected by the Content Based Antispam engine.
For information on enabling this engine, see Enabling/Disabling VStream Antispam on
page 492.
To configure Content Based Antispam engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
Next to the Content Based Antispam lever, click Settings.
Chapter 15: Using Antivirus and Antispam Filtering
497
Using VStream Antispam
The Content Based Antispam Settings page appears.
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Table 110: Content Based Antispam Settings Fields
In this field…
Do this…
Spam
Configure how VStream Antispam should handle spam that is detected
using the Content Based Antispam engine.
498
Check Point Safe@Office User Guide
Using VStream Antispam
In this field…
Do this…
Action
Specify the action VStream Antispam should take upon detecting spam,
by selecting one of the following:
•
None. Take no action.
•
Reject. Block the email. The email will be permanently deleted.
•
Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Note: If the Content Based Antispam engine is in Monitor Only mode, this
setting is ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 492.
Mark Text
Type the prefix to the text appearing in the Subject field of the spam
notification email.
For example, if you type [SPAM] and the original email's Subject field
displays "Earn Money the Easy Way", the spam notification email's Subject
field will display: "[SPAM] Earn Money the Easy Way".
The default value is [SPAM].
Note: If your email client allows defining rules based on the Subject field,
you can create rules specifying that emails whose Subject field contains
certain words should be moved to specific folders. For example, you can
configure your email client to move all emails whose Subject field contains
[SPAM] directly to the Deleted Items folder.
Track
Specify whether VStream Antispam should log spam, by selecting one of
the following:
•
Log. VStream Antispam should log spam.
•
None. VStream Antispam should not log spam.
Chapter 15: Using Antivirus and Antispam Filtering
499
Using VStream Antispam
In this field…
Do this…
Confidence
Type the minimum spam confidence level (SCL). If an email's SCL
matches or exceeds this threshold, the email is considered spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as spam. Setting a lower SCL increases the amount of spam
that is identified as legitimate email.
The default value is 90.
Suspected Spam
Configure how VStream Antispam should handle suspected spam that is
detected using the Content Based Antispam engine.
Action
Specify the action VStream Antispam should take upon detecting potential
spam, by selecting one of the following:
•
None. Take no action.
•
Reject. Block the email. The email will be permanently deleted.
•
Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Note: If the Content Based Antispam engine is in Monitor Only mode, this
setting is ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 492.
500
Check Point Safe@Office User Guide
Using VStream Antispam
In this field…
Do this…
Mark Text
Type the prefix to the text appearing in the Subject field of the suspected
spam notification email.
For example, if you type [SUSPECTED SPAM] and the original email's
Subject field displays "Earn Money the Easy Way", the suspected spam
notification email's Subject field will display: "[SUSPECTED SPAM] Earn
Money the Easy Way".
The default value is [SUSPECTED SPAM].
Note: If your email client allows defining rules based on the Subject field,
you can create rules specifying that emails whose Subject field contains
certain words should be moved to specific folders. For example, you can
configure your email client to move all emails whose Subject field contains
[SUSPECTED SPAM] directly to a Quarantine folder.
Track
Specify whether VStream Antispam should log suspected spam, by
selecting one of the following:
Confidence
•
Log. VStream Antispam should log suspected spam.
•
None. VStream Antispam should not log suspected spam.
Type the minimum spam confidence level (SCL). If an email's SCL
matches or exceeds this threshold, the email is considered suspected
spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as suspected spam. Setting a lower SCL increases the amount
of potential spam that is identified as legitimate email.
The default value is 80.
Chapter 15: Using Antivirus and Antispam Filtering
501
Using VStream Antispam
Configuring the Block List Engine
You can configure a list of email addresses and domain names that VStream Antispam
should automatically block, if the Block List engine is enabled.
For information on enabling the Block List engine, see Enabling/Disabling VStream
Antispam on page 492.
Adding Blocked Senders
To add a blocked sender
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
502
Next to the Block List lever, click Edit List.
Check Point Safe@Office User Guide
Using VStream Antispam
The Blocked Sender List page appears.
3.
Click Add.
The Add Email to List dialog box appears.
4.
In the field provided, do one of the following:
•
To block all email from a specific sender, type the sender's email address.
•
To block all email from addresses ending with a specific domain, type the
domain name.
For example, if you type "@special-offers.com", then email addresses such as
johns@special-offers.com and sarahm@special-offers.com will be blocked.
Chapter 15: Using Antivirus and Antispam Filtering
503
Using VStream Antispam
5.
Click OK.
The sender appears in the Block Sender List table.
Viewing and Deleting Blocked Senders
To delete a blocked sender
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
Next to the Block List lever, click Edit List.
The Blocked Sender List page appears.
3.
In the desired sender's row, click
The sender is deleted.
Configuring the Block List Engine Settings
To configure Block List engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
504
Next to the Block List lever, click Settings.
Check Point Safe@Office User Guide
Using VStream Antispam
The Antispam Block List Settings page appears.
3.
Complete the fields using the information in the following table.
4.
Click Apply.
Chapter 15: Using Antivirus and Antispam Filtering
505
Using VStream Antispam
Table 111: Antispam Block List Settings Fields
In this field…
Do this…
Block Action
Specify the action VStream Antispam should take upon receiving an
email from a blocked sender, by selecting one of the following:
•
None. Take no action.
•
Reject. Block the email.
•
Mark Subject. Mark the email's Subject line.
If you select Mark Subject, the Mark Text field appears.
Note: If the Block List engine is in Monitor Only mode, this setting is
ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 492.
Mark Text
Type the prefix to the text appearing in the Subject field of the spam
notification email.
For example, if you type [SPAM] and the original email's Subject field
displays "Earn Money the Easy Way", the spam notification email's Subject
field will display: "[SPAM] Earn Money the Easy Way".
The default value is [SPAM].
Note: If your email client allows defining rules based on the Subject field,
you can create rules specifying that emails whose Subject field contains
certain words should be moved to specific folders. For example, you can
configure your email client to move all emails whose Subject field contains
[SPAM] directly to the Deleted Items folder.
Track Blocked
Specify whether VStream Antispam should log emails from blocked
Email
senders, by selecting one of the following:
506
•
Log. VStream Antispam should log emails from blocked
senders.
•
None. VStream Antispam should not log emails from blocked
senders.
Check Point Safe@Office User Guide
Using VStream Antispam
Configuring the IP Reputation Engine
You can configure how VStream Antispam should handle spam and suspected spam that is
detected by the IP Reputation engine.
For information on enabling this engine, see Enabling/Disabling VStream Antispam on
page 492.
To configure IP Reputation engine settings
1.
Click Antispam in the main menu, and click the Antispam tab.
The VStream Antispam page appears.
2.
Next to the IP Reputation Checking lever, click Settings.
The Antispam IP Reputation Settings page appears.
3.
Complete the fields using the information in the following table.
Chapter 15: Using Antivirus and Antispam Filtering
507
Using VStream Antispam
4.
Click Apply.
Table 112: Antispam IP Reputation Settings Fields
In this field…
Do this…
Spam
Configure how VStream Antispam should handle spam that is detected
using the IP Reputation engine.
Action
Specify the action VStream Antispam should take upon detecting spam,
by selecting one of the following:
•
Reject. Block the email.
•
None. Take no action.
Note: If the IP Reputation engine is in Monitor Only mode, this setting is
ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 492.
Track
Specify whether VStream Antispam should log spam, by selecting one of
the following:
Confidence
•
Log. VStream Antispam should log spam.
•
None. VStream Antispam should not log spam.
Type the minimum spam confidence level (SCL) needed to fail this check.
If an email's SCL matches or exceeds this threshold, the email is
considered spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as spam. Setting a lower SCL increases the amount of spam
that is identified as legitimate email.
The default value is 90.
Suspected Spam
Configure how VStream Antispam should handle suspected spam that is
detected using the IP Reputation engine.
508
Check Point Safe@Office User Guide
Using VStream Antispam
In this field…
Do this…
Action
Specify the action VStream Antispam should take upon detecting potential
spam, by selecting one of the following:
•
Reject. Block the email.
•
None. Take no action.
Note: If the IP Reputation engine is in Monitor Only mode, this setting is
ignored. For information on changing the engine's mode, see
Enabling/Disabling VStream Antispam on page 492.
Track
Specify whether VStream Antispam should log suspected spam, by
selecting one of the following:
Confidence
•
Log. VStream Antispam should log suspected spam.
•
None. VStream Antispam should not log suspected spam.
Type the minimum spam confidence level (SCL) needed to fail this check.
If an email's SCL matches or exceeds this threshold, the email is
considered suspected spam.
Setting a higher SCL reduces the number of legitimate emails erroneously
identified as suspected spam. Setting a lower SCL increases the amount
of potential spam that is identified as legitimate email.
The default value is 80.
Chapter 15: Using Antivirus and Antispam Filtering
509
Using VStream Antispam
Configuring the VStream Antispam Policy
VStream Antispam includes a flexible mechanism that allows the user to define exactly
which emails should be scanned for spam and which should be considered safe, by
specifying the protocol, and the source and destination IP addresses.
VStream Antispam processes policy rules in the order they appear in the Antispam Policy
table, so that rule 1 is applied before rule 2, and so on. This enables you to define
exceptions to rules, by placing the exceptions higher up in the Rules table.
For example, if you want to scan all outgoing SMTP traffic, except traffic from a specific
IP address, you can create a rule scanning all outgoing SMTP traffic and move the rule
down in the Antispam Policy table. Then create a rule passing SMTP traffic from the
desired IP address and move this rule to a higher location in the Antispam Policy table than
the first rule. In the figure below, the general rule is rule number 2, and the exception is
rule number 1.
510
Check Point Safe@Office User Guide
Using VStream Antispam
The Safe@Office appliance will process rule 1 first, passing outgoing SMTP traffic from
the specified IP address, and only then it will process rule 2, scanning all outgoing SMTP
traffic.
The following rule types exist:
Table 113: VStream Antispam Rule Types
Rule
Description
Pass
This rule type enables you to specify that VStream Antispam should allow all
emails matching the rule, without scanning the emails.
Scan
This rule type enables you to specify that VStream Antispam should scan all
emails matching the rule.
Reject
This rule type enables you to specify that VStream Antispam should reject all
emails matching the rule, without scanning the emails.
Chapter 15: Using Antivirus and Antispam Filtering
511
Using VStream Antispam
Adding and Editing VStream Antispam Rules
To add or edit a VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
512
Do one of the following:
•
To add a new rule, click Add Rule.
•
To edit an existing rule, click
next to the desired rule.
Check Point Safe@Office User Guide
Using VStream Antispam
The VStream Antispam Policy Rule Wizard opens, with the Step 1: Rule Type dialog box
displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Destination & Source dialog box appears.
5.
Complete the fields using the relevant information in the following table.
Chapter 15: Using Antivirus and Antispam Filtering
513
Using VStream Antispam
6.
Click Next.
The Step 3: Done dialog box appears.
7.
If desired, type a description of the rule in the field provided.
8.
Click Finish.
The new rule appears in the Antispam Policy page.
Table 114: VStream Antispam Policy Rule Wizard Fields
In this field…
Do this…
If the email
Select the email protocol to which the rule should apply. The supported
protocol is
protocols are SMTP and POP3.
To specify both SMTP and POP3, select ANY.
Note: When defining a Reject rule, this field is set to Mail Server (SMTP).
514
Check Point Safe@Office User Guide
Using VStream Antispam
In this field…
Do this…
The connection
Select the source of the connections to which the rule should apply.
source is
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify connections originating from this gateway, select This Gateway.
To specify any source except this gateway, select ANY.
And the
Select the destination of the connections to which the rule should apply.
destination is
This list includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the text box.
To specify an IP address range, select Specified Range and type the desired
IP address range in the fields provided.
To specify the Safe@Office IP addresses, select This Gateway.
To specify any destination except the Safe@Office Portal IP addresses,
select ANY.
Description
Type a description of the rule.
Chapter 15: Using Antivirus and Antispam Filtering
515
Using VStream Antispam
Enabling/Disabling VStream Antispam Rules
You can temporarily disable a VStream Antispam rule.
To enable/disable a VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
Next to the desired rule, do one of the following:
•
To enable the rule, click
The button changes to
•
To disable the rule, click
The button changes to
and the rule is enabled.
and the rule is disabled.
Reordering VStream Antispam Rules
To reorder VStream Antispam rules
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears.
2.
516
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Check Point Safe@Office User Guide
Using VStream Antispam
Viewing and Deleting VStream Antispam Rules
To view or delete an existing VStream Antispam rule
1.
Click Antispam in the main menu, and click the Policy tab.
The Antispam Policy page appears with a list of existing VStream Antispam rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
In the desired rule's row, click
A confirmation message appears.
b.
Click OK.
The rule is deleted.
Configuring the Safe Sender List
You can configure a list of email addresses and domain names that are "safe". VStream
Antispam will treat all emails sent from these addresses or domains as legitimate (nonspam) mail.
Note: The IP Reputation check is performed before accepting the TCP connection,
at which point the sender’s email address is not yet available. Therefore, if the IP
Reputation engine is enabled, and an SMTP session is received from an IP address
that is reputed to be a source of spam, VStream Antispam will block the connection,
regardless of whether the sender's email address is on the Safe Sender List.
Chapter 15: Using Antivirus and Antispam Filtering
517
Using VStream Antispam
Adding Safe Senders
To add a safe sender
1.
Click Antispam in the main menu, and click the Safe Senders tab.
The Safe Sender List page appears.
2.
Click Add.
The Add Email to List dialog box appears.
518
Check Point Safe@Office User Guide
Using VStream Antispam
3.
4.
In the field provided, do one of the following:
•
To allow all email from a specific sender, type the sender's email address.
•
To allow all email from addresses ending with a specific domain, type the
domain name.
For example, if you type "@mycompany.com", then email addresses such as
johns@mycompany.com and sarahm@mycompany.com will be allowed.
Click OK.
The sender appears in the Safe Senders table.
Viewing and Deleting Safe Senders
To view or delete a safe sender
1.
Click Antispam in the main menu, and click the Safe Senders tab.
The Safe Sender List page appears.
2.
In the desired sender's row, click Erase.
The sender is deleted.
Chapter 15: Using Antivirus and Antispam Filtering
519
Using VStream Antispam
Configuring VStream Antispam Advanced Settings
To configure VStream Antispam advanced settings
1.
Click Antispam in the main menu, and click the Advanced tab.
The Advanced Antispam Settings page appears.
2.
In the Track Non Spam Emails drop-down list, do one of the following:
•
To specify that VStream Antispam should log email that is detected as
legitimate mail, select Log.
•
3.
520
To specify that VStream Antivirus should not log email that is detected as
legitimate mail, select None.
In the Track Safe Senders drop-down list, do one of the following:
Check Point Safe@Office User Guide
Using Centralized Email Filtering
•
To specify that VStream Antispam should log email sent by addresses on the
Safe Sender List, select Log.
•
4.
To specify that VStream Antivirus should not log email sent by addresses on
the Safe Sender List, select None.
Click Apply.
Using Centralized Email Filtering
There are two centralized Email Filtering services:
•
Email Antivirus
When the Email Antivirus service is enabled, your email is automatically scanned for
the detection and elimination of all known viruses and vandals. If a virus is detected, it
is removed and replaced with a warning message.
•
Email Antispam
When the Email Antispam service is enabled, your email is automatically scanned for
the detection of spam. If spam is detected, the email’s Subject line is modified to
indicate that it is suspected spam. If your email client allows defining rules based on
the Subject field, you can create rules to divert such messages to a special folder.
Note: Email Filtering services are only available if you are connected to a Service
Center and subscribed to the services. For information on using subscription
services, see Using Subscription Services on page 551.
Note: For information on the differences between the centralized Email Filtering
services and VStream Antivirus or VStream Antispam, see Overview on page 465.
Chapter 15: Using Antivirus and Antispam Filtering
521
Using Centralized Email Filtering
Enabling/Disabling Email Filtering
To enable/disable Email Filtering
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Next to Email Antivirus, drag the On/Off lever upwards or downwards.
Email Antivirus is enabled/disabled.
522
Check Point Safe@Office User Guide
Using Centralized Email Filtering
Selecting Protocols for Scanning
If you are locally managed, you can define which protocols should be scanned for viruses
and spam:
•
Email retrieving (POP3). If enabled, all incoming email in the POP3 protocol will
be scanned.
•
Email sending (SMTP). If enabled, all outgoing email will be scanned.
Protocols marked with
will be scanned, while those marked with
will not.
Note: If the Safe@Office appliance is remotely managed, contact your Service
Center administrator to change these settings.
To enable virus and spam scanning for a protocol
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
In the Options area, click
or
next to the desired protocol.
Chapter 15: Using Antivirus and Antispam Filtering
523
Using Centralized Email Filtering
Configuring Email Filtering Advanced Settings
Note: If the Safe@Office appliance is remotely managed, contact your Service
Center administrator to change these settings.
To configure Email Filtering advanced settings
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Next to the Bypass scanning if Service Center is unavailable option, specify
how the gateway should handle Email Filtering when the service is enabled
and the Service Center is unavailable, by doing do one of the following:
•
To temporarily block all email traffic, click
This ensures constant protection from spam and viruses.
The button changes to
•
To temporarily allow all email traffic, click
This ensures continuous access to email; however, it does not protect against
viruses and spam, so use this option cautiously.
The button changes to .
When the Service Center is available again, the gateway will enforce the configured
Email Filtering policy.
524
Check Point Safe@Office User Guide
Using Centralized Email Filtering
Temporarily Disabling Email Filtering
If you are having problems sending or receiving email you can temporarily disable the
Email Filtering services.
To temporarily disable Email Filtering
1.
Click Services in the main menu, and click the Email Filtering tab.
The Email Filtering page appears.
2.
Click Snooze.
•
Email Antivirus and Email Antispam are temporarily disabled for all internal
network computers.
•
The Snooze button changes to Resume.
Chapter 15: Using Antivirus and Antispam Filtering
525
Using Centralized Email Filtering
•
3.
526
The Email Filtering Off popup window opens.
To re-enable Email Antivirus and Email Antispam, click Resume, either in the
popup window, or on the Email Filtering page.
•
The services are re-enabled for all internal network computers.
•
If you clicked Resume in the Email Filtering page, the button changes to
Snooze.
•
If you clicked Resume in the Email Filtering Off popup window, the popup
window closes.
Check Point Safe@Office User Guide
Overview
Chapter 16
Using Web Content Filtering
This chapter explains how to use Web content filtering.
This chapter includes the following topics:
Overview ..................................................................................................527
Using Web Rules......................................................................................529
Using Web Filtering .................................................................................537
Customizing the Access Denied Page ......................................................543
Overview
You can allow or block users from accessing Web content, by configuring Web rules
and/or the Web Filtering service. The following table describes the main differences
between Web rules and the Web Filtering service:
Table 115: Comparison of Web Content Filtering Methods
Filtering Action
Web Rules
Web Filtering
Web rules allow and block
The Web Filtering service is category
specific URLs.
based; that is, it filters Web sites based
on the category to which they belong.
Point of Enforcement
HTTP requests are analyzed in
HTTP requests are analyzed in the
the gateway, by comparing each
gateway, by extracting each request's URL
request against a list of rules.
and then sending the URL to the Service
Center, to determine to which categories
the URL belongs. The request is then
allowed or denied according to the
configured list of allowed categories.
Chapter 16: Using Web Content Filtering
527
Overview
Web Rules
Web Filtering
Subscription and
Web rules are included with the
The Web Filtering service is subscription-
Connection
Safe@Office appliance and do
based and requires a connection to the
Requirement
not require a Service Center
Service Center.
subscription or connection.
You can use either Web content filtering solution or both in conjunction. When a user
attempts to access a Web site, the Safe@Office appliance first evaluates the Web rules. If
the site is not blocked or allowed by the Web rules, the Web Filtering service is then
consulted.
Regardless of which method is used, if a user attempts to access a blocked page, the
Access Denied page appears. For information on customizing this page, see Customizing
the Access Denied Page on page 543.
If desired, you can permit specific users to override Web content filtering, by granting
them Web Filtering Override permissions. Such users will be able to view Web pages
without restriction, after they have provided their username password via the Access
Denied page. For information on granting Web Filtering Override permissions, see Adding
and Editing Users on page 643.
In addition, you can choose to exclude specific network objects from Web content filtering
enforcement. Users connecting from these network objects will be able to view Web pages
without restriction, regardless of whether they have Web Filtering Override permissions.
For information on configuring network objects, see Using Network Objects on page 185.
528
Check Point Safe@Office User Guide
Using Web Rules
Using Web Rules
You can block or allow access to specific Web pages, by defining Web rules.
Note: Web rules affect outgoing traffic only and cannot be used to allow or limit
access from the Internet to internal Web servers.
The Safe@Office appliance processes Web rules in the order they appear in the Web Rules
table, so that rule 1 is applied before rule 2, and so on. This enables you to define
exceptions to rules, by placing the exceptions higher up in the Web Rules table.
For example, if you want to block all the pages of a particular Web site, except a specific
page, you can create a rule blocking access to all of the Web site's pages and move the rule
down in the Web Rules table. Then create a rule allowing access to the desired page and
move this rule to a higher location in the Web Rules table than the first rule. In the figure
below, the general rule is rule number 2, and the exception is rule number 1.
Chapter 16: Using Web Content Filtering
529
Using Web Rules
The Safe@Office appliance will process rule 1 first, allowing access to the desired page,
and only then it will process rule 2, blocking access to the rest of the site.
The following rule types exist:
Table 116: Web Rule Types
Rule
Description
Allow
This rule type enables you to specify that a specific Web page should be
allowed.
Block
This rule type enables you to specify that a specific Web page should be
blocked.
Adding and Editing Web Rules
To add or edit a Web rule
1.
530
Click Security in the main menu, and click the Web Rules tab.
Check Point Safe@Office User Guide
Using Web Rules
The Web Rules page appears.
2.
Do one of the following:
•
To add a new rule, click Add Rule.
•
To edit an existing rule, click
Chapter 16: Using Web Content Filtering
next to the desired rule.
531
Using Web Rules
The Safe@Office Web Rule Wizard opens, with the Step 1: Rule Type dialog box
displayed.
3.
Select the type of rule you want to create.
4.
Click Next.
The Step 2: Rule Location dialog box appears.
The example below shows a Block rule.
532
Check Point Safe@Office User Guide
Using Web Rules
5.
Complete the fields using the relevant information in the following table.
6.
Click Next.
The Step 3: Confirm Rule dialog box appears.
7.
Click Finish.
The new rule appears in the Web Rules page.
Chapter 16: Using Web Content Filtering
533
Using Web Rules
Table 117: Web Rules Fields
In this field…
Do this…
Block/Allow
Type the URL or IP address to which the rule should apply.
access to the
following URL
Wildcards (*) are supported. For example, to block all URLs that start with
"http://www.casino-", set this field's value to: http://www.casino-
Note: If you block a Web site based on its domain name
(http://), the Web site is not automatically blocked when
surfing to the Web server's IP address (http://). Likewise, if
you block a Web site based on its IP address, the Web site is not
automatically blocked when surfing to the domain name. To prevent access
to both the domain name and the IP address, you must block both.
Log allowed
Select this option to log the specified blocked or allowed connections.
connections /
Log blocked
connections
By default, allowed Web pages are not logged, and blocked Web pages are
logged.
If the connection
Select the source of the connections you want to allow/block. This list
source is
includes network objects.
To specify an IP address, select Specified IP and type the desired IP address
in the field provided.
To specify an IP address range, select Specified Range and type the desired IP
address range in the fields provided.
534
Check Point Safe@Office User Guide
Using Web Rules
Reordering Web Rules
To reorder Web rules
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
2.
For each rule you want to move, click on the rule and drag it to the desired
location in the table.
Enabling/Disabling Web Rule Logging
You can enable or disable logging for a Web rule, by using the information in Adding and
Editing Web Rules on page 530, or by using the following shortcut.
To enable/disable logging for a Web rule
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
2.
Next to the desired rule, in the Log column, do one of the following:
•
To enable logging, click
The button changes to
•
To disable logging, click
The button changes to
Chapter 16: Using Web Content Filtering
and logging is enabled for the rule.
and logging is disabled for the rule.
535
Using Web Rules
Viewing and Deleting Web Rules
To view or delete an existing Web rule
1.
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears with a list of existing Web rules.
2.
To resize a column, drag the relevant column divider right or left.
3.
To delete a rule, do the following.
a.
In the desired rule's row, click
A confirmation message appears.
b.
Click OK.
The rule is deleted.
536
Check Point Safe@Office User Guide
Using Web Filtering
Using Web Filtering
When the Web Filtering service is enabled, access to Web content is restricted according to
the categories specified in the Allow Categories area of the Web Filtering page.
Note: The Web Filtering service is only available if you are connected to a Service
Center and subscribed to this service. For information on using subscription
services, see Using Subscription Services on page 551.
Enabling/Disabling Web Filtering
To enable/disable Web Filtering
1.
Click Services in the main menu, and click the Web Filtering tab.
Chapter 16: Using Web Content Filtering
537
Using Web Filtering
The Web Filtering page appears.
2.
Drag the On/Off lever upwards or downwards.
Web Filtering is enabled/disabled.
538
Check Point Safe@Office User Guide
Using Web Filtering
Selecting Categories for Blocking
You can define which types of Web sites should be considered appropriate for your family
or office members, by selecting the categories. Categories marked with
will remain
will be blocked and will require the administrator
visible, while categories marked with
password for viewing.
Note: If the Safe@Office appliance is remotely managed, contact your Service Center
administrator to change these settings.
Note: The list of supported categories may vary, depending on the Service Center to
which the Safe@Office appliance is connected.
To allow/block a category
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
In the Allow Categories area, use the scroll bar to scroll through all of the
categories.
3.
Click
or
next to the desired category.
Chapter 16: Using Web Content Filtering
539
Using Web Filtering
Configuring Web Filtering Advanced Settings
Note: If the Safe@Office appliance is remotely managed, contact your Service
Center administrator to change these settings.
To configure Web Filtering advanced settings
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Next to the Bypass scanning if Service Center is unavailable option, specify
how the gateway should handle Web Filtering when the service is enabled and
the Service Center is unavailable, by doing do one of the following:
•
To temporarily block all connections to the Internet, click
This ensures that users will not gain access to undesirable Web sites, even when
the Service Center is unavailable.
The button changes to
•
To temporarily allow all connections to the Internet, click
This ensures continuous access to the Internet.
The button changes to .
When the Service Center is available again, the gateway will enforce the configured
Web Filtering policy.
540
Check Point Safe@Office User Guide
Using Web Filtering
Temporarily Disabling Web Filtering
If desired, you can temporarily disable the Web Filtering service.
To temporarily disable Web Filtering
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Click Snooze.
•
Web Filtering is temporarily disabled for all internal network computers.
•
The Snooze button changes to Resume.
Chapter 16: Using Web Content Filtering
541
Using Web Filtering
•
3.
The Web Filtering Off popup window opens.
To re-enable the service, click Resume, either in the popup window, or on the
Web Filtering page.
•
The service is re-enabled for all internal network computers.
•
If you clicked Resume in the Web Filtering page, the button changes to
Snooze.
•
If you clicked Resume in the Web Filtering Off popup window, the popup
window closes.
Resetting Web Filtering Categories to Defaults
If desired, you can reset the Web Filtering categories to their default settings.
To restore Web Filtering defaults
1.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
2.
Click Defaults
A confirmation message appears.
3.
542
Click OK.
Check Point Safe@Office User Guide
Customizing the Access Denied Page
Customizing the Access Denied Page
The Access Denied page appears when a user attempts to access a page that is blocked
either by a Web rule or by the Web Filtering service. You can customize this page using
the following procedure.
To customize the Access Denied page
1.
Do one of the following:
•
Click Security in the main menu, and click the Web Rules tab.
The Web Rules page appears.
•
2.
Click Services in the main menu, and click the Web Filtering tab.
The Web Filtering page appears.
Click Settings.
Chapter 16: Using Web Content Filtering
543
Customizing the Access Denied Page
The Customize Access Denied Page page appears. In the following example, this page
was accessed via the Web Rules page.
3.
In the text box, type the message that should appear when a user attempts to
access a blocked Web page.
You can use HTML tags as needed.
4.
To display the Access Denied page using HTTPS, select the Use HTTPS check
box.
5.
To preview the Access Denied page, click Preview.
A browser window opens displaying the Access Denied page.
6.
Click Apply.
Your changes are saved.
544
Check Point Safe@Office User Guide
Overview
Chapter 17
Updating the Firmware
This chapter explains how to update the Safe@Office appliance's firmware.
This chapter includes the following topics:
Overview ..................................................................................................545
Using Software Updates ...........................................................................546
Updating the Firmware Manually.............................................................549
Overview
You can update your Safe@Office appliance with new product features and protection
against new security threats. To do so, you must update your appliance's firmware, by
using one of the following methods:
•
Software Updates. This subscription service allows checking for new security
and software updates, either automatically or manually. Detected updates are
downloaded and installed without user intervention.
•
Manual updates. If you are not subscribed to the Software Updates service, you
must update the firmware manually.
Chapter 17: Updating the Firmware
545
Using Software Updates
Using Software Updates
Note: Software Updates are only available if you are connected to a Service Center
and subscribed to this service. For information on using subscription services, see
Using Subscription Services on page 551.
Checking for Software Updates when Remotely Managed
If your Safe@Office appliance is remotely managed, it automatically checks for software
updates and installs them without user intervention. However, you can still check for
updates manually, if needed.
To manually check for security and software updates
1.
546
Click Services in the main menu, and click the Software Updates tab.
Check Point Safe@Office User Guide
Using Software Updates
The Software Updates page appears.
2.
Click Update Now.
The system checks for new updates and installs them.
Chapter 17: Updating the Firmware
547
Using Software Updates
Checking for Software Updates when Locally Managed
If your Safe@Office appliance is locally managed, you can set it to automatically check
for software updates, or you can set it so that software updates must be checked for
manually.
To configure software updates when locally managed
1.
Click Services in the main menu, and click the Software Updates tab.
The Software Updates page appears.
2.
To set the Safe@Office appliance to automatically check for and install new
software updates, drag the Automatic/Manual lever upwards.
The Safe@Office appliance checks for new updates and installs them according to its
schedule.
548
Check Point Safe@Office User Guide
Updating the Firmware Manually
Note: When the Software Updates service is set to Automatic, you can still manually
check for updates.
3.
To set the Safe@Office appliance so that software updates must be checked
for manually, drag the Automatic/Manual lever downwards.
The Safe@Office appliance does not check for software updates automatically.
4.
To manually check for software updates, click Update Now.
The system checks for new updates and installs them.
Updating the Firmware Manually
To update your Safe@Office firmware manually
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
Click Firmware Update.
Chapter 17: Updating the Firmware
549
Updating the Firmware Manually
The Firmware Update page appears.
3.
Click Browse.
A browse window appears.
4.
Select the image file and click Open.
The Firmware Update page reappears. The path to the firmware update image file
appears in the Browse text box.
5.
Click Upload.
Your Safe@Office appliance firmware is updated.
Updating may take a few minutes. Do not power off the appliance.
At the end of the process the Safe@Office appliance restarts automatically.
550
Check Point Safe@Office User Guide
Connecting to a Service Center
Chapter 18
Using Subscription Services
This chapter explains how to connect your Safe@Office appliance to a Service Center and
start subscription services.
Note: Check with your reseller regarding availability of subscription services, or surf
to www.sofaware.com/servicecenters to locate a Service Center in your area.
This chapter includes the following topics:
Connecting to a Service Center ............................................................... 551
Viewing Services Information ................................................................. 557
Refreshing Your Service Center Connection........................................... 558
Configuring Your Account ...................................................................... 559
Disconnecting from Your Service Center................................................ 559
Connecting to a Service Center
To connect to a Service Center
1.
Click Services in the main menu, and click the Account tab.
Chapter 18: Using Subscription Services
551
Connecting to a Service Center
The Account page appears.
2.
552
In the Service Account area, click Connect.
Check Point Safe@Office User Guide
Connecting to a Service Center
The Safe@Office Services Wizard opens, with the Service Center dialog box displayed.
3.
Make sure the Connect to a Service Center check box is selected.
4.
Do one of the following:
•
To connect to the SofaWare Service Center, choose usercenter.sofaware.com.
•
5.
To specify a Service Center, choose Specified IP and then in the Specified IP
field, enter the desired Service Center’s IP address, as given to you by your
system administrator.
Click Next.
•
The Connecting screen appears.
Chapter 18: Using Subscription Services
553
Connecting to a Service Center
•
If the Service Center requires authentication, the Service Center Login dialog
box appears.
Enter your gateway ID and registration key in the appropriate fields, as given to
you by your service provider, then click Next.
•
554
The Connecting screen appears.
Check Point Safe@Office User Guide
Connecting to a Service Center
•
6.
The Confirmation dialog box appears with a list of services to which you are
subscribed.
Click Next.
The Done screen appears with a success message.
7.
Click Finish.
The following things happen:
Chapter 18: Using Subscription Services
555
Connecting to a Service Center
556
•
If a new firmware is available, the Safe@Office appliance may start
downloading it. This may take several minutes. Once the download is
complete, the Safe@Office appliance restarts using the new firmware.
•
The Welcome page appears.
•
The services to which you are subscribed are now available on your
Safe@Office appliance and listed as such on the Account page. See Viewing
Services Information on page 557 for further information.
•
The Services submenu includes the services to which you are subscribed.
Check Point Safe@Office User Guide
Viewing Services Information
Viewing Services Information
The Account page displays the following information about your subscription.
Table 118: Account Page Fields
This field…
Displays…
Service Center
The name of the Service Center to which you are connected (if known).
Name
Gateway ID
Your gateway ID.
Subscription will
The date on which your subscription to services will end.
end on
Service
The services available in your service plan.
Subscription
The status of your subscription to each service:
Status
•
Subscribed
•
Not Subscribed
The status of each service:
•
Connected. You are connected to the service through the
Service Center.
•
Connecting. Connecting to the Service Center.
•
N/A. The service is not available.
Chapter 18: Using Subscription Services
557
Refreshing Your Service Center Connection
This field…
Displays…
Information
The mode to which each service is set.
If you are subscribed to Dynamic DNS, this field displays your gateway's
domain name.
For further information, see Web Filtering on page 537, Virus Scanning
on page 521, and Automatic and Manual Updates on page 546.
Refreshing Your Service Center Connection
This option restarts your Safe@Office appliance’s connection to the Service Center and
refreshes your Safe@Office appliance’s service settings.
To refresh your Service Center connection
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Refresh.
The Safe@Office appliance reconnects to the Service Center.
Your service settings are refreshed.
558
Check Point Safe@Office User Guide
Configuring Your Account
Configuring Your Account
This option allows you to access your Service Center's Web site, which may offer
additional configuration options for your account. Contact your Service Center for a user
ID and password.
To configure your account
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Configure.
Note: If no additional settings are available from your Service Center, this button will
not appear.
Your Service Center's Web site opens.
3.
Follow the on-screen instructions.
Disconnecting from Your Service Center
If desired, you can disconnect from your Service Center.
To disconnect from your Service Center
1.
Click Services in the main menu, and click the Account tab.
The Account page appears.
2.
In the Service Account area, click Connect.
The Safe@Office Services Wizard opens, with the first Subscription Services dialog box
displayed.
Chapter 18: Using Subscription Services
559
Disconnecting from Your Service Center
3.
Clear the Connect to a Service Center check box.
4.
Click Next.
The Done screen appears with a success message.
5.
Click Finish.
The following things happen:
560
•
You are disconnected from the Service Center.
•
The services to which you were subscribed are no longer available on your
Safe@Office appliance.
Check Point Safe@Office User Guide
Overview
Chapter 19
Working With VPNs
This chapter describes how to use your Safe@Office appliance as a Remote Access VPN
Client, server, or gateway.
This chapter includes the following topics:
Overview ..................................................................................................561
Setting Up Your Safe@Office Appliance as a VPN Server .....................567
Adding and Editing VPN Sites ................................................................581
Viewing and Deleting VPN Sites .............................................................615
Enabling/Disabling a VPN Site ................................................................615
Logging in to a Remote Access VPN Site................................................616
Logging Out of a Remote Access VPN Site.............................................619
Using Certificates .....................................................................................620
Viewing VPN Tunnels .............................................................................631
Viewing IKE Traces for VPN Connections..............................................634
Viewing VPN Topology...........................................................................635
Overview
You can configure your Safe@Office appliance as part of a virtual private network (VPN).
A VPN is a private data network consisting of a group of gateways that can securely
connect to each other. Each member of the VPN is called a VPN site, and a connection
between two VPN sites is called a VPN tunnel. VPN tunnels encrypt and authenticate all
traffic passing through them. Through these tunnels, employees can safely use their
company’s network resources when working at home. For example, they can securely read
email, use the company’s intranet, or access the company’s database from home.
The are four types of VPN sites:
•
SecuRemote Remote Access VPN Server. Makes a network remotely available to
authorized users who connect to the Remote Access VPN Server using the
Check Point SecuRemote VPN Client (provided for free with your
Safe@Office) or another Safe@Office.
Chapter 19: Working With VPNs
561
Overview
•
SecuRemote Internal VPN Server. SecuRemote can also be used from your
internal networks, allowing you to secure your wired or wireless network with
strong encryption and authentication.
•
L2TP VPN Server. Makes a network available to authorized users who connect
from the Internet or from your internal networks using an L2TP client such as
the Microsoft L2TP IPSec VPN Client.
•
Site-to-Site VPN Gateway. Can connect with another Site-to-Site VPN Gateway in
a permanent, bi-directional relationship.
•
Remote Access VPN Client. Can connect to a Remote Access VPN Server, but
other VPN sites cannot initiate a connection to the Remote Access VPN Client.
Defining a Remote Access VPN Client is a hardware alternative to using
SecuRemote software.
All Safe@Office models provide full VPN functionality. They can act as a Remote Access
VPN Client, a Remote Access VPN Server for multiple users, or a Site-to-Site VPN
Gateway.
A virtual private network (VPN) must include at least one Remote Access VPN Server or
gateway. The type of VPN sites you include in a VPN depends on the type of VPN you
want to create, Site-to-Site or Remote Access.
Note: A locally managed Remote Access VPN Server or gateway must have a static
IP address. If you need a Remote Access VPN Server or gateway with a dynamic
IP address, you must use SofaWare Security Management Portal (SMP)
management.
A SecuRemote/SecureClient or Safe@Office Remote Access VPN Client can have
a dynamic IP address, regardless of whether it is locally or remotely managed.
Note: This chapter explains how to define a VPN locally. However, if your appliance
is centrally managed by a Service Center, then the Service Center can
automatically deploy VPN configuration for your appliance.
562
Check Point Safe@Office User Guide
Overview
Site-to-Site VPNs
A Site-to-Site VPN consists of two or more Site-to-Site VPN Gateways that can
communicate with each other in a bi-directional relationship. The connected networks
function as a single network. You can use this type of VPN to mesh office branches into
one corporate network.
Figure 27: Site-to-Site VPN
Chapter 19: Working With VPNs
563
Overview
To create a Site-to-Site VPN with two VPN sites
1.
On the first VPN site’s Safe@Office appliance, do the following:
a.
Define the second VPN site as a Site-to-Site VPN Gateway, using the
procedure Adding and Editing VPN Sites on page 581.
b.
2.
Enable a Remote Access VPN Server using the procedure Setting Up
Your Safe@Office Appliance as a VPN Server on page 567.
On the second VPN site’s Safe@Office appliance, do the following:
a.
Define the first VPN site as a Site-to-Site VPN Gateway, using the
procedure Adding and Editing VPN Sites on page 581.
b.
Enable a Remote Access VPN Server using the procedure Setting Up
Your Safe@Office Appliance as a VPN Server on page 567.
Note: You can manually configure each VPN site's internal encryption domain via
the CLI. For information, refer to the Embedded NGX CLI Reference Guide.
564
Check Point Safe@Office User Guide
Overview
Remote Access VPNs
A Remote Access VPN consists of one Remote Access VPN Server or Site-to-Site VPN
Gateway, and one or more Remote Access VPN Clients. You can use this type of VPN to
make an office network remotely available to authorized users, such as employees working
from home, who connect to the office Remote Access VPN Server with their Remote
Access VPN Clients.
Figure 28: Remote Access VPN
Chapter 19: Working With VPNs
565
Overview
To create a Remote Access VPN with two VPN sites
1.
On the remote user VPN site's Safe@Office appliance, add the office Remote
Access VPN Server as a Remote Access VPN site.
See Adding and Editing VPN Sites on page 581.
The remote user's Safe@Office appliance will act as a Remote Access VPN Client.
2.
On the office VPN site's Safe@Office appliance, enable a Remote Access
VPN Server.
See Setting Up Your Safe@Office Appliance as a VPN Server on page 567.
Internal VPN Server
You can use your Safe@Office appliance as an internal VPN Server, for enhanced wired
and wireless security. When an internal VPN Server is enabled, internal network PCs and
PDAs with the appropriate software installed can establish a Remote Access VPN session
to the gateway. This means that connections from internal network users to the gateway
can be encrypted and authenticated.
The benefits of using an internal VPN Server are two-fold:
•
Accessibility
Using SecuRemote/SecureClient or L2TP, you can enjoy a secure connection from
anywhere—in your wireless network or on the road—without changing any settings.
The standard is completely transparent and allows you to access company resources
the same way, whether you are sitting at your desk or anywhere else.
•
Security
Many of today's attacks are increasingly introduced from inside the network. Internal
security threats cause outages, downtime, and lost revenue. Wired networks that deal
with highly sensitive information—especially networks in public places, such as
classrooms—are vulnerable to users trying to hack the internal network.
Using an internal VPN Server, along with a strict security policy for non-VPN users,
can enhance security both for wired networks and for wireless networks, which are
particularly vulnerable to security breaches.
For information on setting up your Safe@Office appliance as an internal VPN Server, see
Configuring the Internal VPN Server on page 571.
566
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
Setting Up Your Safe@Office Appliance as a VPN
Server
You can make your network available to authorized users connecting from the Internet or
from your internal networks, by setting up your Safe@Office appliance as a VPN Server.
When the SecuRemote Remote Access VPN Server or SecuRemote Internal VPN Server is
enabled, users can connect to the server via Check Point SecuRemote/SecureClient or via a
Safe@Office appliance in Remote Access VPN mode. When the L2TP (Layer 2 Tunneling
Protocol) VPN Server is enabled, users can connect to the server using an L2TP client such
as the Microsoft Windows L2TP IPSEC VPN Client. L2TP users are automatically
assigned to the OfficeMode network, enabling you to configure special security rules for
them.
SecuRemote/SecureClient supports split tunneling, which means that VPN Clients can
connect directly to the Internet, while traffic to and from VPN sites passes through the
VPN Server. In contrast, the L2TP VPN Client does not support split tunneling, meaning
that all Internet traffic to and from a VPN Client passes through the VPN Server and is
routed to the Internet.
Enabling the Safe@Office VPN Server for users connecting from your internal networks
adds a layer of security to such connections. For example, while you could create a firewall
rule allowing a specific user on the DMZ to access the LAN, enabling VPN access for the
user means that such connections can be encrypted and authenticated. For more
information, see Internal VPN Server on page 566.
Chapter 19: Working With VPNs
567
Setting Up Your Safe@Office Appliance as a VPN Server
To set up your Safe@Office appliance as a VPN Server
1.
Configure the VPN Server in one or more of the following ways:
•
To accept SecuRemote/SecureClient or Safe@Office remote access
connections from the Internet.
See Configuring the SecuRemote Remote Access VPN Server on page 569.
•
To accept SecuRemote/SecureClient connections from your internal networks.
See Configuring the Internal VPN Server on page 571.
•
2.
To accept L2TP remote access connections from the Internet, as well L2TP
connections from your internal networks.
See Configuring the L2TP VPN Server on page 572.
If you configured the SecuRemote Internal VPN Server, install
SecuRemote/SecureClient on the desired internal network computers.
See Installing SecuRemote on page 573.
3.
If you configured the L2TP VPN Server, do the following:
a.
Configure the OfficeMode network.
See Configuring the OfficeMode Network on page 172.
All users connecting via L2TP will be assigned to the OfficeMode network.
b.
4.
Configure L2TP VPN Clients on the desired internal network computers.
See Configuring L2TP VPN Clients on page 574.
Set up remote VPN access for users.
See Setting Up Remote VPN Access for Users on page 650.
Note: Disabling the VPN Server for a specific type of connection (from
SecuRemote/SecureClient clients on the Internet, from SecuRemote/SecureClient
clients on internal networks, or from L2TP clients) will cause all existing VPN
tunnels of that type to disconnect.
568
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
Configuring the SecuRemote Remote Access VPN Server
To configure the SecuRemote Remote Access VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Select the Allow SecuRemote users to connect from the Internet check box.
Chapter 19: Working With VPNs
569
Setting Up Your Safe@Office Appliance as a VPN Server
New check boxes appear.
3.
To allow authenticated users connecting from the Internet to bypass NAT
when connecting to your internal network, select the Bypass NAT check box.
4.
To allow authenticated users connecting from the Internet to bypass the default
firewall policy and access your internal network without restriction, select the
Bypass default firewall policy check box.
User-defined rules will still apply to the authenticated users.
5.
Click Apply.
The SecuRemote Remote Access VPN Server is enabled for the specified connection
types.
570
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
Configuring the Internal VPN Server
To configure the internal VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The SecuRemote VPN Server page appears.
2.
Select the Allow SecuRemote users to connect from my internal networks check
box.
New check boxes appear.
3.
To allow authenticated users connecting from internal networks to bypass the
default firewall policy and access your internal network without restriction,
select the Bypass default firewall policy check box.
User-defined rules will still apply to the authenticated users.
Chapter 19: Working With VPNs
571
Setting Up Your Safe@Office Appliance as a VPN Server
Note: Bypass NAT is always enabled for the internal VPN Server, and cannot be
disabled.
4.
Click Apply.
The internal VPN Server is enabled for the specified connection types.
Configuring the L2TP VPN Server
To configure the L2TP VPN Server
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Select the Allow L2TP clients to connect check box.
New check boxes appear.
572
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
3.
In the Preshared Secret field, type the preshared secret to use for secure
communications between the L2TP clients and the VPN Server.
The secret can contain spaces and special characters. It is used to secure L2TP
connections for all users.
In addition to entering this secret, each L2TP user will have to authenticate with a
username and password.
For information on defining users with VPN access permissions, see Setting Up
Remote VPN Access for Users on page 650.
4.
To allow authenticated users to bypass the default firewall policy and access
your internal network without restriction, select the Bypass default firewall
policy check box.
User-defined rules will still apply to the authenticated users.
5.
Click Apply.
The L2TP VPN Server is enabled for the specified connection types.
Installing SecuRemote
If you configured the SecuRemote Internal VPN Server, you must install the
SecuRemote/SecureClient VPN Client on all internal network computers that should be
allowed to remotely access your network via SecuRemote connections.
To install SecureClient/SecuRemote
1.
Click VPN in the main menu, and click the VPN Server tab.
The VPN Server page appears.
2.
Click the Download link.
The VPN-1 SecuRemote for Safe@Office page opens in a new window.
3.
Follow the online instructions to complete installation.
SecureClient/SecuRemote is installed.
Chapter 19: Working With VPNs
573
Setting Up Your Safe@Office Appliance as a VPN Server
For information on using SecureClient/SecuRemote, see the User Help. To access
SecureClient/SecuRemote User Help, right-click on the VPN Client icon in the
taskbar, select Settings, and then click Help.
Configuring L2TP VPN Clients
If you configured the L2TP VPN Server, you must configure the L2TP VPN Client on all
computers that should be allowed to remotely access your network via L2TP connections.
This procedure is relevant for computers with a Windows XP operating system.
Note: The Safe@Office appliance supports the following authentication methods:
•
PAP. For both local users and RADIUS users
•
EAP-MD5, CHAP. For local users, but not for RADIUS users
To configure L2TP VPN Clients on Microsoft Windows
1.
Click Start > Settings > Control Panel.
The Control Panel window appears.
2.
Double-click the Network and Dial-up Connections icon.
The Network and Dial-up Connections window appears.
3.
574
Click File > New Connection.
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
The New Connection Wizard opens displaying the Welcome to the New Connection
Wizard screen.
4.
Click Next.
The Network Connection Type dialog box appears.
5.
Choose Connect to the network at my workplace.
6.
Click Next.
Chapter 19: Working With VPNs
575
Setting Up Your Safe@Office Appliance as a VPN Server
7.
The Network Connection dialog box appears.
8.
Choose Virtual Private Network connection.
9.
Click Next.
The Connection Name dialog box appears.
10. In the Company Name field, type your company's name.
11. Click Next.
576
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
The Public Network dialog box appears.
12. Choose Do not dial the initial connection.
13. Click Next.
The VPN Server Selection dialog box appears.
14. In the field, type the Safe@Office appliance's IP address.
Chapter 19: Working With VPNs
577
Setting Up Your Safe@Office Appliance as a VPN Server
The Completing the New Connection Wizard screen appears.
15. Click Finish.
16. In the Network and Dial-up Connections window, right-click on the L2TP
connection, and click Properties in the popup menu.
The connection's Properties dialog box opens.
17. In the Security tab, choose Advanced (custom settings).
18. Click Settings.
578
Check Point Safe@Office User Guide
Setting Up Your Safe@Office Appliance as a VPN Server
The Advanced Security Settings dialog box opens.
19. In the Data encryption drop-down list, select Optional encryption.
20. Choose Allow these protocols.
21. Select the Unencrypted password (PAP) check box, and clear all other check
boxes.
22. Click OK.
23. In Properties dialog box's Security tab, click IPSec Settings.
The IPSec Settings dialog box opens.
24. Select the Use pre-shared key for authentication check box.
25. In the Key field, type the preshared secret you configured on the L2TP VPN
Server.
26. Click OK.
27. In Properties dialog box, click the Networking tab.
Chapter 19: Working With VPNs
579
Setting Up Your Safe@Office Appliance as a VPN Server
28. In the Type of VPN drop-down list, select L2TP IPSec VPN.
29. Click OK.
580
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Adding and Editing VPN Sites
To add or edit VPN sites
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears with a list of VPN sites.
2.
Do one of the following:
•
To add a VPN site, click New Site.
•
To edit a VPN site, click Edit in the desired VPN site’s row.
Chapter 19: Working With VPNs
581
Adding and Editing VPN Sites
The Safe@Office VPN Site Wizard opens, with the Welcome to the VPN Site Wizard
dialog box displayed.
3.
Do one of the following:
•
Select Remote Access VPN to establish remote access from your Remote
Access VPN Client to a Remote Access VPN Server.
•
4.
582
Select Site-to-Site VPN to create a permanent bi-directional connection to
another Site-to-Site VPN Gateway.
Click Next.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Configuring a Remote Access VPN Site
If you selected Remote Access VPN, the VPN Gateway Address dialog box appears.
1.
Enter the IP address of the Remote Access VPN Server to which you want to
connect, as given to you by the network administrator.
2.
To allow the VPN site to bypass the default firewall policy and access your
internal network without restriction, select the Bypass default firewall policy
check box.
User-defined rules will still apply to the VPN site.
3.
Click Next.
Chapter 19: Working With VPNs
583
Adding and Editing VPN Sites
The VPN Network Configuration dialog box appears.
4.
Specify how you want to obtain the VPN network configuration. Refer to VPN
Network Configuration Fields on page 593.
5.
Click Next.
The following things happen in the order below:
584
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
•
If you chose Specify Configuration, a second VPN Network Configuration dialog
box appears.
Complete the fields using the information in VPN Network Configuration Fields
on page 593 and click Next.
•
If you chose Specify Configuration or Route All Traffic, the Backup Gateway
dialog box appears.
Chapter 19: Working With VPNs
585
Adding and Editing VPN Sites
In the Backup Gateway IP field, type the name of the VPN site to use if the
primary VPN site fails, and then click Next.
•
The Authentication Method dialog box appears.
6.
Complete the fields using the information in Authentication Methods Fields
on page 595.
7.
Click Next.
586
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Username and Password Authentication Method
If you selected Username and Password, the VPN Login dialog box appears.
1.
Complete the fields using the information in VPN Login Fields on page 596.
2.
Click Next.
•
If you selected Automatic Login, the Connect dialog box appears.
Chapter 19: Working With VPNs
587
Adding and Editing VPN Sites
Do the following:
1) To try to connect to the Remote Access VPN Server, select the Try to
Connect to the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all
existing tunnels to this site will be terminated.
2) Click Next.
If you selected Try to Connect to the VPN Gateway, the Connecting… screen
appears, and then the Contacting VPN Site screen appears.
•
3.
The Site Name dialog box appears.
Enter a name for the VPN site.
You may choose any name.
4.
588
Click Next.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
The VPN Site Created screen appears.
5.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the
VPN Sites list. If you edited a VPN site, the modifications are reflected in the VPN
Sites list.
Chapter 19: Working With VPNs
589
Adding and Editing VPN Sites
Certificate Authentication Method
If you selected Certificate, the Connect dialog box appears.
1.
To try to connect to the Remote Access VPN Server, select the Try to Connect
to the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all
existing tunnels to this site will be terminated.
2.
Click Next.
If you selected Try to Connect to the VPN Gateway, the Connecting… screen appears,
and then the Contacting VPN Site screen appears.
590
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
The Site Name dialog box appears.
3.
Enter a name for the VPN site.
You may choose any name.
4.
Click Next.
The VPN Site Created screen appears.
Chapter 19: Working With VPNs
591
Adding and Editing VPN Sites
5.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the
VPN Sites list. If you edited a VPN site, the modifications are reflected in the VPN
Sites list.
RSA SecurID Authentication Method
If you selected RSA SecurID, the Site Name dialog box appears.
1.
Enter a name for the VPN site.
You may choose any name.
2.
592
Click Next.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
The VPN Site Created screen appears.
3.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the
VPN Sites list. If you edited a VPN site, the modifications are reflected in the VPN
Sites list.
Table 119: VPN Network Configuration Fields
In this field…
Do this…
Download
Click this option to obtain the network configuration by downloading it from
Configuration
the VPN site.
This option will automatically configure your VPN settings, by downloading
the network topology definition from the Remote Access VPN Server.
Note: Downloading the network configuration is only possible if you are
connecting to a Check Point VPN-1 or Safe@Office Site-to-Site VPN
Gateway.
Chapter 19: Working With VPNs
593
Adding and Editing VPN Sites
In this field…
Do this…
Specify
Click this option to provide the network configuration manually.
Configuration
Route All Traffic
Click this option to route all network traffic through the VPN site.
For example, if your VPN consists of a central office and a number of
remote offices, and the remote offices are only allowed to access Internet
resources through the central office, you can choose to route all traffic from
the remote offices through the central office.
Note: You can only configure one VPN site to route all traffic.
Route Based VPN
Click this option to create a virtual tunnel interface (VTI) for this site, so
that it can participate in a route-based VPN.
Route-based VPNs allow routing connections over VPN tunnels, so that
remote VPN sites can participate in dynamic or static routing schemes.
This improves network and VPN management efficiency for large
networks.
For constantly changing networks, it is recommended to use a route-based
VPN combined with OSPF dynamic routing. This enables you to make
frequent changes to the network topology, such as adding an internal
network, without having to reconfigure static routes.
OSPF is enabled using CLI. For information on using CLI, see Controlling
the Appliance via the Command Line on page 673. For information on
the relevant commands for OSPF, refer to the Embedded NGX CLI
Reference Guide.
This option is only available for when configuring a Site-to-Site VPN
gateway.
594
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
In this field…
Do this…
Destination network
Type up to three destination network addresses at the VPN site to which
you want to connect.
Subnet mask
Select the subnet masks for the destination network addresses.
Note: Obtain the destination networks and subnet masks from the VPN
site’s system administrator.
Table 120: Authentication Methods Fields
In this field…
Do this…
Username and
Select this option to use a user name and password for VPN
Password
authentication.
In the next step, you can specify whether you want to log in to the VPN site
automatically or manually.
Certificate
Select this option to use a certificate for VPN authentication.
If you select this option, a certificate must have been installed. (Refer to
Installing a Certificate on page 620 for more information about
certificates and instructions on how to install a certificate.)
RSA SecurID
Select this option to use an RSA SecurID token for VPN authentication.
Token
When authenticating to the VPN site, you must enter a four-digit PIN code
and the SecurID passcode shown in your SecurID token's display. The
RSA SecurID token generates a new passcode every minute.
SecurID is only supported in Remote Access manual login mode.
Chapter 19: Working With VPNs
595
Adding and Editing VPN Sites
Table 121: VPN Login Fields
In this field…
Do this…
Manual Login
Click this option to configure the site for Manual Login.
Manual Login connects only your computer to the VPN site, and only when
the appropriate user name and password have been entered. For further
information on Automatic and Manual Login, see, Logging in to a VPN
Site on page 616.
Automatic Login
Click this option to enable the Safe@Office appliance to log in to the VPN
site automatically.
You must then fill in the Username and Password fields.
Automatic Login provides all the computers on your internal network with
constant access to the VPN site. For further information on Automatic and
Manual Login, see Logging in to a VPN Site on page 616.
Username
Type the user name to be used for logging in to the VPN site.
Password
Type the password to be used for logging in to the VPN site.
596
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Configuring a Site-to-Site VPN Gateway
If you selected Site-to-Site VPN, the VPN Gateway Address dialog box appears.
1.
Complete the fields using the information in VPN Gateway Address Fields on
page 611.
2.
Click Next.
Chapter 19: Working With VPNs
597
Adding and Editing VPN Sites
The VPN Network Configuration dialog box appears.
3.
Specify how you want to obtain the VPN network configuration. Refer to VPN
Network Configuration Fields on page 593.
4.
Click Next.
•
598
If you chose Specify Configuration, a second VPN Network Configuration dialog
box appears.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Complete the fields using the information in VPN Network Configuration Fields
on page 593, and then click Next.
•
If you chose Specify Configuration or Route All Traffic, the Backup Gateway
dialog box appears.
In the Backup Gateway IP field, type the name of the VPN site to use if the
primary VPN site fails, and then click Next.
Chapter 19: Working With VPNs
599
Adding and Editing VPN Sites
•
If you chose Route Based VPN, the Route Based VPN dialog box appears.
Complete the fields using the information in Route Based VPN Fields on page
611, and then click Next.
•
5.
600
The Authentication Method dialog box appears.
Complete the fields using the information in Authentication Methods Fields
on page 612.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
6.
Click Next.
Shared Secret Authentication Method
If you selected Shared Secret, the Authentication dialog box appears.
If you chose Download Configuration, the dialog box contains additional fields.
Chapter 19: Working With VPNs
601
Adding and Editing VPN Sites
1.
Complete the fields using the information in VPN Authentication Fields on
page 612 and click Next.
The Security Methods dialog box appears.
2.
To configure advanced security settings, click Show Advanced Settings.
New fields appear.
602
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
3.
Complete the fields using the information in Security Methods Fields on page
613 and click Next.
The Connect dialog box appears.
4.
To try to connect to the Remote Access VPN Server, select the Try to Connect
to the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all
existing tunnels to this site will be terminated.
5.
Click Next.
•
If you selected Try to Connect to the VPN Gateway, the Connecting… screen
appears, and then the Contacting VPN Site screen appears.
Chapter 19: Working With VPNs
603
Adding and Editing VPN Sites
•
6.
The Site Name dialog box appears.
Type a name for the VPN site.
You may choose any name.
7.
To keep the tunnel to the VPN site alive even if there is no network traffic
between the Safe@Office appliance and the VPN site, select Keep this site
alive.
8.
Click Next.
604
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
•
If you selected Keep this site alive, and previously you chose Download
Configuration, the "Keep Alive" Configuration dialog box appears.
Do the following:
1) Type up to three IP addresses which the Safe@Office appliance
should ping in order to keep the tunnel to the VPN site alive.
2) Click Next.
9.
• The VPN Site Created screen appears.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the
VPN Sites list. If you edited a VPN site, the modifications are reflected in the VPN
Sites list.
Chapter 19: Working With VPNs
605
Adding and Editing VPN Sites
Certificate Authentication Method
If you selected Certificate, the following things happen:
•
If you chose Download Configuration, the Authentication dialog box appears.
Complete the fields using the information in VPN Authentication Fields on page
612 and click Next.
606
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
•
1.
The Security Methods dialog box appears.
To configure advanced security settings, click Show Advanced Settings.
New fields appear.
2.
Complete the fields using the information in Security Methods Fields on page
613 and click Next.
Chapter 19: Working With VPNs
607
Adding and Editing VPN Sites
The Connect dialog box appears.
3.
To try to connect to the Remote Access VPN Server, select the Try to Connect
to the VPN Gateway check box.
This allows you to test the VPN connection.
Warning: If you try to connect to the VPN site before completing the wizard, all
existing tunnels to this site will be terminated.
4.
Click Next.
•
If you selected Try to Connect to the VPN Gateway, the following things
happen:
The Connecting… screen appears.
•
608
The Contacting VPN Site screen appears.
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
•
5.
The Site Name dialog box appears.
Enter a name for the VPN site.
You may choose any name.
6.
To keep the tunnel to the VPN site alive even if there is no network traffic
between the Safe@Office appliance and the VPN site, select Keep this site
alive.
7.
Click Next.
Chapter 19: Working With VPNs
609
Adding and Editing VPN Sites
•
If you selected Keep this site alive, and previously you chose Download
Configuration, the "Keep Alive" Configuration dialog box appears.
Do the following:
1) Type up to three IP addresses which the Safe@Office appliance
should ping in order to keep the tunnel to the VPN site alive.
2) Click Next.
8.
• The VPN Site Created screen appears.
Click Finish.
The VPN Sites page reappears. If you added a VPN site, the new site appears in the
VPN Sites list. If you edited a VPN site, the modifications are reflected in the VPN
Sites list.
610
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Table 122: VPN Gateway Address Fields
In this field…
Do this…
Gateway Address
Type the IP address of the Site-to-Site VPN Gateway to which you want
to connect, as given to you by the network administrator.
Bypass NAT
Select this option to allow the VPN site to bypass NAT when connecting
to your internal network.
This option is selected by default.
Bypass default
Select this option to allow the VPN site to bypass the default firewall
firewall policy
policy and access your internal network without restriction.
User-defined rules will still apply to the VPN site.
Table 123: Route Based VPN Fields
In this field…
Do this…
Tunnel Local IP
Type a local IP address for this end of the VPN tunnel.
Tunnel Remote IP
Type the IP address of the remote end of the VPN tunnel.
OSPF Cost
Type the cost of this link for dynamic routing purposes.
The default value is 10.
If OSPF is not enabled, this setting is not used. OSPF is enabled using
the Safe@Office command line interface (CLI). For information on using
CLI, see Controlling the Appliance via the Command Line on page
673. For information on the relevant commands for OSPF, refer to the
Embedded NGX CLI Reference Guide.
Chapter 19: Working With VPNs
611
Adding and Editing VPN Sites
Table 124: Authentication Methods Fields
In this field…
Do this…
Shared Secret
Select this option to use a shared secret for VPN authentication.
A shared secret is a string used to identify VPN sites to each other.
Certificate
Select this option to use a certificate for VPN authentication.
If you select this option, a certificate must have been installed. (Refer to
Installing a Certificate on page 620 for more information about
certificates and instructions on how to install a certificate.)
Table 125: VPN Authentication Fields
In this field…
Do this…
Topology User
Type the topology user’s user name.
Topology
Type the topology user’s password.
Password
Use Shared
Type the shared secret to use for secure communications with the VPN
Secret
site.
This shared secret is a string used to identify the VPN sites to each other.
The secret can contain spaces and special characters.
612
Check Point Safe@Office User Guide
Adding and Editing VPN Sites
Table 126: Security Methods Fields
In this field…
Do this…
Phase 1
Security Methods
Select the encryption and integrity algorithm to use for IKE negotiations:
•
Automatic. The Safe@Office appliance automatically selects
the best security methods supported by the site. This is the
default.
•
A specific algorithm
Diffie-Hellman
Select the Diffie-Hellman group to use:
group
•
Automatic. The Safe@Office appliance automatically selects a
group. This is the default.
•
A specific group
A group with more bits ensures a stronger key but lowers performance.
Renegotiate every
Type the interval in minutes between IKE Phase-1 key negotiations. This
is the IKE Phase-1 SA lifetime.
A shorter interval ensures higher security, but impacts heavily on
performance. Therefore, it is recommended to keep the SA lifetime
around its default value.
The default value is 1440 minutes (one day).
Phase 2
Security Methods
Select the encryption and integrity algorithm to use for VPN traffic:
•
Automatic. The Safe@Office appliance automatically selects
the best security methods supported by the site. This is the
default.
•
A specific algorithm
Chapter 19: Working With VPNs
613
Adding and Editing VPN Sites
In this field…
Do this…
Perfect Forward
Specify whether to enable Perfect Forward Secrecy (PFS), by selecting
Secrecy
one of the following:
•
Enabled. PFS is enabled. The Diffie-Hellman group field is
enabled.
•
Disabled. PFS is disabled. This is the default.
Enabling PFS will generate a new Diffie-Hellman key during IKE Phase 2
and renew the key for each key exchange.
PFS increases security but lowers performance. It is recommended to
enable PFS only in situations where extreme security is required.
Diffie-Hellman
Select the Diffie-Hellman group to use:
group
•
Automatic. The Safe@Office appliance automatically selects a
group. This is the default.
•
A specific group
A group with more bits ensures a stronger key but lowers performance.
Renegotiate every
Type the interval in seconds between IPSec SA key negotiations. This is
the IKE Phase-2 SA lifetime.
A shorter interval ensures higher security.
The default value is 3600 seconds (one hour).
614
Check Point Safe@Office User Guide
Viewing and Deleting VPN Sites
Viewing and Deleting VPN Sites
To view or delete a VPN site
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears, with a list of all VPN sites.
2.
To delete a VPN site, do the following.
a.
In the desired VPN site's row, click the Erase
icon.
A confirmation message appears.
b.
Click OK.
The VPN site is deleted.
Enabling/Disabling a VPN Site
You can only connect to VPN sites that are enabled.
To enable/disable a VPN site
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears, with a list of VPN sites.
2.
To enable a VPN site, do the following:
a.
Click the
icon in the desired VPN site’s row.
A confirmation message appears.
b.
Click OK.
The icon changes to
Chapter 19: Working With VPNs
, and the VPN site is enabled.
615
Logging in to a Remote Access VPN Site
3.
To disable a VPN site, do the following:
Note: Disabling a VPN site eliminates the tunnel and erases the network topology.
a.
Click the
icon in the desired VPN site’s row.
A confirmation message appears.
b.
Click OK.
The icon changes to
, and the VPN site is disabled.
Logging in to a Remote Access VPN Site
You need to manually log in to Remote Access VPN Servers configured for Manual Login.
You do not need to manually log in to a Remote Access VPN Server configured for
Automatic Login or a Site-to-Site VPN Gateway: all the computers on your network have
constant access to it.
Manual Login can be done through either the Safe@Office Portal or the my.vpn page.
When you log in and traffic is sent to the VPN site, a VPN tunnel is established. Only the
computer from which you logged in can use the tunnel. To share the tunnel with other
computers in your home network, you must log in to the VPN site from those computers,
using the same user name and password.
Note: You must use a single user name and password for each VPN destination
gateway.
616
Check Point Safe@Office User Guide
Logging in to a Remote Access VPN Site
Logging in through the Safe@Office Portal
Note: You can only log in to sites that are configured for Manual Login.
To manually log in to a VPN site through the Safe@Office Portal
1.
Click VPN in the main menu, and click the VPN Sites tab.
The VPN Sites page appears.
2.
Next to the desired VPN site, click Login.
The VPN Status dialog box appears.
3.
Type your user name and password in the appropriate fields.
4.
Click Login.
•
If the Safe@Office appliance is configured to automatically download the
network configuration, the Safe@Office appliance downloads the network
configuration.
•
If when adding the VPN site you specified a network configuration, the
Safe@Office appliance attempts to create a tunnel to the VPN site.
Once the Safe@Office appliance has finished connecting, the dialog box displays
“Connected”.
•
The VPN Status dialog box remains open until you manually log out of the
VPN site.
Chapter 19: Working With VPNs
617
Logging in to a Remote Access VPN Site
Logging in through the my.vpn page
Note: You do not need to know the my.firewall page administrator’s password in
order to use the my.vpn page.
To manually log in to a VPN site through the my.vpn page
1.
Direct your Web browser to http://my.vpn
The VPN Login screen appears.
2.
In the Site Name list, select the site to which you want to log in.
3.
Enter your user name and password in the appropriate fields.
4.
Click Login.
•
618
If the Safe@Office appliance is configured to automatically download the
network configuration, the Safe@Office appliance downloads the network
configuration.
Check Point Safe@Office User Guide
Logging Out of a Remote Access VPN Site
•
If when adding the VPN site you specified a network configuration, the
Safe@Office appliance attempts to create a tunnel to the VPN site.
•
The VPN Login Status box appears. The Status field tracks the connection’s
progress.
•
Once the Safe@Office appliance has finished connecting, the Status field
changes to “Connected”.
•
The VPN Login Status box remains open until you manually log out of the
VPN site.
Logging Out of a Remote Access VPN Site
You need to manually log out of a VPN site, if it is a Remote Access VPN site configured
for Manual Login.
To log out of a VPN site
•
In the VPN Login Status box, click Logout.
All open tunnels from the Safe@Office appliance to the VPN site are closed, and the
VPN Login Status box closes.
Note: Closing the browser or dismissing the VPN Login Status box will also terminate
the VPN session within a short time.
Chapter 19: Working With VPNs
619
Using Certificates
Using Certificates
A digital certificate is a secure means of authenticating the Safe@Office appliance to other
Site-to-Site VPN Gateways. The certificate is issued by the Certificate Authority (CA) to
entities such as gateways, users, or computers. The entity then uses the certificate to
identify itself and provide verifiable information.
For instance, the certificate includes the Distinguished Name (DN) (identifying
information) of the entity, as well as the public key (information about itself). After two
entities exchange and validate each other's certificates, they can begin encrypting
information between themselves using the public keys in the certificates.
The certificate also includes a fingerprint, a unique text used to identify the certificate. You
can email your certificate's fingerprint to the remote user. Upon connecting to the
Safe@Office VPN Server for the first time, the entity should check that the VPN peer's
fingerprint displayed in the SecuRemote/SecureClient VPN Client is identical to the
fingerprint received.
The Safe@Office appliance supports certificates encoded in the PKCS#12 (Personal
Information Exchange Syntax Standard) format.
Installing a Certificate
The Safe@Office appliance enables you to install PKCS#12 certificates in the following
ways:
•
By generating a self-signed certificate.
See Generating a Self-Signed Certificate on page 621.
•
By importing a certificate.
The PKCS#12 file you import must have a ".p12" file extension. If you do not have
such a PKCS#12 file, obtain one from your network security administrator.
See Importing a Certificate on page 626.
620
Check Point Safe@Office User Guide
Using Certificates
Note: To use certificates authentication, each Safe@Office appliance should have a
unique certificate. Do not use the same certificate for more than one gateway.
Note: If your Safe@Office appliance is centrally managed, a certificate is
automatically generated and downloaded to your appliance. In this case, there is no
need to generate a self-signed certificate.
Generating a Self-Signed Certificate
To generate a self-signed certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears.
2.
Click Install Certificate.
Chapter 19: Working With VPNs
621
Using Certificates
The Safe@Office Certificate Wizard opens, with the Certificate Wizard dialog box
displayed.
3.
Click Generate a self-signed security certificate for this gateway.
The Create Self-Signed Certificate dialog box appears.
4.
Complete the fields using the information in the following table.
5.
Click Next.
622
Check Point Safe@Office User Guide
Using Certificates
The Safe@Office appliance generates the certificate. This may take a few seconds.
The Done dialog box appears, displaying the certificate's details.
6.
Click Finish.
The Safe@Office appliance installs the certificate. If a certificate is already installed,
it is overwritten.
The Certificate Wizard closes.
The Certificates page displays the following information:
•
The gateway's certificate
•
The gateway's name
•
The gateway certificate's fingerprint
•
The CA's certificate
•
The name of the CA that issued the certificate (in this case, the Safe@Office
gateway)
•
The CA certificate's fingerprint
Chapter 19: Working With VPNs
623
Using Certificates
•
624
The starting and ending dates between which the gateway's certificate and the
CA's certificate are valid
Check Point Safe@Office User Guide
Using Certificates
Table 127: Certificate Fields
In this field…
Do this…
Country
Select your country from the drop-down list.
Organization
Type the name of your organization.
Name
Organizational Unit
Type the name of your division.
Gateway Name
Type the gateway's name. This name will appear on the certificate, and will
be visible to remote users inspecting the certificate.
This field is filled in automatically with the gateway's MAC address. If
desired, you can change this to a more descriptive name.
Valid Until
Use the drop-down lists to specify the month, day, and year when this
certificate should expire.
Note: You must renew the certificate when it expires.
Chapter 19: Working With VPNs
625
Using Certificates
Importing a Certificate
To install a certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears.
2.
Click Install Certificate.
The Safe@Office Certificate Wizard opens, with the Certificate Wizard dialog box
displayed.
3.
Click Import a security certificate in PKCS#12 format.
The Import Certificate dialog box appears.
4.
Click Browse to open a file browser from which to locate and select the file.
The filename that you selected is displayed.
5.
626
Click Next.
Check Point Safe@Office User Guide
Using Certificates
The Import-Certificate Passphrase dialog box appears. This may take a few moments.
6.
Type the pass-phrase you received from the network security administrator.
7.
Click Next.
The Done dialog box appears, displaying the certificate's details.
8.
Click Finish.
The Safe@Office appliance installs the certificate. If a certificate is already installed,
it is overwritten.
The Certificate Wizard closes.
The Certificates page displays the following information:
•
The gateway's certificate
•
The gateway's name
•
The gateway certificate's fingerprint
•
The CA's certificate
•
The name of the CA that issued the certificate
•
The CA certificate's fingerprint
Chapter 19: Working With VPNs
627
Using Certificates
•
The starting and ending dates between which the gateway's certificate and the
CA's certificate are valid
Uninstalling a Certificate
If you uninstall the certificate, no certificate will exist on the Safe@Office appliance, and
you will not be able to connect to the VPN if a certificate is required.
You cannot uninstall the certificate if there is a VPN site currently defined to use
certificate authentication.
Note: If you want to replace a currently-installed certificate, there is no need to
uninstall the certificate first. When you install the new certificate, the old certificate
will be overwritten.
To uninstall a certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears with the name of the currently installed certificate.
2.
Click Uninstall.
A confirmation message appears.
3.
Click OK.
The certificate is uninstalled.
A success message appears.
4.
628
Click OK.
Check Point Safe@Office User Guide
Using Certificates
Exporting Certificates
The Safe@Office appliance allows you to export the following certificates:
•
The device certificate
Exporting the device certificate is useful for backup purposes.
Note: If your Safe@Office appliance is centrally managed, there is no need to back
up the device certificate, as it can be downloaded from the Service Center as
needed.
•
The device Certificate Authority (CA) certificate
When using the Safe@Office EAP authenticator with WPA-Enterprise or 802.1x
security protocols, you must export the device CA certificate and send it to clients that
need to connect to the Safe@Office appliance. For information on the EAP
authenticator, see Using the EAP Authenticator on page 394.
The certificates are exported in PKCS#12 format (that is, as a *.p12 file).
Exporting the Safe@Office Appliance Certificate
To export the Safe@Office appliance certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears with the name of the currently installed certificate.
2.
Click Export Certificate.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the certificate file and click Save.
Chapter 19: Working With VPNs
629
Using Certificates
The certificate is exported as a *.p12 file and saved to the specified directory.
Note: This file contains the gateway's private key, which is confidential and must not
be passed to unauthorized users.
Exporting the CA Certificate
To export the CA certificate
1.
Click VPN in the main menu, and click the Certificate tab.
The Certificate page appears with the name of the currently installed certificate.
2.
Click Export CA Certificate.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the CA certificate file and click Save.
The CA certificate is exported as a *.p12 file and saved to the specified directory.
630
Check Point Safe@Office User Guide
Viewing VPN Tunnels
Viewing VPN Tunnels
You can view a list of currently established VPN tunnels. VPN tunnels are created and
closed as follows:
•
Remote Access VPN sites configured for Automatic Login and Site-to-Site VPN
Gateways
A tunnel is created whenever your computer attempts any kind of communication with
a computer at the VPN site. The tunnel is closed when not in use for a period of time.
Note: Although the VPN tunnel is automatically closed, the site remains open, and if
you attempt to communicate with the site, the tunnel will be reestablished.
•
Remote Access VPN sites configured for Manual Login
A tunnel is created whenever your computer attempts any kind of communication with
a computer at the VPN site, after you have manually logged in to the site. All open
tunnels connecting to the site are closed when you manually log out.
To view VPN tunnels
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open VPN tunnels.
The VPN Tunnels page includes the information described in the following table.
Chapter 19: Working With VPNs
631
Viewing VPN Tunnels
2.
To resize a column, drag the relevant column divider right or left.
3.
To refresh the table, click Refresh.
Table 128: VPN Tunnels Page Fields
This field…
Displays…
Type
The currently active security protocol (IPSEC).
Source
The IP address or address range of the entity from which the tunnel
originates.
The entity's type is indicated by an icon. See VPN Tunnel Icons on page
633.
Destination
The IP address or address range of the entity to which the tunnel is
connected.
The entity's type is indicated by an icon. See VPN Tunnel Icons on page
633.
Security
The type of encryption used to secure the connection, and the type of
Message Authentication Code (MAC) used to verify the integrity of the
message. This information is presented in the following format: Encryption
type/Authentication type.
In addition, if IPSec compression is enabled for the tunnel, this field displays
the
icon.
Note: All VPN settings are automatically negotiated between the two sites.
The encryption and authentication schemes used for the connection are the
strongest of those used at the two sites.
Your Safe@Office appliance supports AES, 3DES, and DES encryption
schemes, and MD5 and SHA authentication schemes.
632
Check Point Safe@Office User Guide
Viewing VPN Tunnels
This field…
Displays…
Established
The time at which the tunnel was established.
This information is presented in the format hh:mm:ss, where:
hh=hours
mm=minutes
ss=seconds
Table 129: VPN Tunnels Icons
This icon…
Represents…
This gateway
A network for which an IKE Phase-2 tunnel was negotiated
A Remote Access VPN Server
A Site-to-Site VPN Gateway
A remote access VPN user
An L2TP user
Chapter 19: Working With VPNs
633
Viewing IKE Traces for VPN Connections
Viewing IKE Traces for VPN Connections
If you are experiencing VPN connection problems, you can save a trace of IKE (Internet
Key Exchange) negotiations to a file, and then use the free IKE View tool to view the file.
The IKE View tool is available for the Windows platform.
Note: Before viewing IKE traces, it is recommended to do the following:
•
The Safe@Office appliance stores traces for all recent IKE
negotiations. If you want to view only new IKE trace data, clear all IKE
trace data currently stored on the Safe@Office appliance.
•
Close all existing VPN tunnels except for the problematic tunnel, so as
to make it easier to locate the problematic tunnel's IKE negotiation
trace in the exported file.
To clear all currently-stored IKE traces
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
2.
Click Clear IKE Trace.
All IKE trace data currently stored on the Safe@Office appliance is cleared.
To view the IKE trace for a connection
1.
Establish a VPN tunnel to the VPN site with which you are experiencing
connection problems.
For information on when and how VPN tunnels are established, see Viewing VPN
Tunnels on page 631.
2.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
3.
Click Save IKE Trace.
A standard File Download dialog box appears.
4.
634
Click Save.
Check Point Safe@Office User Guide
Viewing VPN Topology
The Save As dialog box appears.
5.
Browse to a destination directory of your choice.
6.
Type a name for the *.elg file and click Save.
The *.elg file is created and saved to the specified directory. This file contains the IKE
traces of all currently-established VPN tunnels.
7.
Use the IKE View tool to open and view the *.elg file, or send the file to
technical support.
Viewing VPN Topology
You can view the topology of VPN sites to which the Safe@Office appliance is currently
connected.
To view VPN topology
1.
Click Reports in the main menu, and click the Tunnels tab.
The VPN Tunnels page appears with a table of open tunnels to VPN sites.
2.
Click View Topology.
Chapter 19: Working With VPNs
635
Viewing VPN Topology
The VPN Topology page appears displaying a tree of VPN sites to which the appliance
is connected.
3.
To view topology information for a VPN site, in the tree, click the VPN site's
name.
The right pane displays the information described in the following table.
636
Check Point Safe@Office User Guide
Viewing VPN Topology
Table 130: VPN Topology Page Fields
This field…
Displays…
Split DNS
The VPN site's split DNS mappings.
When split DNS is configured for a VPN site, certain domain suffixes are
mapped to corporate DNS servers. This means that requests for these
domain suffixes are sent to the specific DNS servers to which they are
mapped, while all other requests are sent to the ISP's DNS servers. For
example, a VPN site's split DNS mappings might indicate that all requests
for the domain suffix ".acme.com" should be sent to the Acme company's
corporate DNS servers.
Trusted CAs
A list of root CAs at the VPN site, whose certificates are trusted by this
gateway.
Sub-CAs
A list of second-level CAs at the VPN site, which are signed by a trusted
root CA.
Chapter 19: Working With VPNs
637
Changing Your Login Credentials
Chapter 20
Managing Users
This chapter describes how to manage Safe@Office appliance users. You can define
multiple users, set their passwords, and assign them various permissions.
This chapter includes the following topics:
Changing Your Login Credentials............................................................639
Adding and Editing Users ........................................................................643
Adding Quick Guest HotSpot Users.........................................................647
Viewing and Deleting Users.....................................................................649
Setting Up Remote VPN Access for Users...............................................650
Using RADIUS Authentication ................................................................650
Configuring RADIUS Attributes..............................................................657
Changing Your Login Credentials
You can change your username and password at any time.
To change your login credentials
1.
Click Users in the main menu, and click the Internal Users tab.
Chapter 20: Managing Users
639
Changing Your Login Credentials
The Internal Users page appears.
2.
640
In the row of your username, click Edit.
Check Point Safe@Office User Guide
Changing Your Login Credentials
The Account Wizard opens displaying the Set User Details dialog box.
3.
Edit the Username field.
4.
Edit the Password and Confirm password fields.
Note: Use 5 to 25 characters (letters or numbers) for the new password.
5.
Click Next.
Chapter 20: Managing Users
641
Changing Your Login Credentials
The Set User Permissions dialog box appears.
6.
Click Finish.
Your changes are saved.
642
Check Point Safe@Office User Guide
Adding and Editing Users
Adding and Editing Users
This procedure explains how to add and edit users.
For information on quickly adding guest HotSpot users via a shortcut that the Safe@Office
appliance provides, see Adding Quick Guest HotSpot Users on page 647.
To add or edit a user
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears.
2.
Do one of the following:
•
To create a new user, click New User.
next to the desired user.
• To edit an existing user, click
The Account Wizard opens displaying the Set User Details dialog box.
3.
Complete the fields using the information in Set User Details Fields on page
644.
Chapter 20: Managing Users
643
Adding and Editing Users
4.
Click Next.
The Set User Permissions dialog box appears.
The options that appear on the page are dependant on the software and services you
are using.
5.
Complete the fields using the information in Set User Permissions Fields on
page 645.
6.
Click Finish.
The user is saved.
Table 131: Set User Details Fields
In this field…
Do this…
Username
Enter a username for the user.
Password
Enter a password for the user. Use five to 25 characters (letters or
numbers) for the new password.
Confirm Password
644
Re-enter the user’s password.
Check Point Safe@Office User Guide
Adding and Editing Users
In this field…
Do this…
Expires On
To specify an expiration time for the user, select this option and specify
the expiration date and time in the fields provided.
When the user account expires, it is locked, and the user can no longer
log in to the Safe@Office appliance.
If you do not select this option, the user will not expire.
Table 132: Set User Permissions Fields
In this field...
Do this...
Administrator Level
Select the user’s level of access to the Safe@Office Portal.
The levels are:
•
No Access: The user cannot access the Safe@Office Portal.
•
Read Only: The user can log in to the Safe@Office Portal,
but cannot modify system settings or export the appliance
configuration via the Setup>Tools page. For example, you
could assign this administrator level to technical support
personnel who need to view the Event Log.
•
Read/Write: The user can log in to the Safe@Office Portal
and modify system settings.
The default level is No Access.
The “admin” user’s Administrator Level (Read/Write) cannot be
changed.
VPN Remote
Select this option to allow the user to connect to this Safe@Office
Access
appliance using their VPN client.
For further information on setting up VPN remote access, see see
Setting Up Remote VPN Access for Users on page 650
Chapter 20: Managing Users
645
Adding and Editing Users
Web Filtering
Select this option to allow the user to override the Web Filtering service
Override
and Web rules.
This option cannot be changed for the “admin” user.
HotSpot Access
Select this option to allow the user to log in to the My HotSpot page.
For information on Secure HotSpot, see Configuring Secure HotSpot
on page 380.
This option only appears in Safe@Office 500 with Power Pack.
Remote Desktop
Select this option to allow the user to log in to the my.firewall portal, view
Access
the Active Computers page, and remotely access computers' desktops,
using the Remote Desktop feature.
Note: The user can perform these actions, even if their level of
administrative access is "No Access".
For information on Remote Desktop, see Using Remote Desktop on
page 661.
Users Manager
Select this option to allow the user to log in to the Safe@Office Portal
and add, edit, or delete "No Access"-level users, but not modify other
system settings.
For example, you could assign this administrator level to clerks who
need to manage HotSpot users.
Network Access
Select this option to allow the user to connect to this Safe@Office
appliance via a wireless client or by connecting to the appliance's ports,
when the Safe@Office EAP authenticator is used.
For information on the Safe@Office EAP authenticator, see Using the
Safe@Office EAP Authenticator on page 394.
646
Check Point Safe@Office User Guide
Adding Quick Guest HotSpot Users
Adding Quick Guest HotSpot Users
The Safe@Office appliance provides a shortcut for quickly adding a guest HotSpot user.
This is useful in situations where you want to grant temporary network access to guests,
for example in an Internet café. The shortcut also enables printing the guest user's details in
one click.
By default, the quick guest user has the following characteristics:
•
Username in the format guest, where  is a unique
three-digit number.
For example: guest123
•
Randomly generated password
•
Expires in 24 hours
•
Administration Level: No Access
•
Permissions: HotSpot Access only
For information on configuring Secure HotSpot, see Using Secure HotSpot on page 380.
For information on changing the default expiration period, refer to the Embedded NGX CLI
Reference Guide.
To quickly create a guest user
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears.
2.
Click Quick Guest.
Chapter 20: Managing Users
647
Adding Quick Guest HotSpot Users
The Account Wizard opens displaying the Save Quick Guest dialog box.
3.
In the Expires field, click on the arrows to specify the expiration date and time.
4.
To print the user details, click Print.
5.
Click Finish.
The guest user is saved.
You can edit the guest user's details and permissions using the procedure Adding and
Editing Users on page 643.
648
Check Point Safe@Office User Guide
Viewing and Deleting Users
Viewing and Deleting Users
Note: The “admin” user cannot be deleted.
To view or delete users
1.
Click Users in the main menu, and click the Internal Users tab.
The Internal Users page appears with a list of all users and their permissions.
The expiration time of expired users appears in red.
2.
To delete a user, do the following:
a)
In the desired user’s row, click
A confirmation message appears.
b) Click OK.
3.
The user is deleted.
To delete all expired users, do the following:
a)
Click Clear Expired.
A confirmation message appears.
b) Click OK.
The expired users are deleted.
Chapter 20: Managing Users
649
Setting Up Remote VPN Access for Users
Setting Up Remote VPN Access for Users
If you are using your Safe@Office appliance as a SecuRemote Remote Access VPN
Server, as an internal VPN Server, or as an L2TP VPN Server, you can allow users to
access it remotely through their Remote Access VPN Clients (a Check Point SecureClient,
Check Point SecuRemote, an L2TP VPN Client, or another Embedded NGX appliance).
To set up remote VPN access for a user
1.
Enable your VPN Server, using the procedure Setting Up Your Safe@Office
Appliance as a VPN Server on page 567.
2.
Add or edit the user, using the procedure Adding and Editing Users on page
643.
You must select the VPN Remote Access option.
Using RADIUS Authentication
You can use Remote Authentication Dial-In User Service (RADIUS) to authenticate both
Safe@Office appliance users and Remote Access VPN Clients trying to connect to the
Safe@Office appliance.
Note: When RADIUS authentication is in use, Remote Access VPN Clients must
have a certificate.
When a user tries to log in to the Safe@Office Portal, the Safe@Office appliance sends the
entered user name and password to the RADIUS server. The server then checks whether
the RADIUS database contains a matching user name and password pair. If so, then the
user is logged in.
By default, all RADIUS-authenticated users are assigned the set of permissions specified
in the Safe@Office Portal's RADIUS page. However, you can configure the RADIUS server
to pass the Safe@Office appliance a specific set of permissions to grant the authenticated
user, instead of these default permissions. This is done by configuring the RADIUS
650
Check Point Safe@Office User Guide
Using RADIUS Authentication
Vendor-Specific Attribute (VSA) with a set of attributes containing permission
information for specific users. If the VSA is configured for a user, then the RADIUS server
passes the VSA to the Safe@Office appliance as part of the response to the authentication
request, and the gateway assigns the user permissions as specified in the VSA. If the VSA
is not returned by the RADIUS server for a specific user, the gateway will use the default
permission set for this user.
In addition, you can configure the RADIUS server to pass the Safe@Office appliance a
Secure HotSpot session timeout value. When the RADIUS server's Session-Timeout
Attribute is configured, HotSpot users will be logged out after the specified session
timeout has elapsed.
To use RADIUS authentication
1.
Click Users in the main menu, and click the RADIUS tab.
Chapter 20: Managing Users
651
Using RADIUS Authentication
The RADIUS page appears.
2.
Complete the fields using the following table.
3.
Click Apply.
4.
To restore the default RADIUS settings, do the following:
a)
Click Default.
A confirmation message appears.
b) Click OK.
The RADIUS settings are reset to their defaults. For information on the default
values, refer to the following table.
652
Check Point Safe@Office User Guide
Using RADIUS Authentication
5.
If desired, configure user permissions and/or the HotSpot session timeout on
the RADIUS server.
See Configuring RADIUS Attributes on page 657.
Table 133: RADIUS Page Fields
In this field…
Do this…
Primary/Secondary
Configure the primary and secondary RADIUS servers.
RADIUS Server
By default, the Safe@Office appliance sends a request to the primary
RADIUS server first. If the primary RADIUS server does not respond
after three attempts, the Safe@Office appliance will send the request to
the secondary RADIUS server.
Address
Type the IP address of the computer that will run the RADIUS service
(one of your network computers) or click the corresponding This
Computer button to allow your computer to host the service.
To clear the text box, click Clear.
Port
Type the port number on the RADIUS server’s host computer.
The default port number is 1812.
Shared Secret
Type the shared secret to use for secure communication with the
RADIUS server.
Chapter 20: Managing Users
653
Using RADIUS Authentication
In this field…
Do this…
Realm
If your organization uses RADIUS realms, type the realm to append to
RADIUS requests. The realm will be appended to the username as
follows: @
For example, if you set the realm to “myrealm”, and the user "JohnS"
attempts to log in to the Safe@Office Portal, the Safe@Office
appliance will send the RADIUS server an authentication request with
the username “JohnS@myrealm”.
This field is optional.
Timeout
Type the interval of time in seconds between attempts to communicate
with the RADIUS server.
The default value is 3 seconds.
RADIUS User
Permissions
If the RADIUS VSA (Vendor-Specific Attribute) is configured for a user,
the fields in this area will have no effect, and the user will be granted
the permissions specified in the VSA.
If the VSA is not configured for the user, the permissions configured in
this area will be used.
654
Check Point Safe@Office User Guide
Using RADIUS Authentication
In this field…
Do this…
Administrator Level
Select the level of access to the Safe@Office Portal to assign to all
users authenticated by the RADIUS server.
The levels are:
•
No Access: The user cannot access the Safe@Office Portal.
•
Read Only: The user can log in to the Safe@Office Portal,
but cannot modify system settings or export the appliance
configuration via the Setup>Tools page. For example, you
could assign this administrator level to technical support
personnel who need to view the Event Log.
•
Read/Write: The user can log in to the Safe@Office Portal
and modify system settings.
The default level is No Access.
VPN Remote Access
Select this option to allow all users authenticated by the RADIUS server
to connect to this Safe@Office appliance using their VPN client.
For further information on setting up VPN remote access, see Setting
Up Remote VPN Access for Users on page 650.
Web Filtering
Select this option to allow all users authenticated by the RADIUS server
Override
to override Web Filtering.
This option only appears if the Web Filtering service is defined.
HotSpot Access
Select this option to allow all users authenticated by the RADIUS server
to access the My HotSpot page.
For information on Secure HotSpot, see Configuring Secure HotSpot
on page 380.
This option only appears in Safe@Office 500 with Power Pack.
Chapter 20: Managing Users
655
Using RADIUS Authentication
In this field…
Do this…
Remote Desktop
Select this option to allow all users authenticated by the RADIUS server
Access
to log in to the my.firewall portal, view the Active Computers page, and
remotely access computers' desktops, using the Remote Desktop
feature.
Note: Authenticated users can perform these actions, even if their level of
administrative access is "No Access".
For information on Remote Desktop, see Using Remote Desktop on
page 661.
Users Manager
Select this option to allow all users authenticated by the RADIUS
server to log in to the Safe@Office Portal and add, edit, or delete "No
Access"-level users, but not modify other system settings.
For example, you could assign this administrator level to clerks who
need to manage HotSpot users.
656
Check Point Safe@Office User Guide
Configuring RADIUS Attributes
Configuring RADIUS Attributes
To define a timeout for Secure HotSpot sessions
•
Set the Session-Timeout Attribute (attribute 27) to the number of seconds after
which users should be automatically logged out from the hotspot.
To assign permissions to specific RADIUS-authenticated users
1.
Create a remote access policy as follows:
a)
Assign the policy’s VSA (attribute 26) the SofaWare vendor code (6983).
b) For each permission you want to grant, configure the relevant attribute of
the VSA with the desired value, as described in the following table.
For example, to assign the user VPN access permissions, set attribute number 2 to
“true”.
2.
Assign the policy to the desired user or user group.
For detailed instructions and examples, refer to the "Configuring the RADIUS VendorSpecific Attribute" white paper.
Chapter 20: Managing Users
657
Configuring RADIUS Attributes
Table 134: VSA Syntax
Permission
Admin
Description
Indicates the
Attribute
Attribute
Number
Format
String
Attribute Values
none. The user
administrator’s
cannot access the
level of access to
Safe@Office
the Safe@Office
Portal.
Portal
Notes
readonly. The user
can log in to the
Safe@Office
Portal, but cannot
modify system
settings.
users-manager. The
user can log in to
the Safe@Office
Portal and add,
edit, or delete "No
Access"-level
users. However,
the user cannot
modify other
system settings.
readwrite. The user
can log in to the
Safe@Office
Portal and modify
system settings.
658
Check Point Safe@Office User Guide
Configuring RADIUS Attributes
Permission
VPN
Description
Attribute Values
Notes
true. The user can
This permission
the user can
remotely access
is only relevant if
access the
the network via
the Safe@Office
network from a
VPN.
Remote Access
Indicates whether
Attribute
Attribute
Number
Format
String
Remote Access
false. The user
VPN Client.
cannot remotely
access the
network via VPN.
Hotspot
VPN Server is
enabled. The
gateway must
have a
certificate.
true. The user can
This permission
the user can log
access the Internet
is only relevant if
in via the My
via My HotSpot.
the Secure
Indicates whether
String
HotSpot page.
false. The user
HotSpot feature
is enabled.
cannot access the
Internet via My
HotSpot.
UFP
true. The user can
This permission is
the user can
override Web
only relevant if
override Web
Filtering.
the Web Filtering
Indicates whether
Filtering.
String
false. The user
service is
enabled.
cannot override
Web Filtering.
Chapter 20: Managing Users
659
Configuring RADIUS Attributes
Permission
Description
Attribute
Attribute
Number
Format
String
Attribute Values
Notes
true. The user can
This permission is
RemoteDe
Indicates whether
sktop
the user can
log in to the
only relevant if
remotely access
my.firewall portal,
the Remote
computers'
view the Active
Desktop feature is
desktops, using
Computers page,
enabled.
the Remote
and remotely
Desktop feature.
access computers'
desktops
(irrespective of their
level of
administrative
access).
false. The user
cannot remotely
access computers'
desktops.
660
Check Point Safe@Office User Guide
Overview
Chapter 21
Using Remote Desktop
This chapter describes how to remotely access the desktop of each of your computers,
using the Safe@Office appliance's Remote Desktop feature.
This chapter includes the following topics:
Overview ..................................................................................................661
Workflow..................................................................................................662
Configuring Remote Desktop...................................................................663
Configuring the Host Computer ...............................................................666
Accessing a Remote Computer's Desktop ................................................669
Overview
Your Safe@Office appliance includes an integrated client for Microsoft Terminal Services,
allowing you to remotely access the desktop of each of your computers from anywhere, via
the Safe@Office Portal. You can even redirect your printers or ports to a remote computer,
so that you can print and transfer files with ease.
Remote Desktop sessions use the Microsoft Remote Desktop Protocol (RDP) on TCP port
3389. This port is opened dynamically between the Remote Desktop client and the Remote
Desktop server as needed, meaning that the port is not exposed to the Internet, and your
constant security is ensured.
Note: By default, the Microsoft RDP protocol is secured with 128-bit RC4 encryption.
For the strongest possible security, it is recommended to use Remote Desktop over
an IPSec VPN connection. For information on VPNs, see Working With VPNs on
page 561.
Chapter 21: Using Remote Desktop
661
Workflow
Workflow
To use Remote Desktop
1.
Configure Remote Desktop.
See Configuring Remote Desktop on page 663.
2.
Enable the Remote Desktop server on computers that authorized users should
be allowed to remotely access.
See Configuring the Host Computer on page 666.
3.
Grant Remote Desktop Access permissions to users who should be allowed to
remotely access desktops.
See Adding and Editing Users on page 643.
4.
The authorized users can access remote computers' desktops as desired.
See Accessing a Remote Computer's Desktop on page 669.
662
Check Point Safe@Office User Guide
Configuring Remote Desktop
Configuring Remote Desktop
To configure Remote Desktop
1.
Click Setup in the main menu, and click the Remote Desktop tab.
The Remote Desktop page appears.
2.
Do one of the following:
•
To enable Remote Desktop, select the Allow remote desktop access check
box.
Chapter 21: Using Remote Desktop
663
Configuring Remote Desktop
New fields appear.
•
To disable Remote Desktop, clear the Allow remote desktop access check box.
3.
Fields disappear.
Complete the fields using the information in the following table.
4.
Click Apply.
664
Check Point Safe@Office User Guide
Configuring Remote Desktop
Table 135: Remote Desktop Options
In this field…
Do this…
Sharing
Share local drives
Select this option to allow the host computer to access hard drives on
the client computer. This enables remote users to access their local hard
drives when logged in to the host computer.
Share local printers
Select this option to allow the host computer to access printers on the
client computer. This enables remote users to access their local printer
when logged in to the host computer.
Share local
Select this option to allow the host computer to access smartcards on
smartcards
the client computer. This enables remote users to access their local
smartcards when logged in to the host computer.
Share local COM
Select this option to allow the host computer to access COM ports on
ports
the client computer. This enables remote users to access their local
COM ports when logged in to the host computer.
Advanced
Full screen mode
Select this option to open Remote Desktop sessions on the whole
screen.
Optimize
Select this option to optimize Remote Desktop sessions for slow links.
performance for slow
links
Bandwidth-consuming options, such as wallpaper and menu animations,
will be disabled.
Chapter 21: Using Remote Desktop
665
Configuring the Host Computer
Configuring the Host Computer
To enable remote users to connect to a computer, you must enable the Remote Desktop
server on that computer.
Note: The host computer must have one of the following operating systems installed:
•
Microsoft Windows Server 2003
•
Microsoft Windows XP Professional
•
Microsoft Windows XP Media Center
•
Microsoft Windows XP Tablet PC 2005
To enable users to remotely connect to a computer
1.
Log on to the desired computer as an administrator.
2.
For each remote user who should be allowed to access this computer, create a
user account with a password.
For information, refer to Microsoft documentation.
3.
On the desktop, right-click on My Computer, and select Properties in the popup menu that appears.
The System Properties dialog box appears displaying the General tab.
4.
666
Click the Remote tab.
Check Point Safe@Office User Guide
Configuring the Host Computer
The Remote tab appears.
5.
Select the Allow users to connect remotely to this computer check box.
6.
Click Select Remote Users.
The Remote Desktop Users dialog box appears.
7.
Do the following for each remote user who should be allowed to access this
computer:
a.
Click Add.
Chapter 21: Using Remote Desktop
667
Configuring the Host Computer
The Select Users dialog box appears.
b.
Type the desired user's username in the text box.
The Check Names button is enabled.
c.
Click Check Names.
d.
Click OK.
The Remote Desktop Users dialog box reappears with the desired user's username.
8.
Click OK.
9.
Click OK.
668
Check Point Safe@Office User Guide
Accessing a Remote Computer's Desktop
Accessing a Remote Computer's Desktop
Note: The client computer must meet the following requirements:
•
Microsoft Internet Explorer 6.0 or later
•
A working Internet connection
To access a remote computer's desktop
1.
Click Reports in the main menu, and click the My Computers tab.
The My Computers page appears.
2.
Next to the desired computer, click Remote Desktop.
The following things happen:
Chapter 21: Using Remote Desktop
669
Accessing a Remote Computer's Desktop
3.
•
If you are prompted to install the Remote Desktop Active X Control, then
install it.
•
The Remote Desktop Connection Security Warning dialog box appears.
Select the desired connection options.
The available options depend on your Remote Desktop configuration. See
Configuring Remote Desktop on page 663.
4.
Click OK.
The Log On to Windows dialog box appears.
5.
Type your username and password for the remote computer.
These are the credentials configured for your user account in Enabling the Remote
Desktop Server on page 666.
6.
Click OK.
The remote computer's desktop appears onscreen.
670
Check Point Safe@Office User Guide
Accessing a Remote Computer's Desktop
You can use the following keyboard shortcuts during the Remote Desktop session:
Table 136: Remote Desktop Keyboard Shortcuts
This shortcut…
Does this…
ALT+INSERT
Cycles through running programs in the order that they were started
ALT+HOME
Displays the Start menu
CTRL+ALT+BREAK
Toggles between displaying the session in a window and on the full
screen
CTRL+ALT+END
Opens the Windows Security dialog box
Chapter 21: Using Remote Desktop
671
Overview
Chapter 22
Controlling the Appliance via the
Command Line
This chapter describes various ways of controlling your Safe@Office appliance through
the command line.
This chapter includes the following topics:
Overview ..................................................................................................673
Using the Safe@Office Portal ..................................................................674
Using the Serial Console ..........................................................................676
Configuring SSH ......................................................................................679
Overview
Depending on your Safe@Office model, you can control your appliance via the command
line in the following ways:
•
Using the Safe@Office Portal's command line interface.
See Using the Safe@Office Portal on page 674.
•
Using a console connected to the Safe@Office appliance.
For information, see Using the Serial Console on page 676.
•
Using an SSH client.
See Configuring SSH on page 679.
Chapter 22: Controlling the Appliance via the Command Line
673
Using the Safe@Office Portal
Using the Safe@Office Portal
You can control your appliance via the Safe@Office Portal's command line interface.
To control the appliance via the Safe@Office Portal
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
674
Click Command.
Check Point Safe@Office User Guide
Using the Safe@Office Portal
The Command Line page appears.
3.
In the upper field, type a command.
You can view a list of supported commands using the command help.
For information on all commands, refer to the Embedded NGX CLI Reference Guide.
4.
Click Go.
The command is implemented.
Chapter 22: Controlling the Appliance via the Command Line
675
Using the Serial Console
Using the Serial Console
You can connect a console to the Safe@Office appliance, and use the console to control
the appliance via the command line.
Note: Your terminal emulation software and your Safe@Office appliance's Serial
port must be configured for the same speed.
By default, the appliance's Serial port's speed is 57600 bps. For information on
changing the Serial port's speed, refer to the Embedded NGX CLI Reference
Guide.
To control the appliance via a console
1.
Connect the serial console to your Safe@Office appliance's Serial port, using
an RS-232 Null modem cable.
For information on locating the Serial port, see Rear Panel.
2.
676
Click Network in the main menu, and click the Ports tab.
Check Point Safe@Office User Guide
Using the Serial Console
The Ports page appears.
3.
Next to the Serial port, click Edit.
Chapter 22: Controlling the Appliance via the Command Line
677
Using the Serial Console
The Port Setup page appears.
4.
In the Assign to drop-down list, select Console.
5.
In the Port Speed drop-down list, select the Serial port's speed (in bits per
second).
The Serial port's speed must match that of the attached serial console. The default
value is 57600.
6.
In the Flow Control drop-down list, select the method of flow control supported
by the attached device:
•
7.
RTS/CTS. Hardware-based flow control, using the Serial port's RTS/CTS lines.
• XON/XOFF. Software-based flow control, using XON/XOFF characters.
Click Apply.
You can now control the Safe@Office appliance from the serial console.
For information on all supported commands, refer to the Embedded NGX CLI
Reference Guide.
678
Check Point Safe@Office User Guide
Configuring SSH
Configuring SSH
Safe@Office appliance users can control the appliance via the command line, using the
SSH (Secure Shell) management protocol. You can enable users to do so via the Internet,
by configuring remote SSH access. You can also integrate the Safe@Office appliance with
SSH-based management systems.
Note: The Safe@Office appliance supports SSHv2 clients only. The SSHv1 protocol
contains security vulnerabilities and is not supported.
Note: Configuring SSH is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for SSH, such as allowing
SSH connections from multiple IP address ranges, define Allow rules for TCP port
22, with the destination This Gateway. For information, see Using Rules on page
360.
To configure SSH
1.
Click Setup in the main menu, and click the Management tab.
The Management page appears.
2.
Specify from where SSH access should be granted.
Refer to the following table.
Warning: If remote SSH is enabled, your Safe@Office appliance settings can be
changed remotely, so it is especially important to make sure all Safe@Office
appliance users’ passwords are difficult to guess.
Chapter 22: Controlling the Appliance via the Command Line
679
Configuring SSH
If you selected Internal Networks + IP Range, additional fields appear.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
Click Apply.
The SSH configuration is saved. If you configured remote SSH access, you can now
control the Safe@Office appliance from the Internet, using an SSHv2 client.
For information on all supported commands, refer to the Embedded NGX CLI
Reference Guide.
680
Check Point Safe@Office User Guide
Configuring SSH
Table 137: SSH Access Options
Select this
To allow access from…
option…
Internal Networks
The internal network only.
This disables remote access capability. This is the default.
Internal Networks +
The internal network and your VPN.
VPN
Internal Networks +
A particular range of IP addresses.
IP Range
Additional fields appear, in which you can enter the desired IP address
range.
ANY
Any IP address.
Disabled
Nowhere.
This disables both local and remote access capability.
This option is relevant to the SNMP protocol only.
Chapter 22: Controlling the Appliance via the Command Line
681
Viewing Firmware Status
Chapter 23
Maintenance
This chapter describes the tasks required for maintenance and diagnosis of your
Safe@Office appliance.
This chapter includes the following topics:
Viewing Firmware Status .........................................................................683
Upgrading Your Software Product ...........................................................685
Configuring a Gateway Hostname ...........................................................687
Configuring Syslog Logging ....................................................................689
Configuring HTTPS .................................................................................691
Configuring SNMP...................................................................................694
Setting the Time on the Appliance ...........................................................699
Using Diagnostic Tools ............................................................................702
Backing Up and Restoring the Safe@Office Appliance Configuration ...717
Using Rapid Deployment .........................................................................725
Resetting the Safe@Office Appliance to Defaults ...................................728
Running Diagnostics ................................................................................731
Rebooting the Safe@Office Appliance ....................................................732
Viewing Firmware Status
The firmware is the software program embedded in the Safe@Office appliance.
You can view your current firmware version and additional details.
To view the firmware status
•
Click Setup in the main menu, and click the Firmware tab.
Chapter 23: Maintenance
683
Viewing Firmware Status
The Firmware page appears.
The Firmware page displays the following information:
Table 138: Firmware Status Fields
This field…
Displays…
For example…
WAN MAC Address
The MAC address used for
00:80:11:22:33:44
the Internet connection
Firmware Version
The current version of the
7.5
firmware
Installed Product
The licensed software and
Safe@Office 500 (unlimited nodes)
the number of allowed
nodes
684
Check Point Safe@Office User Guide
Upgrading Your Software Product
This field…
Displays…
For example…
Uptime
The time that elapsed from
01:21:15
the moment the unit was
turned on
Hardware Type
The type of the current
SBox-200
Safe@Office appliance
hardware
Hardware Version
The current hardware
1.0
version of the Safe@Office
appliance
Upgrading Your Software Product
You can upgrade your Safe@Office 500 appliance by adding the Safe@Office 500 Power
Pack. After purchasing the Power Pack, you will receive a new Product Key that enables
you to use the Power Pack on the same Safe@Office appliance you have today. There is no
need to replace your hardware. You can also purchase node upgrades, as needed.
Note: To purchase the Power Pack or node upgrades, contact your Safe@Office
appliance provider. Alternatively, you can click Upgrades & Services in the Welcome
page to view and purchase available upgrades.
To upgrade your product, you must install the new Product Key.
To install a Product Key
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
Click Upgrade Product.
Chapter 23: Maintenance
685
Upgrading Your Software Product
The Safe@Office Licensing Wizard opens, with the Install Product Key dialog box
displayed.
3.
Click Enter a different Product Key.
4.
In the Product Key field, enter the new Product Key.
5.
Click Next.
The Installed New Product Key dialog box appears.
686
Check Point Safe@Office User Guide
Configuring a Gateway Hostname
6.
Click Finish.
Configuring a Gateway Hostname
You can define a gateway hostname for the Safe@Office appliance. The gateway
hostname is used to identify the Safe@Office appliance and appears in the following
places:
•
The Safe@Office Portal’s title bar
•
The Safe@Office appliance's SNMP hostname
•
Syslog messages sent by the Safe@Office appliance
•
The command line prompt
By default, the Safe@Office appliance's MAC address is used as the gateway hostname.
Note: Configuring the gateway hostname is only available if the Safe@Office is not
subscribed to the Remote Management service. When remotely managed, the
gateway hostname is set by the Service Center.
To configure the gateway hostname
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
In the Gateway Name row, click Edit.
Chapter 23: Maintenance
687
Configuring a Gateway Hostname
The Gateway Name page appears.
3.
In the Gateway Name field, type the desired hostname.
4.
To reset the gateway hostname to the default value (the appliance's MAC
address), click Default.
5.
Click Apply.
688
Check Point Safe@Office User Guide
Configuring Syslog Logging
Configuring Syslog Logging
You can configure the Safe@Office appliance to send event logs to a Syslog server
residing in your internal network or on the Internet. The logs detail the date and the time
each event occurred. If the event is a communication attempt that was rejected by the
firewall, the event details include the source and destination IP address, the destination
port, and the protocol used for the communication attempt (for example, TCP or UDP).
This same information is also available in the Event Log page (see Viewing the Event Log
on page 339). However, while the Event Log can display hundreds of logs, a Syslog server
can store an unlimited number of logs. Furthermore, Syslog servers can provide useful
tools for managing your logs.
Note: Kiwi Syslog Daemon is freeware and can be downloaded from
http://www.kiwisyslog.com. For technical support, contact Kiwi Enterprises.
To configure Syslog logging
1.
Click Setup in the main menu, and click the Logging tab.
Chapter 23: Maintenance
689
Configuring Syslog Logging
The Logging page appears.
2.
Complete the fields using the information in the following table.
3.
Click Apply.
Table 139: Logging Page Fields
In this field…
Do this…
Syslog Server
Type the IP address of the computer that will run the Syslog service
(one of your network computers), or click This Computer to allow your
computer to host the service.
Clear
Click to clear the Syslog Server field.
Syslog Port
Type the port number of the Syslog server.
Default
Click to reset the Syslog Port field to the default (port 514 UDP).
690
Check Point Safe@Office User Guide
Configuring HTTPS
Configuring HTTPS
You can enable Safe@Office appliance users to access the Safe@Office Portal from the
Internet. To do so, you must first configure HTTPS.
Note: Configuring HTTPS is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for HTTPS, such as
allowing HTTPS connections from multiple IP address ranges, define Allow rules for
TCP port 443, with the destination This Gateway. For information, see Using Rules
on page 360.
To configure HTTPS
1.
Click Setup in the main menu, and click the Management tab.
The Management page appears.
Chapter 23: Maintenance
691
Configuring HTTPS
2.
Specify from where HTTPS access to the Safe@Office Portal should be
granted.
See Access Options on page 693 for information.
Warning: If remote HTTPS is enabled, your Safe@Office appliance settings can be
changed remotely, so it is especially important to make sure all Safe@Office
appliance users’ passwords are difficult to guess.
Note: You can use HTTPS to access the Safe@Office Portal from your internal
network, by surfing to https://my.firewall.
If you selected Internal Networks + IP Range, additional fields appear.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
Click Apply.
The HTTPS configuration is saved. If you configured remote HTTPS, you can now
access the Safe@Office Portal through the Internet, using the procedure Accessing the
Safe@Office Portal Remotely on page 77.
692
Check Point Safe@Office User Guide
Configuring HTTPS
Table 140: Access Options
Select this
To allow access from…
Internal Networks
The internal network only.
option…
This disables remote access capability. This is the default.
Internal Networks +
The internal network and your VPN.
VPN
Internal Networks +
A particular range of IP addresses.
IP Range
Additional fields appear, in which you can enter the desired IP address
range.
ANY
Any IP address.
Disabled
Nowhere.
This disables both local and remote access capability.
This option is relevant to the SNMP protocol only.
Chapter 23: Maintenance
693
Configuring SNMP
Configuring SNMP
The Safe@Office appliance users can monitor the Safe@Office appliance, using tools that
support SNMP (Simple Network Management Protocol). You can enable users to do so via
the Internet, by configuring remote SNMP access.
The Safe@Office appliance supports the following SNMP MIBs:
•
SNMPv2-MIB
•
RFC1213-MIB
•
IF-MIB
•
IP-MIB
All SNMP access is read-only.
Note: Configuring SNMP is equivalent to creating a simple Allow rule, where the
destination is This Gateway. To create more complex rules for SNMP, such as
allowing SNMP connections from multiple IP address ranges, define Allow rules for
the relevant port (by default, TCP port 161), with the destination This Gateway. For
information, see Using Rules on page 360.
To configure SNMP
1.
Click Setup in the main menu, and click the Management tab.
The Management page appears.
2.
Specify from where SNMP access should be granted.
See Access Options on page 693 for information.
If you selected Internal Networks + IP Range, additional fields appear.
694
Check Point Safe@Office User Guide
Configuring SNMP
The Community field and the Advanced link are enabled.
3.
If you selected Internal Networks + IP Range, enter the desired IP address range
in the fields provided.
4.
In the Community field, type the name of the SNMP community string.
SNMP clients uses the SNMP community string as a password, when connecting to
the Safe@Office appliance.
The default value is "public". It is recommended to change this string.
5.
To configure advanced SNMP settings, do the following:
a.
Click Advanced.
Chapter 23: Maintenance
695
Configuring SNMP
The SNMP Configuration page appears.
b.
696
Complete the fields using the following table.
Check Point Safe@Office User Guide
Configuring SNMP
If you selected the Send SNMP Traps check box, additional fields appear.
6.
Click Apply.
The SNMP configuration is saved.
7.
Configure the SNMP clients with the SNMP community string.
Table 141: Advanced SNMP Settings
In this field...
Do this…
System Location
Type a description of the appliance's location.
This information will be visible to SNMP clients, and is useful for
administrative purposes.
System Contact
Type the name of the contact person.
This information will be visible to SNMP clients, and is useful for
administrative purposes.
Chapter 23: Maintenance
697
Configuring SNMP
In this field...
Do this…
SNMP Port
Type the port to use for SNMP.
The default port is 161.
Send SNMP Traps
Select this option to enable sending SNMP traps. An SNMP trap is a
notification sent from one application to another.
Send Traps On:
Indicates that SNMP traps will automatically be sent upon
Startup / Shutdown
startup/shutdown events.
This option is always selected.
Send Traps On:
Select this option to to send an SNMP trap on each SNMP
SNMP Authentication
authentication failure event.
Failure
Send Traps On: Link
Select this option to send an SNMP trap on each link up/down event.
up/down
Trap Community
Type the SNMP community string of the trap receiver.
The default value is public.
Trap Port
Type The UDP port of the trap receiver.
The default value is 162.
Trap Destination
Type the IP address or DNS name of the SNMP trap receiver agent.
Trap Type
Select the type of SNMP traps to use.
698
Check Point Safe@Office User Guide
Setting the Time on the Appliance
Setting the Time on the Appliance
You set the time displayed in the Safe@Office Portal during initial appliance setup. If
desired, you can change the date and time using the procedure below.
To set the time
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Set Time.
The Safe@Office Set Time Wizard opens displaying the Set the Safe@Office Time dialog
box.
3.
Complete the fields using the information in Set Time Wizard Fields on page
701.
4.
Click Next.
The following things happen in the order below:
Chapter 23: Maintenance
699
Setting the Time on the Appliance
•
If you selected Specify date and time, the Specify Date and Time dialog box
appears.
Set the date, time, and time zone in the fields provided, then click Next.
•
If you selected Use a Time Server, the Time Servers dialog box appears.
Complete the fields using the information in Time Servers Fields on page 702,
then click Next.
700
Check Point Safe@Office User Guide
Setting the Time on the Appliance
•
5.
The Date and Time Updated screen appears.
Click Finish.
Table 142: Set Time Wizard Fields
Select this option…
To do the following…
Your computer's clock
Set the appliance time to your computer’s system time.
Your computer’s system time is displayed to the right of this
option.
Keep the current setting
Do not change the appliance’s time.
The current appliance time is displayed to the right of this option.
Use a Time Server
Synchronize the appliance time with a Network Time Protocol
(NTP) server.
Specify date and time
Chapter 23: Maintenance
Set the appliance to a specific date and time.
701
Using Diagnostic Tools
Table 143: Time Servers Fields
In this field…
Do this…
Primary Server
Type the IP address of the Primary NTP server.
Secondary Server
Type the IP address of the Secondary NTP server.
This field is optional.
Clear
Clear the field.
Select your time zone
Select the time zone in which you are located.
Using Diagnostic Tools
The Safe@Office appliance is equipped with a set of diagnostic tools that are useful for
troubleshooting Internet connectivity.
Table 144: Diagnostic Tools
Use this
To do this…
For information, see...
Ping
Check that a specific IP address or DNS
Using IP Tools on page 703
tool…
name can be reached via the Internet.
Traceroute
Display a list of all routers used to
Using IP Tools on page 703
connect from the Safe@Office appliance
to a specific IP address or DNS name.
702
Check Point Safe@Office User Guide
Using Diagnostic Tools
Use this
To do this…
For information, see...
WHOIS
Display the name and contact information
Using IP Tools on page 703
tool…
of the entity to which a specific IP address
or DNS name is registered. This
information is useful in tracking down
hackers.
Packet Sniffer
Capture network traffic. This information is
Using Packet Sniffer on page
useful troubleshooting network problems.
706
Using IP Tools
To use an IP tool
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
In the Tool drop-down list, select the desired tool.
3.
In the Address field, type the IP address or DNS name for which to run the
tool.
4.
Click Go.
•
If you selected Ping, the following things happen:
The Safe@Office appliance sends packets to the specified the IP address or DNS
name.
Chapter 23: Maintenance
703
Using Diagnostic Tools
The IP Tools window opens and displays the percentage of packet loss and the
amount of time it took each packet to reach the specified host and return (roundtrip) in milliseconds.
•
If you selected Traceroute, the following things happen:
The Safe@Office appliance connects to the specified IP address or DNS name.
The IP Tools window opens and displays a list of routers used to make the
connection.
704
Check Point Safe@Office User Guide
Using Diagnostic Tools
•
If you selected WHOIS, the following things happen:
The Safe@Office appliance queries the Internet WHOIS server.
A window displays the name of the entity to which the IP address or DNS name is
registered and their contact information.
Chapter 23: Maintenance
705
Using Diagnostic Tools
Using Packet Sniffer
The Safe@Office appliance includes the Packet Sniffer tool, which enables you to capture
packets from any internal network or Safe@Office port. This is useful for troubleshooting
network problems and for collecting data about network behavior.
If desired, you can configure Packet Sniffer to capture each packet twice: once before
firewall processing and once after firewall processing. This allows you to observe exactly
what the Safe@Office firewall does to your packets.
The Safe@Office appliance saves the captured packets to a file on your computer. You can
use a free protocol analyzer, such as Ethereal or Wireshark, to analyze the file, or you can
send it to technical support. Wireshark runs on all popular computing platforms and can be
downloaded from http://www.wireshark.org. Ethereal can be downloaded from
http://www.ethereal.com.
Note: If you enabled the Packet Sniffer's Firewall Monitor option, and you would like to
view the results in Ethereal/Wireshark, you must do the following: open the capture
file, click Edit > Preferences, in the left pane click Protocols > Ethernet, and select the
Attempt to interpret as Firewall-1 monitor file check box. The capture file will display the
interface name on which the packet was captured, and the packet’s processing
direction will be indicated by i (input) or o (output).
To use Packet Sniffer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
706
Click Sniffer.
Check Point Safe@Office User Guide
Using Diagnostic Tools
The Packet Sniffer window opens.
3.
Complete the fields using the information in the following table.
4.
Click Start.
The Packet Sniffer window displays the name of the interface, the number of packets
collected, and the percentage of storage space remaining on the appliance for storing
the packets.
5.
Click Stop to stop collecting packets.
A standard File Download dialog box appears.
6.
Click Save.
The Save As dialog box appears.
7.
Browse to a destination directory of your choice.
8.
Type a name for the configuration file and click Save.
The *.cap file is created and saved to the specified directory.
9.
Click Cancel to close the Packet Sniffer window.
Chapter 23: Maintenance
707
Using Diagnostic Tools
Table 145: Packet Sniffer Fields
In this field…
Do this…
Interface
Select the interface from which to collect packets.
The list includes the primary Internet connection, the Safe@Office
appliance ports, and all defined networks.
Filter String
Type the filter string to use for filtering the captured packets. Only
packets that match the filter condition will be saved.
For a list of basic filter strings elements, see Filter String Syntax on
page 709.
For detailed information on filter syntax, go to
http://www.tcpdump.org/tcpdump_man.html.
Note: Do not enclose the filter string in quotation marks.
If you do not specify a filter string, Packet Sniffer will save all packets on
the selected interface.
Capture only traffic
Select this option to capture incoming and outgoing packets for this
to/from this gateway
gateway only.
If this option is not selected, Packet Sniffer will collect packets for all
traffic on the interface.
Firewall Monitor
Select this option to capture each packet both before and after firewall
processing, and to record the name of the interface on which the packet
was captured.
708
Check Point Safe@Office User Guide
Using Diagnostic Tools
Filter String Syntax
The following represents a list of basic filter string elements:
•
and on page 709
•
dst on page 710
•
dst port on page 710
•
ether proto on page 711
•
host on page 712
•
not on page 712
•
or on page 713
•
port on page 713
•
src on page 714
•
src port on page 714
•
tcp on page 715
•
udp on page 716
For detailed information on filter syntax, refer to http://www.tcpdump.org.
and
PURPOSE
The and element is used to concatenate filter string elements. The filtered packets must
match all concatenated filter string elements.
SYNTAX
element and element [and element...]
element && element [&& element...]
PARAMETERS
element
Chapter 23: Maintenance
String. A filter string element.
709
Using Diagnostic Tools
EXAMPLE
The following filter string saves packets that both originate from IP address is
192.168.10.1 and are destined for port 80:
src 192.168.10.1 and dst port 80
dst
PURPOSE
The dst element captures all packets with a specific destination.
SYNTAX
dst destination
PARAMETERS
destination
IP Address or String. The computer to which the packet is
sent. This can be the following:
•
An IP address
•
A host name
EXAMPLE
The following filter string saves packets that are destined for the IP address 192.168.10.1:
dst 192.168.10.1
dst port
PURPOSE
The dst port element captures all packets destined for a specific port.
SYNTAX
dst port port
Note: This element can be prepended by tcp or udp. For information, see tcp on
page 715 and udp on page 716.
710
Check Point Safe@Office User Guide
Using Diagnostic Tools
PARAMETERS
port
Integer. The port to which the packet is sent.
EXAMPLE
The following filter string saves packets that are destined for port 80:
dst port 80
ether proto
PURPOSE
The ether proto element is used to capture packets of a specific ether protocol type.
SYNTAX
ether proto \protocol
PARAMETERS
protocol
String. The protocol type of the packet.
This can be the following: ip,
ip6, arp, rarp,
atalk, aarp, dec net, sca, lat,
mopdl, moprc, iso, stp, ipx, or
netbeui.
EXAMPLE
The following filter string saves ARP packets:
ether proto arp
Chapter 23: Maintenance
711
Using Diagnostic Tools
host
PURPOSE
The host element captures all incoming and outgoing packets for a specific computer.
SYNTAX
host host
PARAMETERS
host
IP Address or String. The computer to/from which the packet
is sent. This can be the following:
•
An IP address
•
A host name
EXAMPLE
The following filter string saves all packets that either originated from IP address
192.168.10.1, or are destined for that same IP address:
host 192.168.10.1
not
PURPOSE
The not element is used to negate filter string elements.
SYNTAX
not element
! element
PARAMETERS
element
String. A filter string element.
EXAMPLE
The following filter string saves packets that are not destined for port 80:
not dst port 80
712
Check Point Safe@Office User Guide
Using Diagnostic Tools
or
PURPOSE
The or element is used to alternate between string elements. The filtered packets must
match at least one of the filter string elements.
SYNTAX
element or element [or element...]
element || element [|| element...]
PARAMETERS
element
String. A filter string element.
EXAMPLE
The following filter string saves packets that either originate from IP address 192.168.10.1
or IP address 192.168.10.10:
src 192.168.10.1 or src 192.168.10.10
port
PURPOSE
The port element captures all packets originating from or destined for a specific port.
SYNTAX
port port
Note: This element can be prepended by tcp or udp. For information, see tcp on
page 715 and udp on page 716.
PARAMETERS
port
Chapter 23: Maintenance
Integer. The port from/to which the packet is sent.
713
Using Diagnostic Tools
EXAMPLE
The following filter string saves all packets that either originated from port 80, or are
destined for port 80:
port 80
src
PURPOSE
The src element captures all packets with a specific source.
SYNTAX
src source
PARAMETERS
source
IP Address or String. The computer from which the packet is
sent. This can be the following:
•
An IP address
•
A host name
EXAMPLE
The following filter string saves packets that originated from IP address 192.168.10.1:
src 192.168.10.1
src port
PURPOSE
The src port element captures all packets originating from a specific port.
SYNTAX
src port port
Note: This element can be prepended by tcp or udp. For information, see tcp on
page 715 and udp on page 716.
714
Check Point Safe@Office User Guide
Using Diagnostic Tools
PARAMETERS
port
Integer. The port from which the packet is sent.
EXAMPLE
The following filter string saves packets that originated from port 80:
src port 80
tcp
PURPOSE
The tcp element captures all TCP packets. This element can be prepended to port-related
elements.
Note: When not prepended to other elements, the tcp element is the equivalent of
ip proto tcp.
SYNTAX
tcp
tcp element
PARAMETERS
element
String. A port-related filter string element that should be
restricted to saving only TCP packets. This can be the
following:
Chapter 23: Maintenance
•
dst port - Capture all TCP packets destined
for a specific port.
•
port - Capture all TCP packets originating from
or destined for a specific port.
•
src port - Capture all TCP packets originating
from a specific port.
715
Using Diagnostic Tools
EXAMPLE 1
The following filter string captures all TCP packets:
tcp
EXAMPLE 2
The following filter string captures all TCP packets destined for port 80:
tcp dst port 80
udp
PURPOSE
The udp element captures all UDP packets. This element can be prepended to port-related
elements.
Note: When not prepended to other elements, the udp element is the equivalent of
ip proto udp.
SYNTAX
udp
udp element
PARAMETERS
element
String. A port-related filter string element that should be
restricted to saving only UDP packets. This can be the
following:
716
•
dst port - Capture all UDP packets destined
for a specific port.
•
port - Captures all UDP packets originating
from or destined for a specific port.
•
src port - Capture all UDP packets
originating from a specific port.
Check Point Safe@Office User Guide
Backing Up and Restoring the Safe@Office Appliance Configuration
EXAMPLE 1
The following filter string captures all UDP packets:
udp
EXAMPLE 2
The following filter string captures all UDP packets destined for port 80:
udp dst port 80
Backing Up and Restoring the Safe@Office
Appliance Configuration
The Safe@Office appliance provides the following ways of backing up and restoring its
configuration:
•
Backup and restore on your computer
You can export the Safe@Office appliance configuration to a *.cfg file on your
computer, and use this file to backup and restore Safe@Office appliance settings, as
needed.
The file includes all of your settings, except for the security policy and certificate.
•
Backup and restore on a USB flash drive
You can back up the appliance configuration and device certificate to a USB flash
drive. You can then restore the Safe@Office appliance settings from the USB flash
drive as needed.
This method requires a USB port on your appliance.
Note: If both cases, the configuration file is saved as a textual CLI script. If desired,
you can edit the file. For a full explanation of the CLI script format and the
supported CLI commands, see the Embedded NGX CLI Reference Guide.
Chapter 23: Maintenance
717
Backing Up and Restoring the Safe@Office Appliance Configuration
Backing Up the Appliance Configuration
Exporting the Appliance Configuration to Your Computer
To export the Safe@Office appliance configuration to your computer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Export.
A standard File Download dialog box appears.
3.
Click Save.
The Save As dialog box appears.
4.
Browse to a destination directory of your choice.
5.
Type a name for the configuration file and click Save.
The *.cfg configuration file is created and saved to the specified directory.
You can now import the configuration file as needed. See Importing the Appliance
Configuration from Your Computer on page 721.
718
Check Point Safe@Office User Guide
Backing Up and Restoring the Safe@Office Appliance Configuration
Backing Up the Appliance Configuration to a USB Flash Drive
The USB flash drive must have at least 64MB of free space.
Note: Some USB flash drives may not be supported by the appliance.
To backup the appliance configuration to a USB flash drive
1.
Connect a USB flash drive to one of your Safe@Office appliance's USB ports.
For information on locating the USB ports, see Introduction on page 1.
2.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
3.
Click Backup/Restore.
The Backup/Restore Wizard opens displaying the Step 1: Select Action dialog box.
4.
Click Backup this gateway to a storage device.
5.
Click Next.
Chapter 23: Maintenance
719
Backing Up and Restoring the Safe@Office Appliance Configuration
The Safe@Office appliance creates the folder  on the USB flash
drive, where  is the appliance's MAC address, and writes the
following files to this folder:
•
embeddedngx.cfg
• embeddedngx.p12
The Step 2: Backup Complete screen appears.
6.
Click Finish.
You can now restore the configuration from the USB flash drive as needed. See
Restoring the Appliance Configuration from a USB Flash Drive on page 723.
720
Check Point Safe@Office User Guide
Backing Up and Restoring the Safe@Office Appliance Configuration
Restoring the Appliance Configuration
Importing the Appliance Configuration from Your Computer
To import the appliance configuration from your computer
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Import.
The Import Settings page appears.
3.
Do one of the following:
• In the Import Settings field, type the full path to the configuration file.
Or
Chapter 23: Maintenance
721
Backing Up and Restoring the Safe@Office Appliance Configuration
4.
• Click Browse, and browse to the configuration file.
Click Upload.
A confirmation message appears.
5.
Click OK.
The Safe@Office appliance settings are imported.
The Import Settings page displays the configuration file's content and the result of
implementing each configuration command.
Note: If the appliance's IP address changed as a result of the configuration import,
your computer may be disconnected from the network; therefore you may not be
able to see the results.
722
Check Point Safe@Office User Guide
Backing Up and Restoring the Safe@Office Appliance Configuration
Restoring the Appliance Configuration from a USB Flash Drive
To restore the appliance configuration from a USB flash drive
1.
Connect a USB flash drive to one of your Safe@Office appliance's USB ports.
For information on locating the USB ports, see Introduction on page 1.
2.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
3.
Click Backup/Restore.
The Backup/Restore Wizard opens displaying the Step 1: Select Action dialog box.
4.
Click Restore this gateway from a storage device.
5.
Click Next.
The Safe@Office appliance is restored from the  folder on the USB
flash drive, where  is the appliance's MAC address. This may take
some time.
Chapter 23: Maintenance
723
Backing Up and Restoring the Safe@Office Appliance Configuration
The Step 2: Restore Complete screen appears displaying the configuration file's content
and the result of implementing each configuration command.
Note: If the appliance's IP address changed as a result of the configuration import,
your computer may be disconnected from the network; therefore you may not be
able to see the results.
6.
724
Click Finish.
Check Point Safe@Office User Guide
Using Rapid Deployment
Using Rapid Deployment
Safe@Office appliances are shipped with a specific firmware and group of settings that
represent the appliance's default state. When installing a new appliance, you can configure
different settings and install new firmware versions as needed; however, this can be timeconsuming. Rapid deployment avoids this hassle, by allowing you to load the following
settings from a USB flash drive during product initialization:
•
The primary firmware
•
The backup firmware
•
The configuration file
•
The default configuration file
The default configuration file contains settings that represent the desired appliance
default state. The settings in the default configuration file become the appliance's new
default settings and are retained even after a reset to defaults operation.
Important: The default configuration file cannot be cleared by performing a Reset to
Defaults operation. It can only be cleared by loading an empty default configuration
file.
•
The certificate
Rapid deployment can be used to configure several appliances in succession. If multiple
appliances share a group of settings, you can use rapid deployment to configure each
appliance with both the shared settings and the appliance-specific settings, all in one
action. For example, before shipping appliances to your company’s branch offices, you can
quickly configure all of the appliances with the corporate security policy and VPN settings,
as well as with branch-specific settings.
Chapter 23: Maintenance
725
Using Rapid Deployment
Preparing the USB Flash Drive for Rapid Deployment
Before performing a rapid deployment, you must load the USB flash drive with the files
you want to install on the appliance(s).
To prepare the USB flash drive
1.
For each appliance you want to deploy, create a folder named
, where  is the appliance’s MAC address,
and the colons are replaced by underscores.
For example, if the appliance's MAC address is 00:11:22:33:44:55, the folder name
should be 00_11_22_33_44_55.
2.
If you would like to deploy multiple appliances that share settings, create a
folder named deploy.
3.
Prepare the files that you want to install on the appliances.
The files must be named according to the following table.
4.
Add files containing settings that should be shared by all of the appliances to
the deploy folder.
5.
For each appliance, add files containing settings that are specific to the
appliance to the folder named after the appliance's MAC address.
For example, if you want two Safe@Office appliances to share the same primary firmware
but to have different configuration files, you must prepare a single primary.firm file
and add it to the deploy folder. Then you must prepare two different
embeddedngx.cfg configuration files, and add one to each appliance's folder.
Table 146: Rapid Deployment File Names
This file...
Should be named...
The primary firmware
primary.firm / primary.img
The backup firmware
secondary.firm / secondary.img
726
Check Point Safe@Office User Guide
Using Rapid Deployment
This file...
Should be named...
The configuration file
embeddedngx.cfg
The default configuration file
preset.cfg
The certificate
embeddedngx.p12
Performing a Rapid Deployment
You must perform the following procedure on each Safe@Office appliance you want to
deploy.
To perform a rapid deployment
1.
Reset the Safe@Office appliance to its default settings.
See Resetting the Safe@Office Appliance to Defaults on page 728.
2.
While the appliance is powering up, insert the USB flash drive into the
appliance’s USB port.
For information on locating the USB ports, see Introduction on page 1.
The following things happen:
•
The PWR/SEC LED flashes quickly in green, signaling that rapid deployment
is in progress.
•
The file results-.log is created in the USB flash
drive's root folder, where  is the appliance's MAC address.
•
If the deploy folder exists, the appliance loads shared settings from it. The
appliance then loads its private settings from the folder named after its MAC
address.
Note: If the appliance loads an updated firmware file, the appliance restarts
and then continues the rapid deployment process. Do not disconnect the USB
flash drive until the process is complete.
Chapter 23: Maintenance
727
Resetting the Safe@Office Appliance to Defaults
•
3.
If an error occurs during the rapid deployment process, the PWR/SEC LED
blinks quickly in red, the errors are logged to the Event Log, and rapid
deployment continues.
• When rapid deployment is complete, the PWR/SEC LED is a constant green.
To check the results of rapid deployment, in the USB flash drive's root folder,
open the file results-.log.
Settings that loaded successfully are marked as "ok", and settings that failed to load
are marked as "failed".
Resetting the Safe@Office Appliance to Defaults
You can reset the Safe@Office appliance to its default settings. When you reset your
Safe@Office appliance, it reverts to the state it was originally in when you purchased it.
Warning: This operation erases all your settings and password information. You will
have to set a new password and reconfigure your Safe@Office appliance for Internet
connection. For information on performing these tasks, see Setting Up the
Safe@Office Appliance on page 67.
This operation also resets your appliance to its default Product Key. Therefore, if you
upgraded your license, you should save your Product Key before resetting to defaults.
You can view the installed Product Key by in the Safe@Office Licensing Wizard. For
information on accessing this wizard, see Upgrading Your License on page 685.
You can reset the Safe@Office appliance to defaults via the Web management interface
(software) or by manually pressing the Reset button (hardware) located at the back of the
Safe@Office appliance.
When resetting the appliance via the Safe@Office Portal, you can choose to keep the
current firmware or to revert to the firmware version that shipped with the Safe@Office
appliance. In contrast, using the Reset button automatically reverts the firmware version.
728
Check Point Safe@Office User Guide
Resetting the Safe@Office Appliance to Defaults
To reset the Safe@Office appliance to factory defaults via the Web interface
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Factory Settings.
A confirmation message appears.
3.
To revert to the firmware version that shipped with the appliance, select the
check box.
4.
Click OK.
•
The Please Wait screen appears.
•
The Safe@Office appliance returns to its factory defaults.
Chapter 23: Maintenance
729
Resetting the Safe@Office Appliance to Defaults
•
The Safe@Office appliance is restarted.
This may take a few minutes.
•
The Login page appears.
To reset the Safe@Office appliance to factory defaults using the Reset button
1.
Make sure the Safe@Office appliance is powered on.
2.
Using a pointed object, press the RESET button on the back of the
Safe@Office appliance steadily for seven seconds and then release it.
3.
Allow the Safe@Office appliance to boot-up until the system is ready.
For information on the appliance's front and rear panels, see the Getting to Know Your
Appliance section in Introduction on page 1.
Warning: If you choose to reset the Safe@Office appliance by disconnecting the power
cable and then reconnecting it, be sure to leave the Safe@Office appliance
disconnected for at least three seconds. Disconnecting and reconnecting the power
without waiting might cause permanent damage.
730
Check Point Safe@Office User Guide
Running Diagnostics
Running Diagnostics
You can view technical information about your Safe@Office appliance’s hardware,
firmware, license, network status, and Service Center.
This information is useful for troubleshooting. You can export it to an *.html file and send
it to technical support.
To view diagnostic information
1.
Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
2.
Click Diagnostics.
Technical information about your Safe@Office appliance appears in a new window.
3.
To save the displayed information to an *.html file:
a.
Click Save.
A standard File Download dialog box appears.
b.
Click Save.
The Save As dialog box appears.
4.
c.
Browse to a destination directory of your choice.
d.
Type a name for the configuration file and click Save.
The *.html file is created and saved to the specified directory.
To refresh the contents of the window, click Refresh.
The contents are refreshed.
5.
To close the window, click Close.
Chapter 23: Maintenance
731
Rebooting the Safe@Office Appliance
Rebooting the Safe@Office Appliance
If your Safe@Office appliance is not functioning properly, rebooting it may solve the
problem.
To reboot the Safe@Office appliance
1.
Click Setup in the main menu, and click the Firmware tab.
The Firmware page appears.
2.
Click Restart.
A confirmation message appears.
3.
Click OK.
•
The Please Wait screen appears.
•
The Safe@Office appliance is restarted.
This may take a few minutes.
•
732
The Login page appears.
Check Point Safe@Office User Guide
Overview
Chapter 24
Using Network Printers
This chapter describes how to set up and use network printers.
This chapter includes the following topics:
Overview ..................................................................................................733
Setting Up Network Printers.....................................................................734
Configuring Computers to Use Network Printers.....................................737
Viewing Network Printers ........................................................................754
Changing Network Printer Ports...............................................................755
Resetting Network Printers.......................................................................756
Overview
Some Safe@Office models include a built-in print server, enabling you to connect USBbased printers to the appliance and share them across the network.
Note: When using computers with a Windows 2000/XP/Vista operating system, the
Safe@Office appliance supports connecting up to four USB-based printers to the
appliance. When using computers with a MAC OS-X operating system, the
Safe@Office appliance supports connecting one printer.
The appliance automatically detects printers as they are plugged in, and they immediately
become available for printing. Usually, no special configuration is required on the
Safe@Office appliance.
Note: The Safe@Office print server supports printing via "all-in-one" printers.
Copying and scanning functions are not supported.
Chapter 24: Using Network Printers
733
Setting Up Network Printers
Setting Up Network Printers
To set up a network printer
1.
Connect the network printer to the Safe@Office appliance.
See Connecting the Appliance to Network Printers on page 63.
2.
Turn the printer on.
3.
In the Safe@Office Portal, click Network in the main menu, and click the Ports
tab.
The Ports page appears.
4.
734
Next to USB, click Edit.
Check Point Safe@Office User Guide
Setting Up Network Printers
The USB Devices page appears. If the Safe@Office appliance detected the printer, the
printer is listed on the page.
If the printer is not listed, check that you connected the printer correctly, then click
Refresh to refresh the page.
5.
Next to the printer, click Edit.
Chapter 24: Using Network Printers
735
Setting Up Network Printers
The Printer Setup page appears.
6.
Write down the port number allocated to the printer.
The port number appears in the Printer Server TCP Port field. You will need this
number later, when configuring computers to use the network printer.
7.
To change the port number, do the following:
a.
Type the desired port number in the Printer Server TCP Port field.
Note: Printer port numbers may not overlap, and must be high ports.
b. Click Apply.
You may want to change the port number if, for example, the printer you are setting
up is intended to replace another printer. In this case, you should change the
replacement printer's port number to the old printer's port number, and you can skip
the next step.
8.
736
Configure each computer from which you want to enable printing to the
network printer.
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
See Configuring Computers to Use Network Printers on page 737.
Configuring Computers to Use Network Printers
Perform the relevant procedure on each computer from which you want to enable printing
via the Safe@Office print server to a network printer.
Windows Vista
This procedure is relevant for computers with a Windows Vista operating system.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 364.
2.
Click Start > Control Panel.
Chapter 24: Using Network Printers
737
Configuring Computers to Use Network Printers
The Control Panel window opens.
3.
738
Under Hardware and Sound, click Printer.
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
The Printers screen appears.
4.
Click Add a printer.
The Add Printer wizard opens displaying the Choose a local or network printer screen.
5.
Click Add a local printer.
6.
Click Next.
Chapter 24: Using Network Printers
739
Configuring Computers to Use Network Printers
The Choose a printer port dialog box appears.
7.
Click Create a new port.
8.
In the Type of port drop-down list, select Standard TCP/IP Port.
9.
Click Next.
The Type a printer hostname or IP address dialog box appears.
10. In the Device type drop-down list, select Autodetect.
11. In the Hostname or IP address field, type the Safe@Office appliance's LAN IP
address, or "my.firewall".
You can find the LAN IP address in the Safe@Office Portal, under Network > My
Network.
740
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
12. In the Port name field, type the port name.
13. Select the Query the printer and automatically select the driver to use check
box.
14. Click Next.
The following things happen:
•
If Windows cannot identify your printer, the Additional Port Information
Required dialog box appears.
Do the following:
1) Click Custom.
2) Click Settings.
Chapter 24: Using Network Printers
741
Configuring Computers to Use Network Printers
The Configure Standard TCP/IP Port Monitor dialog box opens.
3) In the Protocol area, make sure that Raw is selected.
4) In the Port Number field, type the printer's port number, as shown in
the Printers page.
5) Click OK.
6) Click Next.
•
The Install the printer driver dialog box displayed.
15. Do one of the following:
•
742
Use the lists to select the printer's manufacturer and model.
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
•
If your printer does not appear in the lists, insert the CD that came with your
printer in the computer's CD-ROM drive, and click Have Disk.
16. Click Next.
17. Complete the remaining dialog boxes in the wizard as desired, and click
Finish.
The printer appears in the Printers and Faxes window.
18. Right-click the printer and click Properties in the popup menu.
The printer's Properties dialog box opens.
19. In the Ports tab, in the list box, select the port you added.
The port's name is IP_.
20. Click OK.
Chapter 24: Using Network Printers
743
Configuring Computers to Use Network Printers
Windows 2000/XP
This procedure is relevant for computers with a Windows 2000/XP operating system.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 364.
2.
Click Start > Settings > Control Panel.
The Control Panel window opens.
3.
Click Printers and Faxes.
The Printers and Faxes window opens.
4.
Right-click in the window, and click Add Printer in the popup menu.
The Add Printer Wizard opens with the Welcome dialog box displayed.
5.
744
Click Next.
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
The Local or Network Printer dialog box appears.
6.
Click Local printer attached to this computer.
Note: Do not select the Automatically detect and install my Plug and Play printer check
box.
7.
Click Next.
The Select a Printer Port dialog box appears.
8.
Click Create a new port.
9.
In the Type of port drop-down list, select Standard TCP/IP Port.
10. Click Next.
Chapter 24: Using Network Printers
745
Configuring Computers to Use Network Printers
The Add Standard TCP/IP Port Wizard opens with the Welcome dialog box displayed.
11. Click Next.
The Add Port dialog box appears.
12. In the Printer Name or IP Address field, type the Safe@Office appliance's LAN
IP address, or "my.firewall".
You can find the LAN IP address in the Safe@Office Portal, under Network > My
Network.
The Port Name field is filled in automatically.
13. Click Next.
746
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
The Add Standard TCP/IP Printer Port Wizard opens, with the Additional Port
Information Required dialog box displayed.
14. Click Custom.
15. Click Settings.
The Configure Standard TCP/IP Port Monitor dialog box opens.
16. In the Port Number field, type the printer's port number, as shown in the
Printers page.
17. In the Protocol area, make sure that Raw is selected.
18. Click OK.
The Add Standard TCP/IP Printer Port Wizard reappears.
Chapter 24: Using Network Printers
747
Configuring Computers to Use Network Printers
19. Click Next.
The Completing the Add Standard TCP/IP Printer Port Wizard dialog box appears.
20. Click Finish.
The Add Printer Wizard reappears, with the Install Printer Software dialog box
displayed.
21. Do one of the following:
•
Use the lists to select the printer's manufacturer and model.
•
If your printer does not appear in the lists, insert the CD that came with your
printer in the computer's CD-ROM drive, and click Have Disk.
22. Click Next.
748
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
23. Complete the remaining dialog boxes in the wizard as desired, and click
Finish.
The printer appears in the Printers and Faxes window.
24. Right-click the printer and click Properties in the popup menu.
The printer's Properties dialog box opens.
25. In the Ports tab, in the list box, select the port you added.
The port's name is IP_.
26. Click OK.
Chapter 24: Using Network Printers
749
Configuring Computers to Use Network Printers
MAC OS-X
This procedure is relevant for computers with the latest version of the MAC OS-X
operating system.
Note: This procedure may not apply to earlier MAC OS-X versions.
To configure a computer to use a network printer
1.
If the computer for which you want to enable printing is located on the WAN,
create an Allow rule for connections from the computer to This Gateway.
See Adding and Editing Rules on page 364.
2.
Choose Apple -> System Preferences.
The System Preferences window appears.
3.
Click Show All to display all categories.
4.
In the Hardware area, click Print & Fax.
750
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
The Print & Fax window appears.
5.
In the Printing tab, click Set Up Printers.
The Printer List window appears.
6.
Click Add.
Chapter 24: Using Network Printers
751
Configuring Computers to Use Network Printers
New fields appear.
7.
In the first drop-down list, select IP Printing.
8.
In the Printer Type drop-down list, select Socket/HP Jet Direct.
9.
In the Printer Address field, type the Safe@Office appliance's LAN IP address,
or "my.firewall".
You can find the LAN IP address in the Safe@Office Portal, under Network > My
Network.
10. In the Queue Name field, type the name of the required printer queue.
For example, the printer queue name for HP printers is RAW.
11. In the Printer Model list, select the desired printer type.
752
Check Point Safe@Office User Guide
Configuring Computers to Use Network Printers
A list of models appears.
12. In the Model Name list, select the desired model.
13. Click Add.
The new printer appears in the Printer List window.
14. In the Printer List window, select the newly added printer, and click Make
Default.
Chapter 24: Using Network Printers
753
Viewing Network Printers
Viewing Network Printers
To view network printers
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
For each printer, the model, serial number, and status is displayed.
A printer can have the following statuses:
•
Initialize. The printer is initializing.
•
Ready. The printer is ready.
•
Not Ready. The printer is not ready. For example, it may be out of paper.
•
Printing. The printer is processing a print job.
•
Restarting. The printer server is restarting.
•
3.
754
Fail. An error occurred. See the Event Log for details (Viewing the Event Log
on page 339).
To refresh the display, click Refresh.
Check Point Safe@Office User Guide
Changing Network Printer Ports
Changing Network Printer Ports
When you set up a new network printer, the Safe@Office appliance automatically assigns
a port number to the printer. If you want to use a different port number, you can easily
change it, as described in Setting Up Network Printers on page 734.
However, you may sometimes need to change the port number after completing printer
setup. For example, you may want to replace a malfunctioning network printer, with
another existing network printer, without reconfiguring the client computers. To do this,
you must change the replacement printer's port number to the malfunctioning printer's port
number, as described below.
Note: Each printer port number must be different, and must be a high port.
To change a printer's port
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
3.
Next to the desired printer, click Edit.
The Printer Setup page appears.
4.
In the printer's Printer Server TCP Port field, type the desired port number.
5.
Click Apply.
Chapter 24: Using Network Printers
755
Resetting Network Printers
Resetting Network Printers
You can cause a network printer to restart the current print job, by resetting the network
printer. You may want to do this if the print job has stalled.
To reset a network printer
1.
Click Network in the main menu, and click the Ports tab.
The Ports page appears.
2.
Next to USB, click Edit.
The USB Devices page appears, displaying a list of connected printers.
3.
Next to the desired printer, click Reset Server.
The network printer's current print job is restarted.
756
Check Point Safe@Office User Guide
Connectivity
Chapter 25
Troubleshooting
This chapter provides solutions to common problems you may encounter while using the
Safe@Office appliance.
Note: For information on troubleshooting wireless connectivity, see
Troubleshooting Wireless Connectivity on page 302.
This chapter includes the following topics:
Connectivity ............................................................................................ 757
Service Center and Upgrades................................................................... 761
Other Problems ........................................................................................ 762
Connectivity
I cannot access the Internet. What should I do?
• Verify that the Safe@Office appliance is operating. If not, check the power
connection to the Safe@Office appliance.
•
Check if the LED for the WAN port is green. If not, check the network cable to
the modem and make sure the modem is turned on.
•
Check if the LED for the LAN port used by your computer is green. If not,
check if the network cable linking your computer to the Safe@Office appliance
is connected properly. Try replacing the cable or connecting it to a different
LAN port.
•
Using your Web browser, go to http://my.firewall and see whether "Connected"
appears on the Status Bar. Make sure that your Safe@Office appliance network
settings are configured as per your ISP directions.
•
Check your TCP/IP configuration according to Installing and Setting up the
Safe@Office Appliance on page 45.
•
If Web Filtering or Email Filtering are on, try turning them off.
Chapter 25: Troubleshooting
757
Connectivity
•
Check if you have defined firewall rules which block your Internet connectivity.
•
Check with your ISP for possible service outage.
•
Check whether you are exceeding the maximum number of computers allowed
by your license, by viewing the My Computers page.
I cannot access my DSL broadband connection. What should I do?
DSL equipment comes in two flavors: bridges (commonly known as DSL modems) and
routers. Some DSL equipment can be configured to work both ways.
•
If you connect to your ISP using a PPPoE or PPTP dialer defined in your
operating system, your equipment is most likely configured as a DSL bridge.
Configure a PPPoE or PPTP type DSL connection.
•
If you were not instructed to configure a dialer in your operating system, your
equipment is most likely configured as a DSL router. Configure a LAN
connection, even if you are using a DSL connection.
For instructions, see Configuring the Internet Connection on page 85.
I cannot access my Cable broadband connection. What should I do?
• Some cable ISPs require you to register the MAC address of the device behind
the cable modem. You may need to clone your Ethernet adapter MAC address
onto the Safe@Office appliance. For instructions, see Configuring the Internet
Connection on page 85.
•
Some cable ISPs require using a hostname for the connection. Try reconfiguring
your Internet connection and specifying a hostname. For further information, see
Configuring the Internet Connection on page 85.
I cannot access my ADSL connection from an ADSL appliance. What should I do?
• Check that a micro-filter is used on all the phone sockets on the line (required in
most locations).
•
Check that the DSL Standard setting configured for your appliance is compatible
with your service provider. You can view this setting in the Network > Internet
Setup page.
•
Advanced ADSL configuration fine tuning options are available via the CLI. For
information, refer to the Embedded NGX CLI Reference Guide.
758
Check Point Safe@Office User Guide
Connectivity
I cannot access http://my.firewall or http://my.vpn. What should I do?
• Verify that the Safe@Office appliance is operating.
•
Check if the LED for the LAN port used by your computer is green. If not,
check if the network cable linking your computer to the Safe@Office appliance
is connected properly.
•
By default, unencrypted HTTP access is not allowed from the wireless LAN to
http://my.firewall or http://my.vpn. Therefore, if you are connecting from the
wireless LAN, try connecting to https://my.firewall instead.
•
Try surfing to 192.168.10.1 instead of to my.firewall.
Note: 192.168.10 is the default value, and it may vary if you changed it in the My
Network page.
•
Check your TCP/IP configuration according to Installing and Setting up the
Safe@Office Appliance on page 45.
•
Restart your Safe@Office appliance and your broadband modem by
disconnecting the power and reconnecting after 5 seconds.
•
If your Web browser is configured to use an HTTP proxy to access the
Internet, add my.firewall or my.vpn to your proxy exceptions list.
My network seems extremely slow. What should I do?
• The Ethernet cables may be faulty. For proper operation, the Safe@Office
appliance requires STP CAT5 (Shielded Twisted Pair Category 5) Ethernet
cables. Make sure that this specification is printed on your cables.
•
Your Ethernet card may be faulty or incorrectly configured. Try replacing your
Ethernet card.
•
There may be an IP address conflict in your network. Check that the TCP/IP
settings of all your computers are configured to obtain an IP address
automatically.
I changed the network settings to incorrect values and am unable to correct my error. What
should I do?
Reset the network to its default settings using the button on the back of the Safe@Office
appliance unit. See Resetting the Safe@Office Appliance to Defaults on page 728.
Chapter 25: Troubleshooting
759
Connectivity
I am using the Safe@Office appliance behind another NAT device, and I am having problems
with some applications. What should I do?
By default, the Safe@Office appliance performs Network Address Translation (NAT). It is
possible to use the Safe@Office appliance behind another device that performs NAT, such
as a DSL router or Wireless router, but the device will block all incoming connections
from reaching your Safe@Office appliance.
To fix this problem, do ONE of the following. (The solutions are listed in order of
preference.)
•
Consider whether you really need the router. The Safe@Office appliance can be
used as a replacement for your router, unless you need it for some additional
functionality that it provides.
•
If possible, disable NAT in the router. Refer to the router’s documentation for
instructions on how to do this.
•
If the router has a “DMZ Computer” or “Exposed Host” option, set it to the
Safe@Office appliance’s external IP address.
•
Open the following ports in the NAT device:
•
UDP 9281/9282
•
UDP 500
•
UDP 2746
•
TCP 256
•
TCP 264
•
ESP IP protocol 50
•
TCP 981
I cannot receive audio or video calls through the Safe@Office appliance. What should I do?
To enable audio/video, you must configure an IP Telephony (H.323) virtual server. For
instructions, see Configuring Servers on page 357.
I run a public Web server at home but it cannot be accessed from the Internet. What should I
do?
Configure a virtual Web Server. For instructions, see Configuring Servers on page 357.
760
Check Point Safe@Office User Guide
Service Center and Upgrades
I cannot connect to the LAN network from the DMZ or primary WLAN network. What should I
do?
By default, connections from the DMZ or primary WLAN network to the LAN network
are blocked. To allow traffic from the DMZ or primary WLAN to the LAN, configure
appropriate firewall rules. For instructions, see Using Rules on page 360.
Service Center and Upgrades
I have exceeded my node limit. What does this mean? What should I do?
Your Product Key specifies a maximum number of nodes that you may connect to the
Safe@Office appliance.
The Safe@Office appliance tracks the cumulative number of nodes on the internal network
that have communicated through the firewall. When the Safe@Office appliance encounters
an IP address that exceeds the licensed node limit, the My Computers page displays a
warning message and marks nodes over the node limit in red. These nodes will not be able
to access the Internet through the Safe@Office appliance, but will be protected. The Event
Log page also warns you that you have exceeded the node limit.
To upgrade your Safe@Office appliance to support more nodes, purchase a new Product
Key. Contact your reseller for upgrade information.
While trying to connect to a Service Center, I received the message “The Service Center did
not respond”. What should I do?
• If you are using a Service Center other than the Check Point Service Center,
check that the Service Center IP address is typed correctly.
•
The Safe@Office appliance connects to the Service Center using UDP ports
9281/9282. If the Safe@Office appliance is installed behind another firewall,
make sure that these ports are open.
I purchased an advanced Safe@Office model, but I only have the functionality of a simpler
Safe@Office model. What should I do?
Your have not installed your product key. For further information, see Upgrading Your
Software Product on page 685.
Chapter 25: Troubleshooting
761
Other Problems
Other Problems
I have forgotten my password. What should I do?
Reset your Safe@Office appliance to factory defaults using the Reset button as detailed in
Resetting the Safe@Office Appliance to Defaults on page 728.
Why are the date and time displayed incorrectly?
You can adjust the time on the Setup page's Tools tab. For information, see Setting the
Time on the Appliance on page 699.
I cannot use a certain network application. What should I do?
Look at the Event Log page. If it lists blocked attacks, do the following:
•
Set the Safe@Office appliance's firewall level to Low and try again.
•
If the application still does not work, set the computer on which you want to use
the application to be the exposed host.
For instructions, see Defining an Exposed Host.
When you have finished using the application, make sure to clear the exposed host setting,
otherwise your security might be compromised.
In the Safe@Office Portal, I do not see the pop-up windows that the guide describes. What
should I do?
Disable any pop-up blockers for http://my.firewall.
762
Check Point Safe@Office User Guide
Technical Specifications
Chapter 26
Specifications
This chapter includes the following topics:
Technical Specifications.......................................................................... 763
CE Declaration of Conformity................................................................. 770
Federal Communications Commission Radio Frequency Interference
Statement ................................................................................................. 772
Technical Specifications
Check Point is committed to protecting the environment. Safe@Office unified threat
management appliances are compliant with the RoHS Directive, meeting the European
Union's strict restrictions on hazardous substances.
RoHS & WEEE Declaration and Certification
The Safe@Office appliance has been verified to comply with the following directives,
throughout the design, development, and supply chain stages:
•
Directive of the European Parliament and of the Council, of 27 January 2003, on
the Restriction of the Use of Certain Hazardous Substances in Electrical and
Electronic Equipment (RoHS – 2002/95/EC)
•
Directive of the European Parliament and of the Council, of 27 January 2003, on
Waste Electrical and Electronic Equipment (WEEE – 2002/96/CE)
For a copy of the original signed declaration (in full conformance with EN45014), contact
SofaWare technical support at www.sofaware.com/support.
Chapter 26: Specifications
763
Technical Specifications
Table 147: Safe@Office ADSL Models Attributes
Attribute
Safe@Office 500 ADSL
Safe@Office 500W ADSL
SBXD-166LHGE-5
SBXWD-166LHGE-5
Dimensions
200 x 33 x 122 mm
200 x 33 x 130 mm
(width x height x depth)
(7.87 x 1.3 x 4.8 inches)
(7.87 x 1.3 x 5.12 inches)
Physical Attributes
(incl. antenna connectors)
Weight
660 g (1.46 lbs)
694 g (1.53 lbs)
Retail Box Dimensions
290 x 250 x 80 mm
290 x 250 x 80 mm
(width x height x depth)
(11.42 x 9.84 x 3.15 inches)
(11.42 x 9.84 x 3.15 inches)
In: 100~240VAC @ 0.5A
In: 100~240VAC @ 0.5A
5V DC @ 3.3A
5V DC @ 3.3A
8.5W
10.5W
13.5W (including USB devices)
15.5W (including USB devices)
-5ºC ~ 80º C
-5ºC ~ 80ºC
0ºC ~ 40ºC
0ºC ~ 40ºC
5V Power Supply Unit
Power Supply Nominal
Input
Power Supply Nominal
Output
Max. Power
Consumption
Environmental
Conditions
Temperature:
Storage/Transport
Temperature: Operation
764
Check Point Safe@Office User Guide
Technical Specifications
Humidity:
10 ~ 95% / 10 ~ 90%
10 ~ 95% / 10 ~ 90%
(non-condensed)
(non-condensed)
Safety
cULus, CB, LVD
cULus, CB, LVD
Quality
ISO9001, ISO 14001, TL9000
ISO9001, ISO 14001, TL9000
EMC
CE . FCC 15B.VCCI
CE . FCC 15B.VCCI
Reliability
EN 300 019 - 1, 2, 3
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
RoHS & WEEE
ADSL
Part 68.CS03
Part 68.CS03
RF
N/A
R&TTE .FCC15C, TELCO
Storage/Operation
Applicable Standards
Table 148: Safe@Office Non-ADSL Models Attributes
Attribute
Safe@Office 500
Safe@Office 500W
SBX-166LHGE-5
SBXW-166LHGE-5
Dimensions
200 x 33 x 122 mm
200 x 33 x 130 mm
(width x height x depth)
(7.87 x 1.3 x 4.8 inches)
(7.87 x 1.3 x 5.12 inches)
Physical Attributes
(incl. antenna connectors)
Weight
580 g (1.28 lbs)
635 g (1.40 lbs)
Retail Box Dimensions
290 x 250 x 80 mm
290 x 250 x 80 mm
(width x height x depth)
(11.42 x 9.84 x 3.15 inches)
(11.42 x 9.84 x 3.15 inches)
Chapter 26: Specifications
765
Technical Specifications
5V Power Supply Unit
Power Supply Nominal
In: 100~240VAC @ 0.5A
In: 100~240VAC @ 0.5A
9VAC @ 1.5 A
12VDC @ 1.5 A
Input
Power Supply Nominal
Output
OR:
12VDC @ 1.5 A
Max. Power
4.5W
6.5W
Consumption
11.5W (including USB devices)
Environmental
Conditions
Temperature:
-5ºC ~ 80ºC
-5ºC ~ 80ºC
Temperature: Operation
0ºC ~ 40ºC
0ºC ~ 40ºC
Humidity:
10 ~ 95% / 10 ~ 90%
10 ~ 95% / 10 ~ 90%
(non-condensed)
(non-condensed)
Safety
cULus, CB, LVD
cULus, CB, LVD
Quality
ISO9001, ISO 14001, TL9000
ISO9001, ISO 14001, TL9000
EMC
CE . FCC 15B.VCCI
CE . FCC 15B.VCCI
Reliability
EN 300 019 - 1, 2, 3
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
RoHS & WEEE
Storage/Transport
Storage/Operation
Applicable Standards
766
Check Point Safe@Office User Guide
Technical Specifications
MTBF (hours)
68,000 hours at 30ºC
68,000 hours at 30ºC
RF
N/A
R&TTE .FCC15C,TELCO
Table 149: Safe@Office Non-ADSL Models Attributes
Attribute
Safe@Office 500
Safe@Office 500W
Dimensions
200 x 32 x 128 mm
200 x 32 x 128 mm
(width x height x depth)
(7.87 x 1.26 x 5.04 inches)
(7.87 x 1.26 x 5.04 inches)
Weight
675 g (1.49 lbs)
685 g (1.51 lbs)
Retail Box Dimensions
290 x 250 x 80 mm
290 x 250 x 80 mm
(width x height x depth)
(11.42 x 9.84 x 3.15 inches)
(11.42 x 9.84 x 3.15 inches)
Retail box weight
1.36 kg (3 lbs)
1.38 kg (3.04 lbs)
Power Supply Nominal
100 to 240 Vac
100 to 240 Vac
Input
50 to 60 Hz
50 to 60 Hz
Power Supply Nominal
12VDC @ 1.5 A
12VDC @ 1.5 A
15W
15W
SBX-166LHGE-6
SBXW-166LHGE-6
Physical Attributes
5V Power Supply Unit
Output
Max. Power
Consumption
20W (including USB devices)
Chapter 26: Specifications
767
Technical Specifications
Environmental Conditions
Temperature:
-20ºC ~ 65ºC
-20ºC ~ 65ºC
0ºC ~ 40ºC
0ºC ~ 40ºC
10% ~ 85%
10% ~ 85%
(non-condensed)
(non-condensed)
Safety
EN 60950
EN 60950
Quality
ISO 9001, 9002, 14001
ISO 9001, 9002, 14001
EMC
FCC part 15B
FCC Part 15 B & C
VCCI V-3/V-4
AS/NZS 4268: 2003 A1
Storage/Transport
Temperature:
Operation
Humidity:
Storage/Operation
Applicable Standards
DGT
Reliability
EN 300 019 - 1, 2, 3
EN 300 019 - 1, 2, 3
Environment
RoHS & WEEE
RoHS & WEEE
MTBF (hours)
68,000
68,000
RF
N/A
R&TTE .FCC15C, TELCO
768
Check Point Safe@Office User Guide
Technical Specifications
Wireless Attributes
Table 150: Safe@Office Wireless Attributes
Attribute
All Wireless Models
Operation Frequency
2.412-2.484 MHz
Transmission Power
79.4 mW
Modulation
OFDM, DSSS, 64QAM, 16QAM, QPSK, BPSK, CCK, DQPSK,
DBPSK
WPA Authentication
EAP-TLS, EAP-TTLS, PEAP (EAP-GTC), PEAP (EAP-MSCHAP V2)
Modes
Chapter 26: Specifications
769
CE Declaration of Conformity
CE Declaration of Conformity
SofaWare Technologies Ltd., 3 Hilazon St., Ramat-Gan Israel, hereby declares that this
equipment is in conformity with the essential requirements specified in Article 3.1 (a) and
3.1 (b) of:
•
Directive 89/336/EEC (EMC Directive)
•
Directive 73/23/EEC (Low Voltage Directive – LVD)
•
Directive 99/05/EEC (Radio Equipment and Telecommunications Terminal
Equipment Directive)
In accordance with the following standards:
Table 151: Safe@Office Appliance Standards
Attribute
Safe@Office 500
SBX-166LHGE-5
Safe@Office 500
SBX-166LHGE-6 /
Safe@Office 500W SBXW166LHGE-6
EMC
770
EN 55022
EN 50081-1
EN 61000-3-2
EN 50082-1
EN 61000-3-3
EN 61000-6-1
EN 61000-4-2
EN 61000-6-3
EN 61000-4-3
EN 55022
EN 61000-4-4
EN 55024
EN 61000-4-5
EN 61000-3-2
EN 61000-4-6
EN 61000-3-3
Check Point Safe@Office User Guide
CE Declaration of Conformity
Attribute
Safe@Office 500
SBX-166LHGE-5
Safe@Office 500
SBX-166LHGE-6 /
Safe@Office 500W SBXW166LHGE-6
EN 61000-4-8
EN 61000-4-2
EN 61000-4-11
EN 61000-4-3
ENV50204
EN 61000-4-4
EN 61000-4-5
EN 61000-4-6
EN 61000-4-7
EN 61000-4-8
EN 61000-4-9
EN 61000-4-10
EN 61000-4-11
EN 61000-4-12
Safety
EN 60950
EN 60950
IEC 60950
IEC 60950
The "CE" mark is affixed to this product to demonstrate conformance to the R&TTE
Directive 99/05/EEC (Radio Equipment and Telecommunications Terminal Equipment
Directive) and FCC Part 15 Class B.
The product has been tested in a typical configuration. For a copy of the Original Signed
Declaration (in full conformance with EN45014), please contact SofaWare at the above
address.
Chapter 26: Specifications
771
Federal Communications Commission Radio Frequency Interference Statement
Federal Communications Commission Radio
Frequency Interference Statement
This equipment complies with the limits for a Class B digital device, pursuant to Part 15 of
the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference when the equipment is operated in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy and, if not installed and used in
accordance with the instruction manual, may cause harmful interference to radio
communications.
Shielded cables must be used with this equipment to maintain compliance with FCC
regulations.
Any changes or modifications to this product not explicitly approved by the manufacturer
could void the user’s authority to operate the equipment and any assurances of Safety or
Performance, and could result in violation of Part 15 of the FCC Rules.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following
two conditions: (1) this device may not cause harmful interference, and (2) this device
must accept any interference received, including interference that may cause undesired
operation.
This Class B digital apparatus complies with Canadian ICES-003.
FCC Radiation Exposure Statement for Wireless Models
This equipment complies with FCC radiation exposure limits set forth for an uncontrolled
environment. The antenna(s) used for this equipment must be installed to provide a
separation distance of at least eight inches (20 cm) from all persons. This equipment must
not be operated in conjunction with any other antenna.
772
Check Point Safe@Office User Guide
Glossary of Terms
Glossary of Terms
ADSL Modem
A device connecting a computer to the
Internet via an existing phone line.
ADSL (Asymmetric Digital Subscriber
Line) modems offer a high-speed
'always-on' connection.
CA
The Certificate Authority (CA) issues
certificates to entities such as gateways,
users, or computers. The entity later
uses the certificate to identify itself and
provide verifiable information. For
instance, the certificate includes the
Distinguished Name (DN) (identifying
information) of the entity, as well as the
public key (information about itself),
and possibly the IP address.
After two entities exchange and validate
each other's certificates, they can begin
encrypting information between
themselves using the public keys in the
certificates.
Cable Modem
A device connecting a computer to the
Internet via the cable television
network. Cable modems offer a highspeed 'always-on' connection.
Glossary of Terms
Certificate Authority
The Certificate Authority (CA) issues
certificates to entities such as gateways,
users, or computers. The entity later
uses the certificate to identify itself and
provide verifiable information. For
instance, the certificate includes the
Distinguished Name (DN) (identifying
information) of the entity, as well as the
public key (information about itself),
and possibly the IP address.
After two entities exchange and validate
each other's certificates, they can begin
encrypting information between
themselves using the public keys in the
certificates.
Cracking
An activity in which someone breaks
into someone else's computer system,
bypasses passwords or licenses in
computer programs; or in other ways
intentionally breaches computer
security. The end result is that whatever
resides on the computer can be viewed
and sensitive data can be stolen without
anyone knowing about it. Sometimes,
tiny programs are 'planted' on the
computer that are designed to watch out
for, seize and then transmit to another
computer, specific types of data.
773
Glossary of Terms
DHCP
Any machine requires a unique IP
address to connect to the Internet using
Internet Protocol. Dynamic Host
Configuration Protocol (DHCP) is a
communications protocol that assigns
Internet Protocol (IP) addresses to
computers on the network.
DHCP uses the concept of a "lease" or
amount of time that a given IP address
will be valid for a computer.
DMZ
A DMZ (demilitarized zone) is an
internal network defined in addition to
the LAN network and protected by the
Safe@Office appliance.
DNS
The Domain Name System (DNS)
refers to the Internet domain names, or
easy-to-remember "handles", that are
translated into IP addresses.
An example of a Domain Name is
'www.sofaware.com'.
Domain Name System
Domain Name System. The Domain
Name System (DNS) refers to the
Internet domain names, or easy-toremember "handles", that are translated
into IP addresses.
An example of a Domain Name is
'www.sofaware.com'.
774
Exposed Host
An exposed host allows one computer
to be exposed to the Internet. An
example of using an exposed host
would be exposing a public server,
while preventing outside users from
getting direct access form this server
back to the private network.
Firmware
Software embedded in a device.
Gateway
A network point that acts as an entrance
to another network.
Hacking
An activity in which someone breaks
into someone else's computer system,
bypasses passwords or licenses in
computer programs; or in other ways
intentionally breaches computer
security. The end result is that whatever
resides on the computer can be viewed
and sensitive data can be stolen without
anyone knowing about it. Sometimes,
tiny programs are 'planted' on the
computer that are designed to watch out
for, seize and then transmit to another
computer, specific types of data.
Check Point Safe@Office User Guide
Glossary of Terms
HTTPS
Hypertext Transfer Protocol over Secure
Socket Layer, or HTTP over SSL.
A protocol for accessing a secure Web
server. It uses SSL as a sublayer under
the regular HTTP application. This
directs messages to a secure port
number rather than the default Web port
number, and uses a public key to
encrypt data
HTTPS is used to transfer confidential
user information.
Hub
A device with multiple ports,
connecting several PCs or network
devices on a network.
IP Address
An IP address is a 32-bit number that
identifies each computer sending or
receiving data packets across the
Internet. When you request an HTML
page or send e-mail, the Internet
Protocol part of TCP/IP includes your
IP address in the message and sends it
to the IP address that is obtained by
looking up the domain name in the
Uniform Resource Locator you
requested or in the e-mail address you're
sending a note to. At the other end, the
recipient can see the IP address of the
Web page requestor or the e-mail sender
and can respond by sending another
message using the IP address it
received.
Glossary of Terms
IP Spoofing
A technique where an attacker attempts
to gain unauthorized access through a
false source address to make it appear as
though communications have originated
in a part of the network with higher
access privileges. For example, a packet
originating on the Internet may be
masquerading as a local packet with the
source IP address of an internal host.
The firewall can protect against IP
spoofing attacks by limiting network
access based on the gateway interface
from which data is being received.
IPSEC
IPSEC is the leading Virtual Private
Networking (VPN) standard. IPSEC
enables individuals or offices to
establish secure communication
channels ('tunnels') over the Internet.
ISP
An ISP (Internet service provider) is a
company that provides access to the
Internet and other related services.
LAN
A local area network (LAN) is a group
of computers and associated devices
that share a common communications
line and typically share the resources of
a single server within a small
geographic area.
775
Glossary of Terms
MAC Address
The MAC (Media Access Control)
address is a computer's unique hardware
number. When connected to the Internet
from your computer, a mapping relates
your IP address to your computer's
physical (MAC) address on the LAN.
Mbps
Megabits per second. Measurement unit
for the rate of data transmission.
MTU
The Maximum Transmission Unit
(MTU) is a parameter that determines
the largest datagram than can be
transmitted by an IP interface (without
it needing to be broken down into
smaller units). The MTU should be
larger than the largest datagram you
wish to transmit un-fragmented. Note:
This only prevents fragmentation
locally. Some other link in the path may
have a smaller MTU - the datagram will
be fragmented at that point. Typical
values are 1500 bytes for an Ethernet
interface or 1452 for a PPP interface.
NAT
Network Address Translation (NAT) is
the translation or mapping of an IP
address to a different IP address. NAT
can be used to map several internal IP
addresses to a single IP address, thereby
sharing a single IP address assigned by
the ISP among several PCs.
776
Check Point FireWall-1's Stateful
Inspection Network Address Translation
(NAT) implementation supports
hundreds of pre-defined applications,
services, and protocols, more than any
other firewall vendor.
NetBIOS
NetBIOS is the networking protocol
used by DOS and Windows machines.
Packet
A packet is the basic unit of data that
flows from one source on the Internet to
another destination on the Internet.
When any file (e-mail message, HTML
file, GIF file etc.) is sent from one place
to another on the Internet, the file is
divided into "chunks" of an efficient
size for routing. Each of these packets is
separately numbered and includes the
Internet address of the destination. The
individual packets for a given file may
travel different routes through the
Internet. When they have all arrived,
they are reassembled into the original
file at the receiving end.
PPPoE
PPPoE (Point-to-Point Protocol over
Ethernet) enables connecting multiple
computer users on an Ethernet local area
network to a remote site or ISP, through
common customer premises equipment
(e.g. modem).
Check Point Safe@Office User Guide
Glossary of Terms
PPTP
The Point-to-Point Tunneling Protocol
(PPTP) allows extending a local
network by establishing private
“tunnels” over the Internet. This
protocol it is also used by some DSL
providers as an alternative for PPPoE.
RJ-45
The RJ-45 is a connector for digital
transmission over ordinary phone wire.
Router
A router is a device that determines the
next network point to which a packet
should be forwarded toward its
destination. The router is connected to
at least two networks.
Server
A server is a program (or host) that
awaits and requests from client
programs across the network. For
example, a Web server is the computer
program, running on a specific host, that
serves requested HTML pages or files.
Your browser is the client program, in
this case.
Stateful Inspection
Stateful Inspection was invented by
Check Point to provide the highest level
of security by examining every layer
within a packet, unlike other systems of
inspection. Stateful Inspection extracts
information required for security
Glossary of Terms
decisions from all application layers and
retains this information in dynamic state
tables for evaluating subsequent
connection attempts. In other words, it
learns!
Subnet Mask
A 32-bit identifier indicating how the
network is split into subnets. The subnet
mask indicates which part of the IP
address is the host ID and which
indicates the subnet.
TCP
TCP (Transmission Control Protocol) is
a set of rules (protocol) used along with
the Internet Protocol (IP) to send data in
the form of message units between
computers over the Internet. While IP
takes care of handling the actual
delivery of the data, TCP takes care of
keeping track of the individual units of
data (called packets) that a message is
divided into for efficient routing
through the Internet.
For example, when an HTML file is
sent to you from a Web server, the
Transmission Control Protocol (TCP)
program layer in that server divides the
file into one or more packets, numbers
the packets, and then forwards them
individually to the IP program layer.
Although each packet has the same
destination IP address, it may get routed
differently through the network.
777
Glossary of Terms
At the other end (the client program in
your computer), TCP reassembles the
individual packets and waits until they
have arrived to forward them to you as a
single file.
TCP/IP
TCP/IP (Transmission Control
Protocol/Internet Protocol) is the
underlying communication protocol of
the Internet.
UDP
UDP (User Datagram Protocol) is a
communications protocol that offers a
limited amount of service when
messages are exchanged between
computers in a network that uses the
Internet Protocol (IP). UDP is an
alternative to the Transmission Control
Protocol (TCP) and, together with IP, is
sometimes referred to as UDP/IP. Like
the Transmission Control Protocol,
UDP uses the Internet Protocol to
actually get a data unit (called a
datagram) from one computer to
another. Unlike TCP, however, UDP
does not provide the service of dividing
a message into packets (datagrams) and
reassembling it at the other end.
resource depends on the Internet
application protocol. On the Web
(which uses the Hypertext Transfer
Protocol), an example of a URL is
'http://www.sofaware.com'.
VPN
A virtual private network (VPN) is a
private data network that makes use of
the public telecommunication
infrastructure, maintaining privacy
through the use of a tunneling protocol
and security procedures.
VPN tunnel
A secure connection between a Remote
Access VPN Client and a Remote
Access VPN Server.
WLAN
A WLAN is a wireless local area
network protected by the Safe@Office
appliance.
UDP is often used for applications such
as streaming data.
URL
A URL (Uniform Resource Locator) is
the address of a file (resource)
accessible on the Internet. The type of
778
Check Point Safe@Office User Guide
Index
Index
802.1x
configuring for a wireless network • 269
backup connection
configuring • 149
configuring for ports • 374
Block Known Ports • 448
excluding network objects from • 185
Block List engine
Access Denied page
customizing • 543
account
configuring • 559
ADSL
configuring a direct connection • 85
ADSL modem
about • 773
antispam filtering solutions
about • 466
comparison of • 466
Email Antivirus • 521
VStream Antispam • 487
antivirus filtering solutions
adding senders • 502
configuring settings • 504
deleting senders • 504
enabling/disabling • 492
Block Port Overflow • 449
Blocked FTP Commands • 450
bridges
adding and editing • 224
adding connections to • 233
adding networks to • 228
deleting • 238
explained • 217
multiple • 222
using • 217
about • 465
CA, explained • 620, 773
Email Antivirus • 521
cable modem
solutions • 465
configuring a connection • 85
VStream Antivirus • 467
explained • 773
Index
779
Index
certificate
Packet Sniffer • 706
explained • 620
Ping • 702
exporting • 629
Traceroute • 702
exporting CA • 630
using • 702
exporting device • 629
WHOIS • 702
generating self-signed • 621
importing • 626
installing • 620
uninstalling • 628
diagnostics
running • 731
dialup
connection • 125
Checksum Verification • 436
RS232 modem • 137
Cisco IOS DOS • 433
USB modem • 141
command line interface
controlling the appliance via • 673
Content Based Antispam engine
direct ADSL connection • 97, 105
DMZ
configuring • 169
configuring • 497
configuring High Availability for • 239
enabling/disabling • 492
explained • 774
DDoS Attack • 425
DHCP
configuring • 158
DNS • 149, 702, 774
Dynamic DNS • 9, 557
EAP authenticator
connection • 94
explained • 394
explained • 773
using with wired clients • 396
options • 164
using with wireless clients • 395
DHCP Server
workflows • 395
enabling/disabling • 158
Email Antispam, see Email Filtering • 521
explained • 158
Email Antivirus, see Email Filtering • 521
diagnostic tools
780
Email Filtering
Check Point Safe@Office User Guide
Index
Email Antispam • 521
types • 364
Email Antivirus • 521
using • 360
enabling/disabling • 522
firmware
selecting protocols for • 523
explained • 774
snoozing • 525
updating • 545
temporarily disabling • 525
updating by using Software Updates •
546
EoA
configuring a connection • 85
Event Log
viewing • 339
exposed host
defining a computer as • 357
explained • 774
File and Print Sharing • 453
firewall
about • 351
levels • 354
rule types • 362
setting security level • 354
technologies • 37
firewall rules
updating manually • 549
viewing status • 683
Flags • 443
FTP Bounce • 447
gateway hostname
configuring • 687
gateways
backup • 239
default • 199
explained • 774
ID • 557
master • 239
H.323 • 458
adding and editing • 364
Header Rejection • 451
deleting • 373
Hide NAT
enabling/disabling • 372
enabling/disabling • 157
enabling/disabling logging • 373
explained • 157
reordering • 372
Index
high availability
781
Index
configuring • 239
configuring backup • 149
explained • 239
enabling/disabling • 148
Host Port Scan • 444
establishing quick • 148
HTTPS
terminating • 149
configuring • 691
troubleshooting • 757
explained • 774
viewing information • 145
using • 77
hub • 59, 149, 239, 757, 775
Internet Setup
using • 102
Internet Wizard
IGMP • 455
IKE traces
viewing • 634
installation
ADSL models • 60
cable type • 59
network • 59
non-ADSL models • 59
software requirements • 9
Instant Messengers • 461
internal DNS Server
about • 182
configuring • 182
internal VPN Server
configuring • 571
explained • 566
Internet connection
configuring • 85
782
using • 86
IP address
changing • 156
explained • 775
hiding • 157
IP Fragments • 429
IP Reputation engine
configuring • 507
enabling/disabling • 492
IPoA
configuring a connection • 112
ISP
explained • 775
L2TP VPN Clients
configuring • 574
L2TP VPN Server
about • 567
Check Point Safe@Office User Guide
Index
configuring • 572
LAN
cable • 59
configuring a connection • 85
configuring High Availability for • 239
explained • 775
ports • 59
LAND • 422
licenses
upgrading • 685
link configurations
modifying • 214
load balancing
about • 150
configuring • 150
login
MTU
explained • 776
NAT rules
about • 386
adding and editing • 389
types • 387
using • 386
viewing and deleting • 393
NetBIOS
explained • 776
network
changing internal range of • 156
configuring • 153
configuring a DMZ • 169
initial • 71
configuring a virtual access point (VAP)
• 294
regular • 74
configuring a VLAN • 174
logs
configuring DHCP options • 164
event logs • 339
configuring high availability • 239
exporting • 339
security logs • 343
configuring the OfficeMode network •
172
viewing • 339
configuring the WLAN • 263
enabling DHCP Server on • 158
MAC address
explained • 775
Max Ping Size • 428
Index
enabling Hide NAT • 157
installation on • 59
managing • 153
objects • 185
783
Index
Network Interface Monitor
viewing bridge statistics • 331
viewing general network statistics • 321
viewing Internet connection statistics •
322
viewing wired network statistics • 326
viewing wireless network statistics • 329
network objects
adding and editing • 187
using • 185
viewing and deleting • 195
Network Quota • 431
network service objects
filter string syntax • 709
using • 706
password
changing • 639
setting up • 71
Peer to Peer • 459
Ping of Death • 421
Port-based VLAN
about • 174
adding and editing • 178
deleting • 181
ports
adding and editing • 196
configuring 802.1x security scheme for •
374
viewing and deleting • 198
managing • 205
node limit
viewing • 316
modifying assignments • 212
modifying link configurations • 214
Non-TCP Flooding • 423
resetting to defaults • 215
Null Payload • 435
viewing statuses • 206
OfficeMode
about • 172
configuring • 172
PPPoA
configuring a connection • 85
PPPoE
connection • 85
explained • 776
PPTP
packet • 145, 199, 702, 775, 776
connection • 85
Packet Sanity • 426
explained • 776
Packet Sniffer
784
primary WLAN
Check Point Safe@Office User Guide
Index
configuring • 263
about • 725
defined • 778
performing • 727
printers
changing ports • 755
configuring computers to use • 737
resetting • 756
preparing for • 726
Remote Access VPN Clients
Remote Access VPN Clients • 561
Remote Access VPN Servers
setting up • 734
configuring • 567
using • 733
explained • 561
viewing • 754
QoS
classes • 251
explained • 251
QoS classes
adding and editing • 256
assigning services to • 360
deleting • 260
explained • 251
predefined • 254
restoring defaults • 261
Remote Desktop
accessing a remote desktop • 669
configuring • 663
configuring the host computer • 666
using • 661
reports
active computers • 316
active connections • 318
network statistics • 321
node limit • 316
routing table • 334
Safe@Office appliance status • 305
traffic • 311
RADIUS
viewing • 305
wireless statistics • 329
configuring VSA • 657
routers • 149, 239, 702, 757, 777
explained • 650
RS232 dialup modem
using • 650
rapid deployment
Index
setting up • 137
rules
785
Index
firewall • 360
NAT • 386
rear panel • 16
Safe@Office 500W ADSL
VStream Antispam • 510
front panel • 28
VStream Antivirus • 471
network requirements • 26
Web • 529
package contents • 25
Safe Senders
adding • 518
deleting • 519
Safe@Office 500
front panel • 13
network requirements • 10
package contents • 10
rear panel • 11
Safe@Office 500 ADSL
front panel • 23
network requirements • 21
package contents • 20
rear panel • 21
Safe@Office 500 series
about • 1
features • 2
product family • 2
Safe@Office 500W
front panel • 18
network requirements • 15
package contents • 15
786
rear panel • 26
Safe@Office appliance
backing up • 717
cascading • 62
changing internal IP address of • 156
configuring Internet connection • 85
connecting to network printers • 63
controlling via the command line • 673
features • 2
firewall • 37
installing • 45
internal DNS server • 182
maintenance • 683
models • 2
mounting • 63
preparing for a wireless connection • 62
rapid deployment • 725
rebooting • 732
resetting to factory defaults • 728
restoring • 717
securing against theft • 65
security • 31
Check Point Safe@Office User Guide
Index
setting the time • 699
setting up • 67
explained • 561
security
status • 305
about • 31
technical specifications • 763
configuring port-based security • 374
Safe@Office appliance configuration
configuring servers • 357
backing up to a USB flash drive • 719
creating firewall rules • 360
exporting • 718
defining a computer as an exposed host •
357
importing • 721
restoring from a USB flash drive • 723
Safe@Office Portal
elements • 79
initial • 71
logging in • 74
logging out • 619
remotely accessing • 77
using • 79
Secure HotSpot
customizing • 384
enabling/disabling • 382
quick guest users • 647
setting up • 381
using • 380
SecuRemote
explained • 566
installing • 573
SecuRemote Remote Access VPN Server
configuring • 569
firewall • 354
Secure HotSpot • 380
SmartDefense • 410
Security Log
resetting • 343
viewing • 343
security policy
about • 351
default • 353
enforcement • 352
implementation • 352
planning • 352
setting up • 351
Sequence Verifier • 442
serial console
controlling appliance via • 676
using • 676
servers
configuring • 357
explained • 777
Index
787
Index
Service Center
connecting to • 551
explained • 199
Spanning Tree Protocol
disconnecting from • 559
explained • 222
refreshing a connection to • 558
with WDS • 265
service routing
explained • 199
services
Email Filtering • 521
SSH
configuring • 679
explained • 679
Stateful Inspection
software updates • 546
explained • 777
Web Filtering • 537
technology • 39
Setup Wizard • 71, 86
SIP • 457
Site-to-Site VPN gateways
Static IP
configuring a connection • 93
Static NAT
explained • 561
explained • 185
PPPoE tunnels • 581
using • 187
Small PMTU • 438
SmartDefense
static routes
adding and editing • 200
categories • 419
explained • 199
configuring • 411
using • 199
using • 410
viewing and deleting • 204
SNMP
configuring • 694
explained • 694
software updates
checking for manually • 546
explained • 546
source routing
788
viewing the routing table • 334
Status Monitor
viewing • 305
Strict TCP • 437
subnet masks
explained • 777
subscription services
Check Point Safe@Office User Guide
Index
explained • 551
starting • 551
viewing information • 557
Sweep Scan • 444
SynDefender • 440
Syslog logging
viewing reports • 312
traffic reports
exporting • 315
viewing • 312
Traffic Shaper
advanced • 251
configuring • 689
enabling • 251
explained • 689
explained • 251
Tag-based VLAN
about • 174
adding and editing • 180
deleting • 181
TCP
TCP, explained • 777
TCP/IP
setting up for MAC OS • 55
setting up for Windows XP/2000 • 50
Teardrop • 420
technical support
contacting • 30
Telstra
Telstra • 123
Traffic Monitor
configuring • 313
exporting reports • 315
restoring defaults • 261
setting up • 253
simplified • 251
using • 251
troubleshooting • 757
UDP
explained • 778
URL
explained • 778
users
adding and editing • 643
adding quick guest HotSpot • 647
managing • 639
setting up remote VPN access for • 650
viewing and deleting • 649
Vendor-Specific Attribute
using • 311
Index
789
Index
about • 650
deleting • 615
configuring • 471
enabling/disabling • 615
virtual access points (VAPs)
logging in • 616
about • 174
logging out • 619
adding and editing • 294
types • 561
deleting • 181
VLAN
VPN tunnels
creation and closing of • 631
adding and editing • 177
establishing • 616
configuring • 13
explained • 778
configuring port-based • 178
viewing • 631
configuring tag-based • 180
VStream Antispam
configuring virtual access points • 294
about • 487
deleting • 181
configuring advanced settings • 520
types • 174
configuring the Block List engine • 502
VPN
explained • 561
Remote Access • 565
sites • 561
Site-to-Site • 563
tunnnels • 561
viewing IKE traces • 634
VPN Server
configuring • 567
SecuRemote internal • 566
types • 567
VPN sites
adding and editing • 581
790
configuring the Content Based Antispam
engine • 497
configuring the IP Reputation engine •
507
configuring the Safe Sender list • 517
default policy • 492
enabling/disabling • 492
header marking • 491
how it works • 489
rules • 510
viewing statistics • 495
VStream Antispam rules
adding and editing • 512
deleting • 517
Check Point Safe@Office User Guide
Index
enabling/disabling • 516
configuring • 298
reordering • 516
explained • 265
types • 511
VStream Antivirus
Web content filtering solutions
about • 527
about • 467
comparison of • 527
configuring • 467
Web Filtering • 537
configuring advanced settings • 482
Web rules • 529
configuring policy • 471
default policy • 469
enabling/disabling • 469
rules • 473
updating • 486
viewing database information • 470
VStream Antivirus rules
adding and editing • 473
deleting • 481
enabling/disabling • 480
reordering • 480
types • 473
WAN
Web Filtering
customizing the Access Denied page •
543
enabling/disabling • 537
excluding network objects from • 185
resetting to defaults • 542
selecting categories for • 539
snoozing • 541
temporarily disabling • 541
Web rules
adding and editing • 530
customizing the Access Denied page •
543
enabling/disabling logging • 535
reordering • 535
cable • 59
using • 529
load balancing • 150
viewing and deleting • 536
WDS
Welchia • 432
explained • 265
WEP • 263, 269
links • 265
wireless networks
WDS links
Index
troubleshooting connectivity • 302
791
Index
viewing statistics for • 329
wireless protocols
supported • 269
wireless stations
viewing • 329
Worm Catcher • 452
XBox LIVE • 463
792
Check Point Safe@Office User Guide

---

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.6
Linearized                      : Yes
Page Mode                       : UseOutlines
XMP Toolkit                     : 3.1-701
About                           : uuid:dfb385fc-f2c4-42da-a6b7-e6205285cfc3
Producer                        : Acrobat Distiller 8.1.0 (Windows)
Company                         :  Tech-Tav Documentation Ltd.
Creator Tool                    : Acrobat PDFMaker 8.1 for Word
Modify Date                     : 2009:10:13 18:54:14+08:00
Create Date                     : 2008:04:29 20:39:49+03:00
Metadata Date                   : 2009:10:13 18:54:14+08:00
Document ID                     : uuid:efd11b4c-d138-4185-ba8a-7274e0f656fd
Instance ID                     : uuid:3a539b0e-7c81-47ce-a7d5-12b0947b1733
Format                          : application/pdf
Creator                         : Part No: 700797, April 2008
Title                           : Check Point Safe@Office User Guide
Description                     : 
Has XFA                         : No
Page Count                      : 405
Page Layout                     : SinglePage
Subject                         : 
Author                          : Part No: 700797, April 2008
Keywords                        : Version, 8.0

EXIF Metadata provided by EXIF.tools