Transcription
Question 1:What is Checkpoint Firewall Architecture?Answer:Check Point has developed a Unified Security Architecture that is implementedthroughout all of its security products. This Unified Security Architecture enables allCheck Point products to be managed and monitored from a single administrativeconsole, and provides a consistent level of security.Question 2:What is stateful inspection?Answer:Stateful inspection was invented by checkpoint, providing accurate and highly efficienttraffic inspection. The inspection engine examines every packet as they are interceptedat the network layer. The connection state and context information are stored andupdated dynamically in kernel table.Question 3:What is policy installation process in checkpoint firewall?Answer:a.b.c.d.INITIATION - Policy installation is initiated by the GUI.VERIFICATION -The information in the database is verifiedCONVERSION- The information in database is convertedCODE GENERATION & COMPILATION- Policy is translated to the INSPECTlanguage and compiled with the INSPECT compiler.e. CPTA- checkpoint policy transfer agent transfers the policy to the firewallgateway using SICf. COMMIT- The gateway is instructed to load the new policyQuestion 4:What is the main purpose for the Security managementserver?Answer:Security management server is used for administrative management of the securitypolicy, stores databased and objects.www.NetTech.org.in
Question 5:What is the difference between standalone and distributed installation?Answer:A Standalone deployment is the simplest deployment, where the management serverand the gateway are installed on the same machine.A distributed deployment is a more complex deployment, where the gatewayand management server are deployed on different machines.Question 6: what is SIC?Answer:Secure internal Communication (SIC) is the checkpoint feature that ensurescomponents, such as Security Gateways, Security Management servers, etc. cancommunicate freely and securely. The following security measures are taken to ensurethe safety of SIC Certificates for authenticationStandards-based SSL for the creation of the secure channel3DES for encryption.Question 7:what is Internal Certificate Authority (ICA)?Answer:ICA is created during the management server installation process. It isresponsible for issuing certificates for: SICVPN certificates for gatewaysUsersQuestion 8:What is Fw unload local?Answer:Fwunloadlocal is a command used to detach the security policy from the local machine.www.NetTech.org.in
Question 9:What is stealth rule in checkpoint firewall?Answer:Stealth rule prevents users from connecting directly to the gateway. Stealth rule at thetop of the rule base protects your gateway from port scanning, spoofing and other typesof direct attacks.Question 10:What is FW Monitor command?Answer:FW Monitor is a packet analyzer tool available on every checkpoint security Gateway.It provides Kernel level inspection and works for Layers 3 and above in OSI model.There are four inspection points as a packet passes through the kernel (or virtualMachine)i ---- Before the Virtual machine, in the inbound direction (Pre-Inbound)I ---- After the virtual machine, in the inbound direction (Post – inbound)o ---- Before the virtual machine, in the outbound direction (Pre Outbound)O --- After the virtual machine, in the outbound direction (Post Outbound)Question 11 – What are the two types of Check Point NG licenses?Answer:Central and Local licensesCentral licenses are the new licensing model and are bound to the Securitymanagement server. Local licenses are the legacy licensing model and are bound to theenforcement module.www.NetTech.org.in
Question 12 – What are the functions of CPD, FWM, and FWD processes?Answer:CPD – CPD is a high in the hierarchical chain and helps to execute many services, suchas Secure Internal Communication (SIC), Licensing and status report.FWM – The FWM process is responsible for the execution of the database activities ofthe Management server. It is; therefore, responsible for Policy installation, ManagementHigh Availability (HA) Synchronization, saving the Policy, Database Read/Write action,Log Display, etc.FWD – The FWD process is responsible for logging. It is executed in relation to logging,Security Servers and communication with OPSEC applications.Question 13:What are the major differences between SPLAT and GAIA platforms?Answer.Gaia is the latest version of Checkpoint which is a combination of SPLAT and IPSO.Here are some benefits of Gaia as compare to SPLAT/IPSO.1. Web-Based user interface with Search Navigation2. Full Software Blade support3. High connection capacity4. Role-Based administrative Access5. Intelligent Software updates6. Native IPv4 and IPv6 Support7. ClusterXL or VRRP Clusters8. Manageable Dynamic Routing SuiteQuestion 14: what ports are used in SIC?Answer:8210TCP18211 TCPPulls Certificates from an ICA.Used by the cod daemon (on the gateway) to receive Certificates.www.NetTech.org.in
Question 15:What are the different Checkpoint Ports and purpose of these ports?Answer:PORT TYPE SHORT DESCRIPTION256TCPFW1 Checkpoint Security gateway Service257TCPFW1 log Protocol Used for delivering logs from FWM259TCPFW1 clientauth telnet ( Client Authentication )500UDPIPSEC IKE Protocol (formerly ISAKMP/Oakley)900TCPFW1 clntauth http (Client Authentication))4433TCPManagement server Portal4500UDPNAT-T NAT Traversal,8116UDPCheck Point Cluster Control protocol (CCP)18190 TCPCPMI Check Point Management Interface,18191TCP1819218210TCPTCP18211 TCPServiceProtocol for communication between GUI and ManagementServerCPD Check Point Daemon ProtocolDownload of rule base from Management Server to FWMFetching rule base from FWM to Management server.CPD amon Check Point Internal Application MonitoringFW1 ica pull Check Point Internal CA Pull CertificateServiceFW1 ica pull Check Point Internal CA Push CertificateQuestion 16: What’s the difference between tcpdump and fewmonitor?Answer:Tcpdump displays traffic coming or leaving to/from a firewall interface while fewmonitor would also tell you how the packet is going through the firewall includingrouting and NAT decisions.FW Monitor captures traffic at 4 important points in the firewall namely i, I, o & O. Youwould see them in the capture in the same sequence.TCP Dumpcaptures at position i & O of firewall monitor, and you can be sure the traffichas left the firewall. This is similar to the way captures work on a Cisco PIX/ASAwww.NetTech.org.in
Question 17: what is bi-directional NAT?Answer:If Bi-directional NAT is selected, the gateway will check all NAT rules to see if there is asource match in one rule, and a destination match in another rule. The Gateway will usethe first matches found, and apply both rules concurrently.Question 18:What are the stages of a phase2 IKE exchange?Answer:Peers exchange more key material, and agree on encryption and integrity methods forIPsec Key. The DH Key is combined with the key material to produce the symmetricalIP Sec key.Question 19: Why cleanup rule need to add explicitly in Checkpoint Smart dashboard?Answer:Cleanup rule is required to drop all traffic that did not match any of the other rules (fromtop to bottom) However there is an Implied rule in Checkpoint that does the same actionof dropping packets if no rule exists ( as you mentioned) but logging is not enabled forthis implied rule.Question 20:What Is the Difference in A Snapshot/Backup/Upgrade Export (MigrateExport)/Database Revision ControlAnswer:Snapshot:The snapshot utility backs up everything, including the drivers, .Snapshot can be usedto backup both your firewall and management modules.The disadvantages of this utility are that the generated file is very big, and can only berestored to the same device and exactly the same state (same OS, same Check Pointversion, and same patch level).www.NetTech.org.in
Backups:The backup utility backs up your Check Point configuration and your networking/OSsystem parameters (such as routing), the backup utility can be used to backup bothyour firewall and management modules. The resulting file will be smaller than the onegenerated by snapshot. Backup does not include the drivers, and can be restored todifferent machine (as opposed to snapshot, which cannot).Database Revision Control:This utility creates a version of your current policies, object database, IPS updates, etc.It is useful for minor changes or edits that you perform in Smart Dashboard. It cannotbe used to restore your system in case of failure.Migrate Export (Upgrade Export):'upgrade export' tool backs up all Check Point configurations, independent of hardware,OS or Check Point version, but does not include OS information.You can use this utility to backup Check Point configuration on the management station.If you change the Check Point version you can only go up, in other words you canupgrade not downgrade.This utility can be used only on command line and cannot be scheduled.Recommended backup schedule:Snapshot - at least once, or before major change (for example: an upgrade), during amaintenance window.Backup - every couple of months, depending how frequently you perform changes inyour network/policy. Also before every major change, during a maintenance window.Upgrade export - every month or more often, depending on how frequently youperform changes in your network/policy. Also important before upgrade or migration.Can be run outside a maintenance window.www.NetTech.org.in
CPTA- checkpoint policy transfer agent transfers the policy to the firewall gateway using SIC f. COMMIT- The gateway is instructed to load the new policy Question 4:
