After publication More than two years have passed, and the 1400 series models are now discontinued. It’s time for changes and innovations, a task CheckPoint has aimed to realize in the 1500 series. In this article, we will explore models for protecting small offices or company branches, presenting technical specifications, delivery features (licensing, management and administration schemes), and discuss new technologies and options.
Model Range
The new SMB models available are: 1530, 1550, 1570, 1570R. You can learn more about the products on of the CheckPoint portal. Logically, we divide them into three groups: security gateway for offices with WIFI support (1530, 1550), security gateway for offices with WIFI + 4G/LTE support (1570, 1550), and industrial security gateway (1570R).
Series 1530, 1550
The models have 5 network interfaces for the local network and 1 interface for internet access, with a throughput capacity of 1 Gbps. They also feature a USB-C Console. Regarding technical specifications, these models offer a wide range of measurable parameters, but we will focus on the most important ones (in our opinion).
Characteristics
1530
1550
Maximum connections per second
10 500
14 000
Maximum concurrent connections
500 000
500 000
Throughput with Firewall + Threat Prevention (Mbps)
340
450
Throughput with Firewall + IPS (Mbps)
600
800
Firewall throughput (Mbps)
1000
1000
* Threat Prevention includes the following running blades: Firewall, Application Control, and IPS.
Models 1530 and 1550 have a number of functional capabilities:
- Gaia 80.20 Embedded options are listed in CheckPoint
- The Mobile Access license for 100 concurrent connections is included with the purchase of any device. It is important to consider that this is a feature of the SMB NGFW model range, allowing you to save on the separate purchase of Mobile Access licenses, which do not come with devices from other CheckPoint series.
- The ability to manage the security gateway using the Watch Tower mobile application (more details were discussed in our )
For whom is the 1530, 1550 series: this line is suitable for branch offices with up to 100 people, providing remote connections with various administration methods.
Series 1570, 1590
The higher models in the 1500 series feature 8 interfaces for local connections, 1 interface for DMZ, and 1 interface for Internet connection (with a total port capacity of 1 Gbps). Additionally, they include a USB 3.0 Port and a USB-C Console. The models support 4G/LTE modems and come with Micro-SD card support for expanding the device's internal memory.
The technical specifications are presented below:
Characteristics
1570
1590
Maximum connections per second
15 750
21 000
Maximum concurrent connections
500 000
500 000
Throughput with Threat Prevention (Mbps)
500
660
Throughput with Firewall + IPS (Mbps)
970
1300
Firewall throughput (Mbps)
2800
2800
Models 1570 and 1590 offer a range of functionalities:
- Gaia 80.20 Embedded options are listed in .
- Mobile Access license for 200 concurrent connections
is included with the purchase of any of the devices. It's worth noting that this feature of the SMB NGFW series allows you to save on the separate purchase of Mobile Access licenses, which are not included with other series of CheckPoint models. - The ability to manage the security gateway using the Watch Tower mobile application (more details were discussed in our ).
Who is the 1570, 1590 series for?: this lineup is suitable for offices of up to 200 people, provides remote connectivity, and has the highest performance among the SMB family.
For comparison of previous models:
Characteristics
1470
1490
Throughput with Threat Prevention + Firewall (Mbps)
500
550
Throughput with Firewall + IPS (Mbps)
625
800
1570R
The NGFW 1570R CheckPoint deserves special attention. It is designed specifically for the industrial sector and will be of interest to companies operating in areas such as transportation, extraction of natural resources (oil, gas, etc.), and manufacturing.
The 1570R is designed with the features and conditions of its use in mind:
- network perimeter security and monitoring of smart devices;
- support for industrial protocols ICS/SCADA and a GPS connector;
- fault tolerance when operating in extreme conditions (high/low temperatures, precipitation, increased vibration).
Characteristics of NGFW
1570 Rugged
Maximum connections per second
13 500
Maximum concurrent connections
500 000
Throughput with Threat Prevention (Mbps)
400
Throughput with Firewall + IPS (Mbps)
700
Firewall throughput (Mbps)
1900
Operating conditions of application
-40ºC ~ 75ºC (-40ºF ~ +167ºF)
Durability certificates
EN/IEC 60529, IEC 60068-2-27 shock, IEC 60068-2-6 vibration
In addition, we highlight a number of functionalities for the 1570R:
- Gaia 80.20 Embedded options are listed in .
- Mobile Access license for 200 concurrent connections
is included with the purchase of the device. It's worth noting that this feature of the new SMB NGFW lineup allows you to save on the separate purchase of Mobile Access licenses, which are not included with other series of CheckPoint models. - The ability to manage the security gateway using the Watch Tower mobile application (more details were discussed in our )
- Automatic generation of policies/rules for IoT devices upon their connection to your local network. A rule is generated for each smart device, allowing only the protocols necessary for its proper operation.
Management of the 1500 series
Considering the technical specifications and capabilities of the new devices in the SMB family, it is important to note that there are various approaches to their management and administration. The following standard schemes exist:
- Local management.
This is generally used in small businesses where there are multiple offices and centralized control of the infrastructure is absent. Pros include: accessible deployment and administration of the NGFW, ability to interact with devices locally. Cons include limitations related to Gaia's capabilities: lack of rule separation level, limited monitoring tools, and absence of centralized log storage.
- Centralized management via a dedicated Management Server. This approach is applied when the administrator can manage several NGFWs that may be located at different sites. The advantage of this approach is flexibility and control over the overall state of the infrastructure; additionally, some Gaia 80.20 Embedded options are only available under this scheme.
- Centralized management through . This is a new scenario for managing NGFWs from CheckPoint. Your Management Server is deployed in a cloud environment, all management takes place through a web interface, allowing independence from your PC's OS. Additionally, the maintenance of the management server is handled by CheckPoint specialists, its performance directly depends on the chosen parameters and is easily scalable.
- Centralized management through (Security Management Portal). This solution includes the deployment in the cloud or locally of a common web portal capable of simultaneously managing up to 10,000 SMB devices.
- The ability to manage via the mobile device Watch Tower is only available after deploying a full management version (see points 1-4). More details on this feature can be found in our
We note the most important points in our opinion:
- The inability to deploy the Mobile Access Portal. Users will be able to use Remote Access to access the company’s internal resources, but will not have the ability to connect to the SSL portal with your published applications.
- The following blades or options are not supported: Content Awareness, DLP, Updatable Objects, SSL inspection without categorization, Threat Extraction, MTA with Threat Emulation checking, Antivirus for scanning archives, ClusterXL in Load Sharing mode.
In conclusion, it is worth noting that the NGFW solution for SMBs has reached a new level of support and interaction, thanks to the release of version 80.20 Embedded, achieving a balance between the features of the full version of Gaia and the capabilities of hardware for small offices. We plan to continue publishing a series of educational articles where we will discuss the basic setup of SMB solutions, performance tuning, and their new options.
. Stay tuned for updates (, , , , ).
Source: habr.com
