{"id":29991,"date":"2019-10-31T21:33:06","date_gmt":"2019-10-31T18:33:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom\/"},"modified":"2019-10-31T21:33:06","modified_gmt":"2019-10-31T18:33:06","slug":"check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/check-point-chto-eto-s-chem-ego-edyat-ili-korotko-o-glavnom","title":{"rendered":"Check Point. What is it, how does it work, or a brief overview","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Check
\nHello, dear readers of Habr! This is the corporate blog of the company TS Solution<\/a><\/noindex>. We are a systems integrator primarily specializing in IT infrastructure security solutions (Check Point<\/a><\/noindex>, Fortinet<\/a><\/noindex>) and machine data analysis systems (Splunk<\/a><\/noindex>). We'll start our blog with a brief introduction to Check Point technologies.<\/p>\n

We pondered for a long time whether to write this article, as it does not contain anything new that cannot be found online. However, despite the abundance of information, we often hear the same questions from clients and partners. Thus, we decided to provide an introduction to the world of Check Point technologies and explain the essence of their solution architectures. All this will be covered in a 'small' post, a quick excursion, if you will. Moreover, we will try to avoid marketing wars, as we are not a vendor, just a system integrator (though we do love Check Point) and will simply cover the main points without comparing them to other manufacturers (such as Palo Alto, Cisco, Fortinet, etc.). The article turned out to be quite extensive, but it cuts out a lot of questions at the stage of getting acquainted with Check Point. If you are interested, welcome below the fold...
\n<\/a><\/noindex>
\nUTM\/NGFW<\/b><\/p>\n

When starting a discussion about Check Point, the first thing worth mentioning is the explanation of what UTM and NGFW are and how they differ. We will do this quite concisely, so the post doesn\u2019t get too lengthy (perhaps in the future, we will explore this topic in a bit more detail).<\/p>\n

UTM \u2014 Unified Threat Management<\/b><\/p>\n

In short, the essence of UTM is the consolidation of multiple security tools into a single solution. That is, everything in one box or some sort of all-inclusive package. What do we mean by 'multiple security tools'? The most common configuration includes: Firewall, IPS, Proxy (URL filtering), Stream Antivirus, Anti-Spam, VPN, and so on. All of this is integrated within one UTM solution, which simplifies integration, setup, administration, and monitoring, positively impacting the overall security of the network. When UTM solutions first appeared, they were considered exclusively for small companies, as UTM struggled to handle high traffic volumes. This was due to two reasons:<\/p>\n

    \n
  1. Packet processing methods. The first versions of UTM solutions processed packets sequentially, one by one through each 'module.' For example, a packet would first be processed by the firewall, then by IPS, followed by a check from the Antivirus, and so on. Naturally, this mechanism introduced significant delays in traffic and heavily consumed system resources (CPU, memory).<\/li>\n
  2. Weak 'hardware.' As mentioned earlier, sequential packet processing significantly drained resources, and the 'hardware' of that era (1995-2005) simply couldn't handle large traffic.<\/li>\n<\/ol>\n

    \nBut progress does not stand still. Since then, hardware capabilities have greatly increased, and packet processing has evolved (it must be acknowledged, not all vendors kept up) to allow for almost simultaneous analysis across multiple modules (FW, IPS, Antivirus, etc.). Modern UTM solutions can 'digest' tens or even hundreds of gigabits in deep analysis mode, enabling their use in large business segments or even data centers.<\/p>\n

    Below is the famous Gartner Magic Quadrant for UTM solutions as of August 2016:<\/p>\n

    \"Check
    \n
    \nI won\u2019t comment much on this image, just to say that the leaders are in the upper right corner.<\/p>\n

    NGFW \u2014 Next Generation Firewall<\/b><\/p>\n

    The name speaks for itself \u2014 next-generation firewall. This concept emerged significantly later than UTM. The main idea of NGFW is deep packet inspection (DPI) using built-in IPS and application-level access control (Application Control). In this case, IPS is necessary to identify specific applications in the stream of packets, allowing for their permission or prohibition. For example: We can allow Skype to operate but prohibit file transfers. We can block the use of Torrent or RDP. Web applications are also supported: Access to VK.com can be permitted while prohibiting games, messages, or video viewing. Essentially, the quality of NGFW depends on the number of applications it can identify. Many believe that the introduction of NGFW was merely a marketing move that coincided with the rapid growth of Palo Alto.<\/p>\n

    The Gartner Magic Quadrant for NGFW as of May 2016:<\/p>\n

    \"Check
    \n
    \nUTM vs NGFW<\/b><\/p>\n

    A very common question is, what is better? There is no definitive answer, and there may never be. Especially considering that almost all modern UTM solutions contain NGFW functionality and most NGFW have features typical of UTM (Antivirus, VPN, Anti-Bot, etc.). As always, \u201cthe devil is in the details,\u201d so first you need to decide what you specifically need and determine your budget. Based on these decisions, you can choose several options. And everything should definitely be tested, without believing marketing materials.<\/p>\n

    In several articles, we will attempt to discuss Check Point, how you can try it out, and what functionalities are generally available (almost all of them).<\/p>\n

    Three entities of Check Point<\/b><\/p>\n

    When working with Check Point, you will inevitably encounter three components of this product:<\/p>\n

    \"Check
    \n<\/p>\n

      \n
    1. Security Gateway (SG)<\/b> \u2014 the actual security gateway, which is usually placed on the network perimeter and performs functions of a firewall, streaming antivirus, anti-bot, IPS, etc.<\/li>\n
    2. Security Management Server (SMS)<\/b> \u2014 the management server for gateways. Almost all settings on the gateway (SG) are configured through this server. SMS can also act as a log server and process logs with its built-in event analysis and correlation system\u2014Smart Event (similar to SIEM for Check Point), but we will discuss this a bit later. SMS is used for centralized management of multiple gateways (the number of gateways depends on the SMS model or license), but you must use it even if you have only one gateway. It is worth mentioning that Check Point was one of the first to implement such a centralized management system, which has been recognized as the \u201cgold standard\u201d in reports by Gartner for many years. There\u2019s even a joke: \u201cIf Cisco had a proper management system, Check Point would have never appeared.\u201d<\/li>\n
    3. Smart Console<\/b> \u2014 a client console for connecting to the management server (SMS). It is usually installed on the administrator's computer. All changes on the management server are made through this console, and only after that can the settings be applied to the security gateways (Install Policy).\n

      \"Check\n<\/li>\n<\/ol>\n

      \nCheck Point Operating System<\/b><\/p>\n

      Speaking of the Check Point operating system, three versions come to mind: IPSO, SPLAT, and GAIA.<\/p>\n

        \n
      1. IPSO<\/b> \u2014 the operating system from Ipsilon Networks, which belonged to Nokia. In 2009, Check Point acquired this business. It is no longer being developed.<\/li>\n
      2. SPLAT<\/b> \u2014 a proprietary development from Check Point, based on the RedHat kernel. It is no longer being developed.<\/li>\n
      3. Gaia<\/b> \u2014 the current operating system from Check Point, which emerged from the merger of IPSO and SPLAT, incorporating the best features. It was introduced in 2012 and continues to be actively developed.<\/li>\n<\/ol>\n

        \nSpeaking of Gaia, it should be noted that the most widely used version at the moment is R77.30. A relatively recent version R80 has appeared, which differs significantly from the previous one (both in functionality and management). We will dedicate a separate post to their differences. Another important point is that currently the FSTEC certification is only available for version R77.10, and the certification for version R77.30 is in progress.<\/p>\n

        Deployment options (Check Point Appliance, Virtual machine, OpenServer)<\/b><\/p>\n

        There is nothing surprising here; like many vendors, Check Point has several product variations:<\/p>\n

          \n
        1. Appliance<\/b> \u2014 a hardware-software device, i.e., their own \"hardware.\" There are many models that differ in performance, functionality, and form factor (there are options for industrial networks).\n

          \"Check<\/li>\n

        2. Virtual Machine<\/b> \u2014 a Check Point virtual machine with the Gaia OS. Supported hypervisors include ESXi, Hyper-V, KVM. Licensing is based on the number of CPU cores.<\/li>\n
        3. OpenServer<\/b> \u2014 installation of Gaia directly on a server as the primary operating system (commonly referred to as \"Bare metal\"). Only certain \"hardware\" is supported. There are recommendations for this hardware that need to be followed; otherwise, there may be problems with drivers, and technical support may refuse to provide service.<\/li>\n<\/ol>\n

          \nDeployment options (Distributed or Standalone)<\/b><\/p>\n

          We previously discussed what a gateway (SG) and a management server (SMS) are. Now let's explore their deployment options. There are two main methods:<\/p>\n

            \n
          1. Standalone (SG+SMS)<\/b> \u2014 an option where both the gateway and the management server are installed on a single device (or virtual machine).\n

            \"Check
            \n
            \nThis option is suitable when you have only one gateway that is lightly loaded with user traffic. This option is the most economical since there is no need to purchase a management server (SMS). However, under significant load on the gateway, you may experience a 'sluggish' management system. Therefore, before choosing a Standalone solution, it is best to consult or even test this option.<\/p>\n<\/li>\n

          2. Distributed<\/b> \u2014 the management server is installed separately from the gateway.\n

            \"Check
            \n
            \nThe optimal choice in terms of convenience and performance. It is used when it is necessary to manage multiple gateways at once, such as a central one and branch offices. In this case, a management server (SMS) must be purchased, which can also be in the form of an appliance (hardware) or a virtual machine.<\/li>\n<\/ol>\n

            \nAs I mentioned a bit earlier, Check Point has its own SIEM system \u2014 Smart Event. You will only be able to use it in the case of a Distributed installation.<\/p>\n

            Operating modes (Bridge, Routed)<\/b>
            \nThe security gateway (SG) can operate in two main modes:<\/p>\n