Check Point Firewall-1aA A is the world's leading firewall - but it's extremely difficult to find in-depth, independent guidance on using it effectively. In this book, the maintainer of the world's leading Firewall-1aA A FAQ brings together comprehensive, expert guidance on every aspect of working with Firewall-1aA A : planning, configuration, deployment, administration, tuning, and troubleshooting. In this book, Daemon Welch draws upon his extensive hands-on experience in teaching and implementing Firewall-1aA A in a wide variety of corporate environments. He begins with a practical overview of firewall security, and what a firewall can and can't do. Welch covers planning your Firewall-1aA A installation, building your "rulebase," configuring Firewall-1, logging and alerting, remote management, authentication and passwords, content security, network address translation (NAT), encryption, high availability, performance tuning, and much more. The book contains detailed coverage of VPNs, including client-to-firewall VPNs, the VPN-1 SecuRemote Secure Virtual Network Architecture, secure clients, and VPN troubleshooting.Along the way, Welch provides practical rules and checklists that can't be found anywhere else.
For all computer security specialists, network/Web professionals, and system administrators, and for super-power users responsible for protecting computer systems against intrusion.
Sprache
Verlagsort
Verlagsgruppe
Zielgruppe
Für höhere Schule und Studium
Maße
Höhe: 235 mm
Breite: 186 mm
Dicke: 23 mm
Gewicht
ISBN-13
978-0-201-69950-0 (9780201699500)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Klassifikation
Dameon D. Welch-Abernathy, a.k.a. "PhoneBoy," has been supporting, deploying, and teaching Check Point (TM) FireWall-1 (R) since 1996. He has assisted and instructed thousands of network professionals and currently maintains the largest industry FAQ site on FireWall-1 (R) NG at http://blog.phoneboy.com/. Dameon works for Product Line Support at Nokia.
0201699508AB10212003
Foreword.
Preface.
1. Introduction to FireWalls.
What is a Firewall?
What a Firewall Cannot Do.
Overview of Firewall Security Technologies.
Packet Filters.
Application Proxies.
Stateful Inspection.
Technology Comparison: Passive FTP.
Technology Comparison: Traceroute.
What Kind of Firewall is FireWall-1?
Do You Really Need FireWall-1?
More Information.
2. Planning your FireWall Installation.
Network Topology.
A Word about Subnetting.
Developing a Site-Wide Security Policy.
The What, Who, and How.
Implementing Firewalls Without a Written Security Policy.
An Example Security Policy.
Fun with Check Point Licensing.
Node-Limited Firewall Licenses.
Single Gateway Products.
Inspection Module.
FireWall-1 Host.
Management Console.
Motif GUI Licenses.
Small Office Products.
Getting Licenses.
Summary.
3. Installing FireWall-1.
Selecting an Operating System.
Windows NT.
Sparc Solaris.
x86 Solaris.
AIX and HPUX.
Nokia Security Platform (IPSO).
Linux.
Installing the Operating System.
Preparing for the OS Installation.
Guidelines for OS Installation.
Securing the Operating System.
Installing FireWall-1.
Unix-Based Systems.
Windows NT/2000.
Summary.
4. Building Your Rulebase.
The Management GUIs.
Configuring a Management User.
Configuring IPs to run the GUIs from.
What Files the GUI Modifies.
Security Policy Editor Restrictions.
GUI Demonstration Mode.
Rulebase Components.@AHEADS = Objects.
Anti-Spoofing.
Policy Properties.
Rules.
Order of Operations.
Making Your First Rulebase.
Knowing Your Network.
Defining Your Objects.
Determining Your Policy.
Rules That Should Be In Every Rulebase.
Installing the Policy.
Frequently Asked Questions.
5. Logging and Alerting.
The System Status Viewer.
The Log Viewer.
Viewing Logs from the Command Line.
Active Mode and Blocking Connections.
Alerts.
Messages in the Log.
Log Maintenance.
6. Remote Management.
The Components.
The Management GUIS.
Configuring a User.
Configuring IPs to run from.
What Files the GUIs Modify.
Security Policy Editor Restrictions.
GUI Demonstration Mode.
The Management Console to Firewall Module Connection.
control.map file.
How Do the Different Authentication Schemes Work?
The fw putkey Command.
Establishing an Authenticated Control Connection.
Special Remote Management Conditions.
What Can You DO With Remote Management.
Control Policy on Firewall Module.
View State Tables of Firewall Modules.
Suspicious Activity Monitoring.
Updating Licenses.
Moving Management Consoles.
Moving a Firewall Module off the Management Console.
Moving the Management Console off a Firewall Module.
Troubleshooting Remote Management Issues.
GUI Issues.
Firewall/Management Module Issues.
Labs.
7. Authentication.
Passwords.
FireWall-1 Password.
OS Password.
S/Key.
SecurID.
Axent Pathways Defender.
RADIUS.
TACACS / TACACS+.
LDAP.
How Users Authenticate.
User Authentication.
Session Authentication.
Client Authentication.
Which Type Should You Choose?
Setting Up Authentication.
Creating Users.
Setting Supported Authentication Schemes.
User Authentication.
Session Authentication.
Client Authentication.
Integrating External Authentication Servers.
FAQs.
Troubleshooting Authentication Issues.
8. Content Security.
The Security Servers.@AHEADS = A Word About Licensing.
CVP and UFP.
Resources and Wildcards.
HTTP Security Server.
Filtering HTTP Without a UFP or CVP Server.
UFP with the HTTP Security Server.
CVP with the HTTP Security Server.
FTP Security Server.
SMTP Security Server.@AHEADS = $FWDIR/conf/smtp.conf.
SMTP Resources.
TCP Security Server.
Frequently Asked Questions.
General Security ServerQuestions.
FTP Security Server.
SMTP Security Server.
HTTP Security Server.
Performance Tuning for the Security Servers.
Troubleshooting Content Security Issues.
9. Network Address Translation.
Introduction.
RFC-1918.
How NAT Works in FireWall-1.
Order of Operations.
Implementing NAT: A Step-by-Step Example.
Determine which IP addresses will be used.
Proxy ARPs.
Static Host Routes.
Network Objects.
Anti-Spoofing.
Security Policy Rules.
Address Translation Rules.
Limitations of NAT.
Dual NAT.
Binding the NATted IP Address to the Loopback Interface.
Troubleshooting.
ARPs.
SYN Packets with No Response.
SYN Followed by RST.
Summary.
10. Encryption (Site-to-Site VPNs).
Introduction to VPNs.
Concepts.
Encryption.
Encryption Key.
Symmetric Encryption.
Asymmetric Encryption.
Certificate Authority.
Diffe-Hellman.
Encryption Domain..
A Word About Licensing.
Supported Key Management and Encryption Schemes.@AHEADS = FWZ.
IPSec.
Manual IPSec.
SKIP.
IKE (ISAKMP/OAKLEY).
How to Configure Encryption.@AHEADS = Planning Your Deployment.
IKE.
Manual IPSEC.
SKIP and FWZ.
Gateway Clusters and High Availability VPNs.
FAQs.
Troubleshooting VPN Problems.
Summary.
Labs.
Q and A.
11. SecuRemote and Secure Client (Client to FireWall-1 VPNs).
Introduction.
A Word About Licensing.
Steps to Configure SecuRemote on FireWall-1.
Choosing an Encryption Scheme.
Configuring Firewall Object for SecuRemote.
Creating Users for use with SecuRemote.
Client Encryption Rules.
Desktop Security Options.
Installing Secure Client.
High Availability and Multiple-Entry Point Configurations.
Hybrid Authentication Mode for IKE.
FAQs.
Troubleshooting.
12. High Availability.
What is High Availability.
State Synchronization.
HA Solutions.
Stonebeat.
Rainfinity.
Nokia.
Check Point's HA Module.
Issues with High Availability.
Licensing.
Managing Multiple Firewalls.
Load Balancing.
Asymmetric Routing.
13. Inspect.
What is INSPECT?
Basic INSPECT Syntax.
Conditions.
Constants.
Registers.
Manipulating Table Entries.
Creating Your Own Tables.
How Your Rulebase is Turned into INSPECT.
Services of Type Other.
Sample INSPECT Code.
Allowing Outbound Connections to a SecuRemote Client.
PPTP.
Allowing a Connection Based on a Previous Connection.
HTTP.
Ping and Traceroute.
Default filter.
fw monitor.
Appendix A: Securing Your Bastion Host.
Appendix B: firewall-1.conf File for Use with OpenLDAP v1.
Appendix C: firewall1.schema File for Use with OpenLDAP v2.
Appendix D: Complete Program for Stateful Inspection of HTTP.
Appendix E: Complete Program for Stateful Inspection of Ping and Traceroute.
Appendix F: NSPECT Script for Different Policies on Different Interfaces.
Appendix G: Sample defaultfilter.pf file.
Appendix H: Sample Internet Usage Policy.
Appendix I: Performance Tuning.
Appendix J: Other Resources.
Appendix K: Further Reading.
Index. 0201699508T05222001
