The Best Damn Firewall Book Period

Since the Nokia appliance is already hardened, there is very little you need to do to prepare it for firewall installation. You must configure and test networking and DNS and set up the Host Address Assignment through the Voyager GUI, and you might need to upgrade your IPSO and boot manager.

Ensure that you have the following ready before you begin configuring Check Point FireWall-1:

For the most recent FireWall-1/IPSO compatibility matrix, look up Nokia Resolution 11253.

Obtaining Licenses

Check Point licenses have changed (again) with the Next Generation release. This means that you cannot use an old 4.1 license when installing NG. If you have 4.1 licenses, don't worry—you can get your 4.1 cert keys upgraded to NG for no additional charge. In order to obtain licenses, you can either go through your Check Point value-added reseller (VAR) or use the Check Point User Center to license your products at http://usercenter.checkpoint.com.

You have two options when it comes to licensing your firewall modules. You can either have them tied to their individual IP addresses (external interface recommended), as with previous versions, or you can tie them all to the management station's IP address. These licenses are called local or central, respectively. In NG, the SecureUpdate management tool can be used to maintain all licenses on the management console.

The management module itself must have a local license based on its own IP address. The nice thing about using central licenses for the enforcement modules is that you can change their IP addresses without needing to replace the license, and you can easily move a license from one module to another.

It is always best to obtain your licenses before you install the firewall software. The program will ask you for your license details during the configuration procedure. If you cannot obtain your permanent license prior to the install, you should ask for an evaluation license. Check Point's eval licenses have full functionality for almost all VPN-1/FireWall-1 features. They are usually valid for one month, and the product is not crippled in any way while running on eval.

Configuring Your Host Name

If you followed the instructions for initial configuration of your Nokia Security Platform, you should already have your host name configured for FireWall-1. If, however, you have jumped to this chapter, you need to know that your VPN-1/FireWall-1 configuration requires that you have your host name mapped to your external IP address in the Host Address Assignment configuration screen, which you can access from the Voyager main Configuration screen under the System Configuration section. If this function is not configured ahead of time, your license installation will fail.

To add a new host name, enter either the fully qualified domain name (FQDN) or the simple hostname in the field Add new hostname. We are using the name gatekeeper, which was the name assigned to this Nokia during initial system configuration. Next, click Apply, and then type in the IP address associated with gatekeeper. This should be the IP address that you will use if licensing the FireWall-1 product on your Nokia as well, and it is typically the external IP address of the firewall. Click Apply again and then click Save to complete the host address assignment. See Figure 18.1 for the completed configuration.

Figure 18.1: Host Address Assignment

Understanding FireWall-1 Options

The following Check Point Next Generation packages are available:

The VPN-1/FireWall-1 component options are:

After the Check Point cpconfig utility sets up the type of installation you have chosen, it will run through a number of configuration screens. The screens that you can prepare for in advance are:

Related

Категории