Add Check Point devices

Relevant for: AFA Administrators

This topic describes how to add Check Point MDSM, SmartCenter / Gateway, or CMA devices, as well as fields and options shared by all of these device types.

In this topic:

Check Point network connections

The following diagrams shows an ASMS Central Manager or Remote Agent connecting to a Check Point MDSM, CMA, or Smart Center device, and a Check Point Gateway. Check Point versions R80 or higher have an additional connection via HTTP-REST.

Back to top

Check Point device permissions

AFA can collect data or logs via SSH or OPSEC. For Check Point versions R80 and higher, you must also define data collection via REST.

ASMS requires the following permissions for each type of connection to your Check Point devices:

Back to top

Add a Check Point Multi-Domain Security Management device

Check Point Multi-Domain Security Management (MDSM) integrates multiple 'firewalled' networks within a single administrative framework. These devices consolidate multiple SmartCenter Servers, referred to as Customer Management Add-ons (CMAs), on a single host.

AFA analyzes the Filter Module security policy via a secure connection to the MDSM server.

Do the following:

1. Access the DEVICES SETUP page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Check Point > Multi Domain Security Management (Provider-1).

   Configure the fields and options on the page as needed. For details, see Check Point fields and options.

   Note: If you select to enable ActiveChange, the ActiveChange License Agreement appears. Select the I agree checkbox, and then click OK.

3. Click Next.

   The fields on the Check Point - Multi-Domain Security Management (Provider-1) - Step 2/3 page differ, depending on whether you selected to connect to the device via SSH or OPSEC.

4. Do one of the following:

   OPSEC	Recommended. Enter the IP address of the CMA that manages the devices you wish to analyze.
   SSH	Select the CMA that manages the devices you wish to analyze by clicking the relevant row.

5. Click Next.

   The Check Point - Multi-Domain Security Management (Provider-1) - Step 3/3 page appears.

   This page displays a table listing all the devices that are managed by the Check Point MDSM, including standalone devices and virtual systems.

6. Optional: Configure AFA to use logs created by a managed device or virtual system.

   Tip: This enables AFA to detect certain policy optimization information, such as unused rules. For more details, see Device report pages.

   Do the following:

   1. In the Add Device column, select the check box next to the device's name.

   2. In the Log Analysis column, select one of the following:

      • None. Disables logging.

      • Standard. Enables logging.

      • Extensive. Enables logging and the Intelligent Policy Tuner. For more details, see Intelligent Policy Tuner.

   3. In the Log Server column, click Settings. Then, do one of the following:

      • Select the log server you want to use from the drop-down list.
      • Select Other and enter the log server's name manually.

      Click OK when you're done.

   4. SSH only: To edit SSH definitions, Edit SSH definitions.

      

      In the Check Point Log Server SSH Setup dialog, do the following:

      • Specify whether this log server is part of a Multi-domain log module (MLM/CLM) or a Stand-alone log server.

      • Populate the fields as needed. For details, see Log Server fields.

   5. OPSEC only: To test OPSEC connectivity to the defined log server, click Test OPSEC connectivity.

      A message informs you whether AFA connected to the log server successfully.

   6. Click OK.

   Close ⌃
7. Optional: Enable AFA to generate baseline compliance reports and/or allow dynamic routing collection for all managed devices

   Do the following:

   1. In the Direct access to managed devices area, click .

   2. The Direct Access Configuration dialog box appears.

      

   3. Complete the fields as needed. For details, see Baseline Configuration Compliance fields

      Note: Specifying this information for a device triggers a direct SSH connection to the device.

   4. Click OK.

   Close ⌃

8. Complete the remaining fields as needed. For details, see Additional Check Point options.

9. Click Finish.

   The new device is added to the device tree.

Set user permissions

If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account. To select multiple users, press the CTRL button while selecting.

Click OK to close the dialog.

Back to top

Add a Check Point SmartCenter/Gateway

Check Point products are based on a distributed architecture, where a typical Check Point deployment is composed of a Filter Module or device and the SmartCenter Server.

• A standalone deployment is the simplest deployment where the SmartCenter Server and the Filter Module are installed on the same machine.
• A distributed deployment is a more complex deployment where the Filter Module and the SmartCenter Server are deployed on different machines.

AFA provides an analysis of the Filter Module's security policy via a secure connection to the SmartCenter server.

Do the following:

1. Access the DEVICES SETUP page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Check Point > Security Management (SmartCenter).

   Configure the fields and options on the page as needed. For details, see Check Point fields and options.

   Note: If you select to enable ActiveChange, the ActiveChange License Agreement appears. Select the I agree checkbox, and then click OK.

3. Click Next.

   The Check Point - Security Management (SmartCenter) - Step 2/2 page appears, displaying a table that lists all the devices that are managed by the Check Point SmartCenter/Gateway, including standalone devices and virtual systems.

4. Optional: Configure AFA to use logs created by a managed device or virtual system.

   Tip: This enables AFA to detect certain policy optimization information, such as unused rules. For more details, see Device report pages.

   Do the following:

   1. In the Add Device column, select the check box next to the device's name.

   2. In the Log Analysis column, select one of the following:

      • None. Disables logging.

      • Standard. Enables logging.

      • Extensive. Enables logging and the Intelligent Policy Tuner. For more details, see Intelligent Policy Tuner.

   3. In the Log Server column, click Settings. Then, do one of the following:

      • Select the log server you want to use from the drop-down list.
      • Select Other and enter the log server's name manually.

      Click OK when you're done.

   4. SSH only: To edit SSH definitions, Edit SSH definitions.

      

      In the Check Point Log Server SSH Setup dialog, do the following:

      • Specify whether this log server is part of a Multi-domain log module (MLM/CLM) or a Stand-alone log server.

      • Populate the fields as needed. For details, see Log Server fields.

   5. OPSEC only: To test OPSEC connectivity to the defined log server, click Test OPSEC connectivity.

      A message informs you whether AFA connected to the log server successfully.

   6. Click OK.

   Close ⌃
5. Optional: Enable generation of baseline compliance reports and/or allow dynamic routing collection for all managed devices.

   To do so, in the Direct access to managed devices area, click Configure.

   The Direct Access Configuration dialog box appears.

   

   Complete the fields as needed, and click OK. For details, see Baseline Configuration Compliance fields.

   Note: Specifying this information for a device triggers a direct SSH connection to the device.

   Close ⌃

6. Complete the remaining fields using the information in Check Point Options Fields (see Additional Check Point options).

7. Click Finish.

   The new device is added to the device tree.

Set user permissions

If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account. To select multiple users, press the CTRL button while selecting.

Click OK to close the dialog.

Back to top

Add a Check Point CMA

You can add single Customer Management Add-ons (CMAs) using the following procedure.

Do the following:

1. Access the DEVICES SETUP page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, select Check Point > Single CMA.

   Configure the fields and options on the page as needed. For details, see Check Point fields and options.

   Note: If you select to enable ActiveChange, the ActiveChange License Agreement appears. Select the I agree checkbox, and then click OK.

3. Click Next.

   The Check Point - Single CMA - Step 2/2 page appears, displaying a table that lists all the devices that are managed by the Check Point CMA, including standalone devices and virtual systems.

4. Optional: Configure AFA to use logs created by a managed device or virtual system.

   Tip: This enables AFA to detect certain policy optimization information, such as unused rules. For more details, see Device report pages.

   Do the following:

   1. In the Add Device column, select the check box next to the device's name.

   2. In the Log Analysis column, select one of the following:

      • None. Disables logging.

      • Standard. Enables logging.

      • Extensive. Enables logging and the Intelligent Policy Tuner. For more details, see Intelligent Policy Tuner.

   3. In the Log Server column, click Settings. Then, do one of the following:

      • Select the log server you want to use from the drop-down list.
      • Select Other and enter the log server's name manually.

      Click OK when you're done.

   4. SSH only: To edit SSH definitions, Edit SSH definitions.

      

      In the Check Point Log Server SSH Setup dialog, do the following:

      • Specify whether this log server is part of a Multi-domain log module (MLM/CLM) or a Stand-alone log server.

      • Populate the fields as needed. For details, see Log Server fields.

   5. OPSEC only: To test OPSEC connectivity to the defined log server, click Test OPSEC connectivity.

      A message informs you whether AFA connected to the log server successfully.

   6. Click OK.

   Close ⌃
5. Optional: Enable generation of baseline compliance reports and/or allow dynamic routing collection for all managed devices.

   To do so, in the Direct access to managed devices area, click Configure.

   The Direct Access Configuration dialog box appears.

   

   Complete the fields as needed, and click OK. For details, see Baseline Configuration Compliance fields.

   Note: Specifying this information for a device triggers a direct SSH connection to the device.

   Close ⌃
6. Complete the remaining fields using the information in Check Point Options Fields (see Additional Check Point options).
7. Click Finish. The new device is added to the device tree.

8. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Check Point fields and options

Check Point devices include the following types of fields and options:

Back to top

Configure one-armed mode manually

AFA automatically identifies Check Point CloudGuard devices in one-armed mode, when the device has a single interface. If your device has multiple interfaces and one-armed mode is not identified automatically, configure this for your device manually.

Do the following:

1. On the AFA machine, access your device configuration meta file as follows:

   /home/afa/.fa/firewalls/<device_name>/fwa.meta

   where <device_name> is the name of the device listed. If you device is listed multiple times, enter the longer name.

2. On a new line, enter:

   is_steering_device=yes

3. Run an analysis on the device to update the device data in AFA.

Back to top