Forwarding Checkpoint Management Server Firewall logs to an external syslog server STRM/Qradar SIEM

There are two ways to integrate STRM with Check Point Firewalls devices.

1. Using Syslog

On Check Point management station, you can follow these steps to redirect firewall logs and audit logs to the external syslog server:

a) Vi /etc/syslog.conf, on the management station, and add the following line at the end of the file:

local5.info @hostname

such as :

          local5.info @10.94.20.23

where ‘10.94.20.23’ is the IP of the syslog server (Juniper STRM).

b) if your management server is SecurePlatform - Execute ‘service syslog restart’.

c) Add this command to /etc/rc.d/init.d/cpboot:

fw log -ftnl | logger -p local5.info -t Firewall &

or 

forward audit log to external syslog server by add following command:

fw log -ftnl $FWDIR/fw.adtlog | awk 'NF' | logger -p local5.info -t Firewall_Audit &

d) reboot Checkpoint management server and configure a new log source in STRM. Deploy Changes to STRM as well. 

e) Verify:

tcpdump host 10.94.20.23

[Expert@CP-Mgmt]# tcpdump host 10.94.20.23
tcpdump: listening on Mgmt
12:54:18.534293 CP-Management.syslog > 10.94.20.23.syslog: udp 253 (DF)
12:54:18.538859 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:18.539622 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:18.540382 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:18.541115 CP-Management.syslog > 10.94.20.23.syslog: udp 252 (DF)
12:54:18.541904 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:20.536629 CP-Management.syslog > 10.94.20.23.syslog: udp 280 (DF)
12:54:20.538424 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:20.539194 CP-Management.syslog > 10.94.20.23.syslog: udp 228 (DF)
12:54:20.540009 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:22.539075 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:22.543184 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:28.540703 CP-Management.syslog > 10.94.20.23.syslog: udp 249 (DF)
12:54:28.543712 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)
12:54:28.544410 CP-Management.syslog > 10.94.20.23.syslog: udp 225 (DF)
12:54:28.545036 CP-Management.syslog > 10.94.20.23.syslog: udp 16 (DF)

On STRM server 10.94.20.23, you should be able to see following logs activities:

2. Using OPSEC / LEA

a. Creating an OPSEC Application Object from Servers and OPSEC tab:

In my lab, STRM_10.94.200.23 created.

Note: Communication Initialized but trust not established, it is still fine to do firewall policy push. The communication will be established by itself after STRM configuration part done.

b. Write Down and Copy Two SIC DN info for STRM configuration

One is from new created OPSEC application: STRM_10.94.200.23
CN=STRM_10.94.200.23,O=CP-Management..wtx8w4

Another is from Mgmt Server CP_Management as show below:

cn=cp_mgmt,o=CP-Management..wtx8w4

c. STRM Log Source

 d. add a new Checkpoint Firewall-1 OPSEC / LEA log Source

e. Verify SIC Connection from Checkpoint Mgmt Server OPSEC Application STRM_10.94.200.23

Reference:

1.  Juniper STRM Configuring DSMs
2.  How to send FireWall logs from Gaia-based Security Management Server to an external Syslog server
3.  Forward Logs from Checkpoint SmartCenter Management Server and Juniper NSM / IDP to Syslog Server

Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)

This is the third part of Checkpoint SSL VPN Series LAB.
Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)

In this part, it will introduce how to use Checkpoint Internal CA issued Certs and how to enable two factor authentication using certs and AD accounts.

In Part 2, AD authentication has been tested and next step is to create certificate for each remote user.

Enable Certificate Authentication Steps:

1. Create Certificate for user test2.

2. Click OK after enter all information for Certificate File.

3. Once certificate created, it will show in the list. It also can be revoked.

4. Import Certificate into Client Machine

Double click the cert file from Client Machine. It will enable Certificate Import Wizard. Enter your password, click next and next then it will be completed this import.

5. Change authentication method to from Username and Password to Personal Certificate on the Gateway Properties:

6. After installed polices to gateway, test it from Client Machine with your imported Personal Certificate:

Enable two factor authentication (Certs and AD account) Steps

1. Certificate will be the first method and AD username/password will be second factor. 

Here is the list Supported Authentication Schemes Combinations:

2. GuiDBedit Tool 

It will be used to configure Multiple Authentication Schemes to allow the administrator to request multiple proofs of user's identity. In our case, for example, request the user to install his certificate and enter his AD password for authenticating.

GuiDBedit Tool will be found at C:\Program Files (x86)\CheckPoint\SmartConsole\RXX\PROGRAM\GuiDBedit.exe

3. Verify the first factor authentication is Certificates.

It will be found at Tables -> Network Objects ->network_objects.
Found the Gateway / Cluster object, in this case , for example, it is R77.
From lower pane, check the value of realms_for blades-> ssl_vpn ->authentication-> auth_schemes->Element Index 0 -> auth_scheme.
It is certificate which is configured before thorough Smart Dashboard.

4. right click on 'auth_schemes' ,-> 'Add...'

5. Enter a value for Index:  

1 for the second authentication scheme. 0 is already there for 1st factor, which is 'Element Index 0'

6. Go to 'Element Index 1', right click on 'auth_scheme' -> 'Edit...'. Choose 'user_pass' for AD username and password as 2nd factor.

7. Save the changes ('File' menu - 'Save All').  

Close the GuiDBedit Tool. Connect to Security Management Server with SmartDashboard. Install the policy onto Security Gateway / Cluster object.

8. Test

Reference:

1. Multiple Authentication Schemes for Mobile Access

Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)

Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)

In previous lab Part 1 "Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)", it shows the first part how to enable Checkpoint SSL VPN with local user authentication and how to add a native application. In this second part of lab, it will show the integration with Active Directory accounts for remote ssl vpn access.

Topology: 

Steps:

1. Enable Identity Awareness Blade in Check Point gateway properties to start Identity Awareness Configuration wizard:

 2. Choose AD Query at Methods for Acquiring Identity window.

 3. Add new Active Directory

 4. Finish the configuration wizard

 5. Add AD Group into Mobile Access Policy as show in the rule No. 2.

6. Use AD account 'test' to do test 

After log in, it only shows Native Application Section to connect. If account is not defined in the any mobile access rule, the login window will show "User is unauthorized" although there is account in the AD.

Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)

Part 1: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 1 (Local User Authentication)
Part 2: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 2 (AD Authentication)
Part 3: Enable Checkpoint SSL VPN Remote Access: Step by Step Instruction Part 3 (Certs and Two Factor Authentication)
Part 4: Enable Checkpoint SSL VPN Remote Access: Step by Step Part 4 - Two Factor Authentication  (AD and SMS)

Check Point has a Mobile Access Blade to provide the SSL VPN featured solution to remote users. In this lab, it will show the step by step instruction with captured screenshots how to enable Checkpoint Remote SSL VPN with Checkpoint Local User Authentication.

Check Point has a number of different remote access solutions to use in different situations. the following table has a quick view on the difference of them.

Remote Access Solution Comparison:

Topology:

Steps to enable Mobile Blade with local Checkpoint user authentication:

1. Check the Mobile Blade from Gateway Properties:

2. Customize your portal URL and Import Certs. 
By default, the portal will use Checkpoint Self-signed certificate which will cause your browser warning message.

3. Customize Your Remote Access Applications:

4. Skip the Active Directory Integration.
Local Account will be used in this Part 1. Later certificate and two factor authentication will be added into part 2, part 3 and part 4.

5. Test your customized web application

6. Create Local Test User

7. Finished the activation of Moile Access Blade.

8. Gateway Properties and Mobile Access Policy

 

9. Log into Mobile Access Portal:

10. Test the custom web application

Add a new native application - RDP:

1. New -> Native Application:

2. Choose the predefined host and service

 3. Take a look at policy rules and application properties:

4. Web Portal for Native Applications:

5. Click Connect button you will get some prompted windows such as following:

 There is SSL Network Extender Agent will be installed on the first time connection:

6 After Connected