Check Point GO Secure Portable Workspace- Run un-approved Program in Virtual Desktop

Checkpoint has nice starting tutorial page for GO stick user. I had a chance to play with it and found one interesting thing to run some un-approved application  in the Checkpoint GO Secure Portable Workspace.

With USB Checkpoint GO Stick, user got a chance to launch Check Point GO Virtual desktop. Based on Page 9 at CP_GO_UserGuide.PDF,
"only a limited number of pre-approved applications are allowed to run. By default, the virtual desktop does not allow you to:

• Print
• Customize the desktop
• Perform any system configuration

If you need this kind of functionality, or another program added to the list of approved applications, contact
your system administrator.
"
After double clicked the GO.exe file from the GO usb stick, you will get a password window to launch GO Desktop.

You can log into Secure Workspace or Folder Mode.







In Advanced button, you can get more information regarding this Check Point GO Stick such as serial no, firmware version. Also change the password on the stick.

Later after you launched GO desktop, you can switch it back to host , or from host switch to GO desktop by right click GO icon at the task bar.



After GO.exe verified your password, GO desktop will show in the screen to replace your original desktop. It looks like windows remote desktop.

On the right bottom, there is remote vpn client for securely accessing resources on the corporate enterprise. After you right clicked icon, choose connect. Your pre-defined remote gateway will be connected and build remote vpn with it from your current Secure Desktop.

One interesting thing I found is to it is possible to run host application which is not approved by security policy. I did see a putty program icon on the virtual desktop. By right click it and click Properties, you will get application properties window. There is find target button and once you clicked it, a host system32 folder will be brought up. Then you could browse to other folder and run other applications on the host.

Why is it happening? I will continue working on to figure it out.

Install / Upgrade Checkpoint Full HA (Gateway and Management) on Check Point Appliances

Checkpoint Support KB SK60443 shows a document regarding How to install Full HA cluster on Check Point Appliances.

Here I will use my LAB to present all steps with more screenshots. First two steps are mostly coming from SK60443 document.

Topologies

1. Initial Connection 

• Connect a crossover cable from a PC workstation t o the Internal NIC of the Appliance.
• Set the IP of the workstation at: 192.168.1.x / 24. use any IP except ".1", which is the default for the Checkpoint appliance.
• Open a web browser and connect to https://192.168.1.1:4434
• If you have a pop up blocker, you’ll need to disable it or add an exception for 192.168.1.1.
• If presented with a dialog similar to the following, choose the option to "Continue to this website...":
• Log in with the default account information: user admin, password admin .
• Follow the prompts to change the default password.

2. First Time Configuration Wizard on Primary Firewall

• Follow the prompts to work through the First Time Configuration Wizard. Review the Welcome screen, and click Next
• Set the Date and Time manually or configure an NTP server, then click Apply, then click Next
• Remember to set the Time and Time Zone accurately.
• Configure your network connections: Click on an interface name to set the IP address, netmask, and Link Speed/Duplex properties for that interface: When set, click Apply , which returns you to the previous screen. Repeat for each NIC, then click Next
• Configure your routing table.Click New , enter the route, and click Apply , which returns you to the previous screen. When all routes are entered, click Next
• Enter the firewall’s host name, domain name, and DNS servers, then click Next
• Configure the management type. For both Primary and Secondary firewalls, choose "Locally Managed"

• Configure clustering. Mark the checkbox to indicate the appliance is part of a cluster, and then select theappropriate optionbutton indicating if it is the primary or secondary member:

• Configure allowed SSH and GUI client IP addresses, then click Next
• If needed, click Start Download to download the SmartConsole application to the workstation, then click Next
• The wizard presents a summary of the installation and offers the options to go back to make any changes, quit, or finish the configuration wizard. If there are any changes necessary, use Back/Next to navigate to the page where you need to make the change, and return to the summary screen. Once all parameters are correct, click Finish

3. First Time Configuration Wizard Secondary Firewall

• Only difference from Primary Firewall is to choose secondary cluster member when configuring UTM-1 Cluster:

4. Configuring the Cluster in SmartDashboard

• Log in to SmartDashboard, approve the First Time Fingerprint Verification. The UTM-1 Cluster Wizardwill run, presenting an introductory page. Click Next

• Provide a name for the cluster object, then click Next

• Provide the information requested about the secondary cluster member: this includes the Activation Key recorded when installing the secondary cluster member.Click Next

.

•  Configure Sync Interface

 

• Configure Internal Interface

•  Configure External Interface

•  Finish the Cluster configuration in the Smartdashboard. Check property of Cluster object.

5. Completing the Procedure

•  Click Management High Availability from Policy Menu

• 'No Peers' Error came up. 

•  No Server shows in the status window because of no policy installed.

•  Push Firewall Policy to the cluster with a minimum two rules policy. 

 Right away to check Management High Availability again, you will see synchronization is in progress.

• Wait Probably 5 minutes, Click Management High Availability you will see both server are showing in the status window which CP-1 is Primary Management Server and Active Secure Gateway. CP-2 is Secondary Management Server and Standby Secure Gateway.

6. Verifying

• Log into CP-2 Secondary Management Server. In my test LAB, CP-1 is using 192.168.2.41. CP-2 is with 192.168.2.42.

• After password verified, Secondary Server Login window pops up to ask you if Change to active or Login as Read Only.

• Click Change to Active button then you will be able to log into SmartConsole. Check status again you will find CP-2 is secondary Management Server but now it is active. Management failover is successful.

------------------------------------------------------------------------------------------------------------

Regarding how to upgrade Gaia Full HA Checkpoint Implementation, the steps are listed at CP_R77_Gaia_Installation_and_Upgrade_Guide.pdf. It is at Page 75 Upgrading Standalone Full High Availability.

I am summarizing them in the following:

1. Backup

• Snapshot
• Backup
• Export DB
• Show configuration

2. Mostly Upgrading with Minimal Downtime method will be used.

• Make sure the primary cluster member is active and the secondary is standby: check the status of the members.
• Start failover to the second cluster member.
  The secondary cluster member processes all the traffic.
• Log in with SmartDashboard to the management server of the secondary cluster member.Click Change to Active.
• Configure the secondary cluster member to be the active management server.
  Note - We recommend to export the database using the Upgrade tools (on page 65).
• Upgrade the primary cluster member to the appropriate version.
• Log in with SmartDashboard to the management server of the primary cluster member.
  Make sure version of the SmartDashboard is the same as the server.
• Upgrade the version of the object to the new version.
• Install the policy on the cluster object.
  The primary cluster member processes all the traffic.
  Note - Make sure that the For Gateway Clusters install on all the members option is cleared. Selecting this option causes the installation to fail.
• Upgrade the secondary cluster member to the appropriate version.
• Synchronize for management High Availability.

Export Checkpoint Firewall Policy to HTML/XML/Excel and Checkpoint Management Portal using cpdb2web tool

I was looking for a tool to export Checkpoint Management Server database to a readable format in Excel or Html format. Checkpoint already has a great tool and KB to present a solution for this purpose:

"sk64501:Exporting Check Point configuration from Security Management Server into readable format using Web Visualization Tool"

1. Installation the Web Visualization Tool cpdb2html

Download it from the link.
Extract the file cpdb2web_B983000003_1.tgz into a folder. You will get these files in the folder:

2. Command line

C:\Tools\cpdb2web_B983000003_1>cpdb2html.bat ?Check Point Web Visualization Tool
Usage: cpdb2html cpdb2html_path output_directory security_management (admin_name
 or certificate_file) password [-o output_file_name] [-m gateway] [-gr] [-go]
Where:
cpdb2html_path      - Web Visualization Tool's root directory.
output_directory    - Path to place the result html file.
security_management - Name or IP address of the Security Management.
                      (for Multi-Domain Security Management the IP associated
                      with a Domain).
admin_name /
certificate_file    - User name of a Security Management administrator, or full
                      path of a certificate file.
password            - Administrator's password, or certificate's password.
-o output_file_name - HTML output file name to use
                      (default file name is '1.html').
-m gateway_name     - A specific gateway for which to generate the policy.
-gr                 - For Check Point Multi-Domain Security Management only.
                      When the -gr option is set the output will include
                      customer rules only (no global rules).
-go                 - For Check Point Multi-Domain Security Management only.
                      When the -go option is set the output will include
                      customer objects only (no global objects).

C:\Tools\cpdb2web_B983000003_1>cpdb2html.bat c:\tools\cpdb2web_B983000003_1 c:\tools\output 192.168.2.37 admin Password1234
CUR_PATH = c:\tools\cpdb2web_B983000003_1
TARGET_DIR = c:\tools\outputHOST = 192.168.2.37
USERNAME = adminPASSWORD = Password1234
TEMP_DIR = "c:\tools\output\temp"
XSLDIR = c:\tools\cpdb2web_B983000003_1\xsl
XSLFILE = stripped_html.xsl
BASE_XML_FILE = stripped_html.xml
OUTPUT_FILE = 1.html
POLICY_NAME = standard
Connected to Security Management version 9.9.0.
Querying tables...
Processing table Communities ...FinishedProcessing table FireWall Policies ...FinishedProcessing table Network Objects ...FinishedProcessing table Services ...FinishedProcessing table Users and Administrators ...Finished
0 1 file(s) copied. 1 file(s) copied.C:\Tools\cpdb2web_B983000003_1>

Notes: you could customize your output file name with date and time in it. Here is a script example with date in the output name used in my test environment:

cd D:\Download\cpdb2webcpdb2html.bat d:\Download\cpdb2web d:\Download\cpdb2web\output 10.9.2.7 admin Password1234 -o %date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%policy.html

I got output file name "10_09_2014__policy.html" when ran on Sep 10 2014. If you run this .bat file in a windows schedule task weekly as shown below, you will get an automatically backup of your policies.

3. Output in HTML and Excel

Html page will include Security Policy, Address Translation Policy, Network Objects, Users and Services.

The policy can be imported / copied into Excel for further editing.

Notes:

1. Actually the cpdb2html.bat is only able to use to export one active or last opened policy to html. For multiple policies you either use -m option to specify the gateway one by one in your script just like following line: 

cpdb2html.bat d:\Download\cpdb2web d:\Download\cpdb2web\output 10.4.2.3 admin password1234 -o %date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%GDSCI-Internet.html -m CP-Internet

2 You could use following script (cpdb2web.exe) to export all policies to xml file, then convert them one by one to html pages:

mkdir output\tempset output_dir=D:\Download\cpdb2web\output\%date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%mkdir %output_dir%echo %output_dir%
cpdb2web -s 10.4.2.3 -u admin -p passwoed -o d:\Download\cpdb2web\output\temp
copy D:\Download\cpdb2web\xsl\strip*.* D:\Download\cpdb2web\output\temp\strip*.*
cd D:\Download\cpdb2web\output\tempcopy ECOMM_Security_Policy.xml Security_Policy.xmlcopy ECOMM_Nat_Policy.xml Nat_Policy.xmlcd D:\Download\cpdb2webXalan.exe -o %output_dir%\Brazil-DMZ.html "D:\Download\cpdb2web\output\temp\stripped_html.xml" "D:\Download\cpdb2web\output\temp\stripped_html.xsl"
cd D:\Download\cpdb2web\output\tempcopy DMZ_Security_Policy.xml Security_Policy.xmlcopy DMZ_Nat_Policy.xml Nat_Policy.xmlcd D:\Download\cpdb2webXalan.exe -o %output_dir%\GDSCI-RAS.html "D:\Download\cpdb2web\output\temp\stripped_html.xml" "D:\Download\cpdb2web\output\temp\stripped_html.xsl"

3. For browsing purpose, the easiest way is to copy all these XML files inside this sub-directory. Firefox is best one for browsing xml file. Chrome and IE will not process xml file the way we want:

<Visualization_Tool_installation_directory>/xsl/xml/.

Then, open the <Visualization_Tool_installation_directory>/xsl/index.xml file with your web browser .

In my case, command line is :

copy D:\Download\cpdb2web\output\temp\*.* D:\Download\cpdb2web\xsl\xml\*.*

Then open it in the browser:

------------------------------------------------------------------------------------------------------------

Checkpoint Management Portal Screenshots:

It can show gateways status, logs, policies and objects.

Creating Checkpoint VSX and Virtual System - Part 1

VPN-1/FireWall-1 Virtual System Extension (VSX) is a security and VPN solution, designed to meet the demands of large-scale environments. Centrally managed and incorporating key network resources internally, VSX allows businesses to offer comprehensive firewall and VPN functions to their customers, while reducing production costs and improving efficiency. Through a “virtualization” of network infrastructure, VSX allows administrators to use it to replace a collection of standard hardware devices. The VSX Gateway is comprised of a virtual topology that includes virtual devices that replace physical ones, such as routers, traditional firewalls, and even some network cables. 

Checkpoint Configuring VSX document shows how to create a new VSX system and how to create new virtual system, router and switch as well. This is the post to record the procedure how the lab has been done in my virtual environment.

I am using VMware ESXi version 5.5.0 build 1623387 as the host to do lab for Checkpoint related products.In previous lab, a standalone security gateway R77.20 with management has been installed. This time I will add a new VSX gateway and a couple of virtual system, router and switch in.

Step1: create a new VSX gateway with VSX Gateway Wizard:

For how to install Checkpoint Gateway and management server, you should be able to find lots of videos in Youtube website, such as the following two:

•  Checkpoint GAIA R77 Installation & Configuration part I

• Checkpoint GAIA R77 Installation & Configuration part II

After you have installed Checkpoint Gateway and management server on your VM system, you will need to log into Checkpoint Smart Dashboard to start VSX gateway wizard.

 2. During wizard, you will have an option to add virtual system, virtual router or virtual switch in:

 

 3. VSX Gateway Properties:

 4. Now we can create Virtual System, Virtual Router or Virtual Switch