1.99k likes | 2.12k Views
Check Point Security Administration II NGX R65. Slide Graphic Legend. Course Objectives. Part 1: Updating and Upgrading Chapter 1: SmartUpdate Identify the common operational features of SmartUpdate. Use SmartUpdate to create an upgrade package.
E N D
Course Objectives • Part 1: Updating and Upgrading • Chapter 1: SmartUpdate • Identify the common operational features of SmartUpdate. • Use SmartUpdate to create an upgrade package. • Upgrade and attach product licenses using SmartUpdate. • Chapter 2: Upgrading VPN-1 • Determine which VPN-1 upgrade strategy is appropriate, given a variety of scenarios. • Determine VPN-1 license requirements, based on upgrade strategy.
Course Objectives • Part 2: Virtual Private Networks • Chapter 3: Encryption and VPNs • Explain encryption for VPNs. • Compare and contrast common encryption methods. • Describe the process for setting up a encrypted VPN tunnels. • Chapter 4: Introduction to VPNs • Select the appropriate VPN deployment to meet requirements, given a variety of scenarios. • Configure VPN-1 to support site-to-site VPNs, given a variety of business requirements. • Adjust NGX R65 VPN configuration settings to correct a problem, given symptoms of a configuration problem.
Course Objectives • Chapter 5: Site-to-Site VPNs • Select the appropriate VPN deployment to meet requirements, given a variety of scenarios. • Configure VPN-1 to support site-to-site VPNs, given a variety of business requirements. • Adjust VPN configuration settings to correct a problem, given symptoms of a configuration problem. • Chapter 6: Remote Access VPNs • Configure VPN-1 to support remote-access VPNs, given a variety of business requirements.
Course Objectives • Part 3: High Availability and ClusterXL • Chapter 7: High Availability and ClusterXL • Identify the features and limitations of Management High Availability. • Identify the benefits and limitations of different modes in a ClusterXL configuration. • Configure a ClusterXL VPN, given a specific business scenario. • Implement and test State Synchronization, given a business scenario.
Course Layout • Prerequisites • Check Point Certified Security Expert (CCSE)
Recommended Setup for Labs • Recommended Lab Topology
Recommended Setup for Labs • IP Addresses • Lab Terms
Check Point Security Architecture • PURE Security
Check Point Security Architecture • Check Point Components
Check Point Security Architecture • Unified Security Architecture
Check Point Security Architecture • Broad Range of Security Solutions
Check Point Security Architecture • Network Security • Data Security • Security Management • Services
Training and Certification • CCMA • Learn More
Part 1: Updating and Upgrading • Chapter 1: SmartUpdate • Chapter 2: Upgrading VPN-1
1 • SmartUpdate
Objectives 1 • Identify the common operational features of SmartUpdate. • Use SmartUpdate to create an upgrade package. • Upgrade and attach product licenses using SmartUpdate.
Introduction to SmartUpdate 1 • Optional component of VPN-1 that automatically distributes software applications and updates for Check Point and OPSEC certified products • Manages product licenses
Introduction to SmartUpdate 1 • SmartUpdate Architecture
Upgrading Packages 1 • Prerequisites for Remote Upgrades • Retrieving Data From VPN-1 Gateways • Adding New Packages to the Package Repository • Verifying the Viability of a Distribution • Transferring Files to Remote Devices • Upgrading Edge Firmware with SmartUpdate • Rebooting the VPN-1 Gateway • Recovering From a Failed Upgrade • Deleting Packages From the Package Repository
Managing Licenses 1 • Central license: package license tied to IP address of SmartCenter Server • Local license: package license tied to IP address of VPN-1 Gateway, and cannot be transferred to Gateway with different IP address • License Upgrade • Retrieving License Data From VPN-1 Gateways • CPInfo • SmartUpdate Command Line
1 • Updating an Installation with SmartUpdate
Review Questions & Answers 1 • What can be upgraded remotely using SmartUpdate?
Review Questions & Answers 1 • VPN-1 Gateways • Hotfixes, HFAs, and patches • Third-party OPSEC applications • UTM Edge devices • Nokia operating systems • Check Point SecurePlatform
Review Questions & Answers 1 • What two repositories does SmartUpdate install on the SmartCenter Server?
Review Questions & Answers 1 • License & Contract Repository in $FWDIR\conf • Package Repository in C:\SUroos (Windows), /var/suroot (UNIX)
Review Questions & Answers 1 • What does the Pre-Install Verifier check?
Review Questions & Answers 1 • Operating-system compatibility • Disk-space availability • Package not already installed • Package dependencies met
Review Questions & Answers 1 • What are the benefits of using a central license?
Review Questions & Answers 1 • Only one IP address is needed for all licenses. • A license can be moved from one Gateway to another. • A license remains valid when changing Gateway IP addresses.
2 • Upgrading VPN-1
Objectives 2 • Determine which VPN-1 upgrade strategy is appropriate, given a variety of scenarios. • Determine VPN-1 license requirements, based on upgrade strategy.
Preinstallation Configuration 2 • Remove any services not running that might be considered a security risk. • Ensure your network and Gateway are properly configured, with special emphasis on routing. • Log in to each of the hosts, and Ping the other hosts. • Enable IP routing/forwarding. • Confirm that DNS is working properly. • Note names/IP addresses of the Gateway’s interfaces. • Confirm Gateway’s name corresponds to IP address of Gateway’s external interface. • Isolate the computers on which you will be installing VPN-1 components from the network. • Verify you have correct version of software for all VPN-1 components.
Distributed Installation 2 • VPN-1 Client/Server Configuration
Upgrading To VPN-1 NGX R65 2 • Upgrade Guidelines • Upgrade Order • Upgrade Export/Import • Upgrading via SmartUpdate
VPN-1 Backward Compatibility 2 • Supported Versions
Licensing VPN-1 2 • Obtaining Licenses • Supported Upgrade Paths • Contract Verification
Performing License Upgrade 2 • Two Upgrade Methods • Trial Licenses
Pre-Upgrade Considerations 2 • Pre-Upgrade Verification Tool • Web Intelligence License Enforcement • Upgrading on SecurePlatform
Upgrading SmartCenter Server 2 • Using the Pre-Upgrade Verification Tool
Gateway Upgrade 2 • Gateway Upgrade with SmartUpdate
Review Questions & Answers 2 • What is the correct order for a VPN-1 upgrade?
Review Questions & Answers 2 • SmartCenter Server first, then Security Gateway
Review Questions & Answers 2 • What should be done before installing a VPN-1 Security Gateway?
Review Questions & Answers 2 • Remove any services not running that may be a security risk. • Make sure your network and Gateway are properly configured. • Test network communication. • Enable IP routing/forwarding • Confirm DNS is working properly. • Note the names and IP addresses of the Gateway’s interfaces. • Confirm the Gateway is shown in the hosts files correctly. • Isolate the computers. • Verify the correct version of software for you OS
Review Questions & Answers 2 • What methods are there for upgrading licenses?
Review Questions & Answers 2 • Centrally, from the SmartCenter Server via SmartUpdate • Locally at the Check Point machine
Review Questions & Answers 2 • Which products can be upgraded to NGX R65?