Checkpoint Interview Questions And Answers

What is Asymmetric Encryption.

In Asymmetric Encryption there is two different key used for encrypt and decrypt to packet. Means that one key used for Encrypt packet, and second key used to for decrypt packet. Same key can not encrypt and decrypt.

How Checkpoint Component communicate and Sync with each other?

Secure Internal Communications (SIC) is the Check Point feature that ensures components, such as Security Gateways, SmartCenter Server, SmartConsole, etc. can communicate with each other freely and securely using a simple communication initialization process.

Checkpoint Packet flow for SNAT and DNAT?

• In case of SNAT

  • Antispoofing

  • Session lookup

  • Policy lookup

  • Routing

  • Netting

• In case of DNAT

  • Antispoofing

  • Session lookup

  • Policy lookup

  • Netting

  • Routing

CheckPoint Anti Spoofing

What is Anti-Spoofing?

Anti-Spoofing is the feature of Checkpoint Firewall. which is protect from attacker who generate IP Packet with Fake or Spoof source address. Its determine that whether traffic is legitimate or not. If traffic is not legitimate then firewall block that traffic on interface of firewall.

What is Stealth Rule in checkpoint firewall?

Stealth Rule Protect Checkpoint firewall from direct access any traffic. Its rule should be place on the top of Security rule base. In this rule administrator denied all traffic to access checkpoint firewall.

What is Cleanup rule In Checkpoint Firewall?

Cleanup rule place at last of the security rule base, It is used to drop all traffic which not match with above rule and Logged. Cleanup rule mainly created for log purpose. In this rule administrator denied all the traffic and enable log.

What are the functions of CPD, FWM, and FWD processes?

CPD – CPD is a high in the hierarchical chain and helps to execute many services, such as Secure Internal Communication (SIC), Licensing and status report.

FWM – The FWM process is responsible for the execution of the database activities of the SmartCenter server. It is; therefore, responsible for Policy installation, Management High Availability (HA) Synchronization, saving the Policy, Database Read/Write action, Log Display, etc.

FWD – The FWD process is responsible for logging. It is executed in relation to logging, Security Servers and communication with OPSEC applications.

What are the two types of Check Point NG licenses?

1. Central License
2. Local Licenses

Central licenses are the new licensing model for NG and are bound to the SmartCenter server. Local licenses are the legacy licensing model and are bound to the enforcement module.

What are the major differences between SPLAT and GAIA?

Gaia is the latest version of Checkpoint which is a combination of SPLAT and IPSO. Here are some benefits of Gaia as compare to SPLAT/IPSO.

1. Web-Based user interface with Search Navigation

2. Full Software Blade support

3. High connection capacity

4. Role-Based administrative Access

5. Intelligent Software updates

6. Native IPv4 and IPv6 Support

7. ClusterXL or VRRP Clusters

8. Manageable Dynamic Routing Suite

9. Full Compatibility with IPSO and SecurePlatform.

Checkpoint Interview Questions - Architecture

What is Checkpoint Architecture?

Check Point has developed a Unified Security Architecture that is implemented throughout all of its security products. This Unified Security Architecture enables all Check Point products to be managed and monitored from a single administrative console and provides a consistent level of security.

The  Check Point Unified Security Architecture is comprised of four main components:

1. Core Technologies: Check Point uses a common set of core technologies, such as INSPECT for security inspection, across multiple layers of security.
2. Central Management: All Check Point products can be managed and monitored from a single administrative console.
3. Open Architecture: Check Point has built its security architecture to be open and interoperable in a heterogeneous environment. For example, Check Point products can interoperate with other network and security equipment from third-party vendors to enable cooperative enforcement of Security Policies.
4. Universal-update Ability: Check Point has consolidated multiple security-alert and update functions to ease update procedures and help Administrators ensure that security is always up-to-date.

What is 3 tier architecture component of Checkpoint Firewall?

• Smart Console.
• Security Management.
• Security Gateway.

What is NAT?

NAT stand for Network Address Translation. It is used to map private IP address with Public IP Address and Public IP address map with Private IP Address. Mainly it is used for Provide Security to the Internal Network and Servers from Internet. NAT is also used to connect Internet with Private IP Address. Because Private IP cant route on Internet.

What is Source NAT?

Source NAT used to initiate traffic from internal network to external network. In source NAT only source IP will be translated in public IP address.

What is IP Sec?

IP Sec (IP Security) is a set of protocol. which is responsible for make secure communication between two host machine, or network over public network such as Internet. IPSec Protocol provide Confidentiality, Integrity, Authenticity and Anti Replay protection.

There is two IPSec protocol which provides security

1. ESP (Encapsulation Security Payload) and
2. AH (Authentication Header).

What are the protocols of IPSec? And what are the Protocol numbers of IPSec Protocols?

IPSec use two Protocols AH (Authentication Header) and ESP (Encapsulated Security Payload). AH works on Protocol number 51 and ESP works on Protocol number 50.

What is VPN (Virtual Private Network)

VPN (Virtual Private Network) is used to create secure connection between two private network over Internet. Its used Encryption authentication to secure data during transmission. There are two type of VPN

• Site to Site VPN.
• Remote Access VPN.

Checkpoint Firewall Interview Questions

What is Difference between ESP and AH IPSec Protocol.

ESP – ESP Protocol is a part of IPsec suit , Its provide Confidentiality, Integrity and Authenticity. Its used in two mode Transport mode and Tunnel mode.

AH – Its is also part of a IPsec suit, Its provide only Authentication and Integrity, Its does not provide Encryption. Its also used to two mode Transport mode and Tunnel mode.

What is Explicit rule In Checkpoint Firewall.

Its a rule in ruse base which is manually created by network security administrator that called Explicit rule.

What is Hide NAT.

Hide NAT used to translate multiple private IP or Network with single public IP address. Means many to one translation. Its can only be used in source NAT translation. Hide NAT can not be used in Destination NAT.

What is Destination NAT.

When request to translate Destination IP address for connect with Internal Private network from Public IP address. Only static NAT can be used in Destination NAT.

Difference between Automatic NAT and Manual NAT.

Automatic NAT	Manual NAT
Automatic created by Firewall	Manually Created by Network Security Administrator
Can not modify	Can be Modify
Can not create “No NAT” rule	Can be Create “No NAT” rule
Can not create Dual NAT	Can be Create Dual NAT
Port forwarding not possible	Port forwarding possible
Proxy ARP by default enabled	Proxy ARP by default not enable

What is the difference between standalone deployment distributed deployment?  

Standalone deployment: In standalone deployment, Security Gateway and Security management server installed on same Machine.

Distributed deployment: In Distributed deployment, Security Gateway and Security Management Server installed on different machine.

What is SIC.

SIC – SIC stand for “Secure Internal Communication”. Its a checkpoint firewall feature that is used to make secure communication between Checkpoint firewall component. Its used when Security Gateway and Security management server installed in Distributed deployment. Its Authentication and Encryption for secure communication.

How SIC work? What are the different ports of SIC?

Secure Internal Communication (SIC) lets Check Point platforms and products authenticate with each other. The SIC procedure creates a trusted status between gateways, management servers and other Check Point components. SIC is required to install polices on gateways and to send logs between gateways and management servers.

These security measures make sure of the safety of SIC:

1. Certificates for authentication

2. Standards-based SSL for the creation of the secure channel

3. 3DES for encryption

The Internal Certificate Authority (ICA)

The ICA is created during the Security Management server installation process. The ICA is responsible for issuing certificates for authentication. For example, ICA issues certificates such as SIC certificates for authentication purposes to administrators and VPN certificates to users and gateways.

Initializing the Trust Establishment Process

Communication Initialization establishes a trust between the Security Management server and the CheckPoint gateways. This trust lets Check Point components communicate securely. Trust can only be established when the gateways and the server have SIC certificates.

Note - For SIC to succeed, the clocks of the gateways and servers must be synchronized.

The Internal Certificate Authority (ICA) is created when the Security Management server is installed. The ICA issues and delivers a certificate to the Security Management server.

To initialize SIC:

1. Decide on an alphanumeric Activation Key.

2. In SmartDashboard, open the gateway network object. In the General Properties page of the gateway, click Communication to initialize the SIC procedure.

3. In the Communication window of the object, enter the Activation Key that you created in step 2.

4. Click Initialize.

The ICA signs and issues a certificate to the gateway. Trust state is Initialized but not trusted. The certificate is issued for the gateway, but not yet delivered.

SSL negotiation takes place. The two communicating peers are authenticated with their Activation Key.

The certificate is downloaded securely and stored on the gateway.

After successful Initialization, the gateway can communicate with any Check Point node that possesses a SIC certificate, signed by the same ICA. The Activation Key is deleted. The SIC process no longer requires the Activation Key, only the SIC certificates.

Checkpoint SIC Ports

PORT	TYPE	SERVICE DESCRIPTION
18209	tcp	NGX Gateways <> ICAs (status, issue, or revoke)
18210	tcp	Pulls Certificates from an ICA
18211	tcp	Used by the cpd daemon (on the gateway) to receive Certificates

 

IPSec works at which OSI layer?

IP Layer (Network Layer and provide security services Network Layer and above).

What is the Packet Flow of Checkpoint firewall?

1. SAM Database.
2. Address Spoofing.
3. Session Lookup.
4. Policy Lookup.
5. Destination NAT.
6. Route Lookup.
7. Source NAT.
8. Layer 7 Inspection.
9. VPN.
10. Routing.

What Advantage of NAT.

• Save Public IP to save cost.
• Security with hide Internal Network.
• Avoid Routing.
• Publish Server over Internet.
• Overlapping Network.
• Access Internet from Private IP address.

What is Smart Dashboard?

Its tool of smart console. It’s used to Configure Rule, Policy object, Create NAT Policy, Configure VPN and Cluster.

What is Asymmetric Encryption?

There are two different keys in Asymmetric Encryption used for packet encryption/decryption. One key is used to encrypt packet whereas the second one is used to decrypt the packet. But, the same key cannot encrypt and decrypt.

Mention the components of the three-tier architecture of Checkpoint Firewall?

• Smart Console
• Security Gateway
• Security Management