Flashcards
Security Before Firewall Activation
Cards in this deck (15)
- 1Achieving Security Before Firewall ActivationThere are several scenarios in which a computer does not yet have a security policy installed and is vulnerable. Two features provide security during these situations: Boot Security, which secures communication during the boot period, and Initial Policy, which provides security before a security policy is installed for the first time. As a result, there is no point in time when the computer is left unprotected.
- 2Boot SecurityDuring the boot process, there is a short period of time (measured in seconds) between the point when the computer is capable of receiving communication (and can be attacked) and the point when the security policy is loaded and is enforced. During this time, the firewall Boot Security feature protects both the internal networks behind the Security Gateway, and the computer itself. Boot Security is provided by two elements working together:
- Control of IP Forwarding on boot
- Default Filter. The Default Filter also provides protection in a scenario where firewall processes are stopped for maintenance. - 3Control of IP Forwarding on BootFor networks protected by a Security Gateway, protection is available at boot by disabling IP forwarding in the OS kernel. This ensures that there will never be a time when IP Forwarding is active and no security policy is enforced. This ensures that networks behind the gateway are safe.
Disabling IP Forwarding protects networks behind the Security Gateway computer, but it does not protect the Security Gateway computer itself. For this purpose, the Security Gateway implements a Default Filter during the period of vulnerability. - 4The Default FilterWhen a Security Gateway boots with the Default Filter, the following sequence is performed:
- Computer boots up.
- Boot security takes effect (Default Filter loads and IP Forwarding is disabled).
- Interfaces are configured.
- Security Gateway services start.
The computer is protected as soon as the Default Filter loads. - 5There are several Default Filters:- General Filter accepts no inbound communication (this is the default option).
- Drop Filter accepts no inbound or outbound communication. This filter drops all communications into and out of the gateway during a period of vulnerability. Note, however, that if the boot process requires that the gateway communicate with other hosts, then the Drop Filter should not be used.
- Default Filter for IPSO allowing SSH incoming communication to support remote Administration.
- Default Filter for IPSO allowing HTTPS incoming communication to support remote Administration.
- Default Filter for IPSO allowing SSH and HTTPS incoming communication to support remote Administration.
The appropriate Default Filter should be selected based on platform and communication needs. The General Filter is selected by default.
The Default Filter also provides Anti-Spoofing protection for the Security Gateway. It ensures that packets whose source is the Security Gateway computer itself have not come from one of its interfaces. - 6Using the Default Filter for MaintenanceIt is sometimes necessary to stop firewall processes for maintenance, and it is impractical to disconnect the Security Gateway computer from the network (for example, the computer may be at a remote location).
The cpstop -fwflag ‑default and cpstop -fwflag ‑proc commands allow Security Gateway processes to be temporarily stopped for remote maintenance without exposing the computer to attack.
During maintenance, the Default Filter allows open connections to the gateway to remain open, without dropping them. - 7The Initial PolicyUntil the Security Gateway administrator installs the security policy on the gateway for the first time, security is enforced by an Initial Policy. The Initial Policy operates by adding "implied rules" to the Default Filter. These rules forbid most communication yet allows the communication needed for the installation of the security policy. The Initial Policy also protects a gateway during Check Point product upgrades, when a SIC certificate is reset on the gateway, or in the case of a Check Point product license expiration. The Initial Policy is enforced until a user-defined policy is installed, and is never loaded again. In subsequent boots, the regular policy is loaded immediately after the Default Filter
- 8During a Check Point upgrade, a SIC certificate reset, or license expiration, the _____ Policy overwrites the user-defined policy.During a Check Point upgrade, a SIC certificate reset, or license expiration, the Initial Policy overwrites the user-defined policy.
- 9The sequence of actions during boot of the Security Gateway computer until a security policy is loaded for the first time:The computer boots up.
The Default Filter loads and IP Forwarding is disabled.
The Interfaces are configured.
Security Gateway services start.
The Initial Policy is fetched from the local gateway.
SmartConsole clients connect or Trust is established, and the security policy is installed. - 10Are there different Initial Policies for standalone and distributed setups?Yes
- 11Initial Policies for standalone configurationIn a standalone configuration, where the Security Management Server and the Security Gateway are on the same computer, the Initial Policy allows CPMI communication only. This permits SmartConsole clients to connect to the Security Management Server.
- 12Initial Policies for distributed configurationIn a distributed configuration, where the Primary Security Management Server is on one computer and the Security Gateway is on a different computer, the Initial Policy allows the following:
In the Primary Security Management Server computer — allows CPMI communication for SmartConsole clients.
In the Security Gateway — allows cpd and fwd communication for SIC communication (to establish trust) and for Policy installation.
In a distributed configuration, the Initial Policy on the Security Gateway does not allow CPMI connections. The smartConsole will not be able to connect to the Security Management Server if the SmartConsole must access the Security Management Server through a gateway running the Initial Policy.
There is also an Initial Policy for a Secondary Security Management Server (Management High Availability). This Initial Policy allows CPMI communication for SmartConsole clients and allows cpd and fwd communication for SIC communication (to establish trust) and for Policy installation. - 13Unloading Default Filter or Initial PolicyTo unload a Default Filter or an Initial Policy from the kernel, use the same command that is used for unloading a regular policy:
To unload the Default Filter locally:
Run the fw unloadlocal command.
To unload an Initial Policy from a remote Security Management machine:
Run the following command on the Security Management Server:
fwm unload
where hostname is the SIC_name of the gateway. - 14the cpstop -fwflag default commandTo stop all firewall processes but leave the Default Filter running, use cpstop -fwflag -default.
-default option: Kills firewall processes (fwd, fwm, vpnd, snmpd etc.). Logs, kernel traps, resources, and all security server connections stop working.
The security policy in the kernel is replaced with the Default Filter. - 15the cpstop -fwflag proc commandTo stop all Security Gateway processes but leave the security policy running, use cpstop -fwflag -proc.
-proc option: Kills firewall processes (fwd, fwm, vpnd etc.). Logs, kernel traps, resources, and all security server connections stop working. The security policy remains loaded in the kernel. Therefore allow, reject, or drop rules that do not use resources, but only services, continue to work.
Information
- Description
- User has deleted their subject information Flashcards on Security Before Firewall Activation, created by Deleted user on 30/05/2019.
- Created by
- Deleted user · May 2019
- Updated
- Jun 17, 2019
- Views
- 19
- History
-
- Created by brian gustavo triviño taborda · May 30, 2019
- Copied by brian gustavo triviño taborda · May 30, 2019
- Rating