VPN Administration Guide R77 Versions

323 Pages·2015·4.79 MB·English

23 July 2015
VPN
R77 Versions
Administration Guide

]
d
e
t
c
e
t
o
r
P
[
n:
o
ti
a
c
fi
si
s
a
Cl
© 2015 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and
distributed under licensing restricting their use, copying, distribution, and decompilation. No part
of this product or related documentation may be reproduced in any form or by any means without
prior written authorization of Check Point. While every precaution has been taken in the
preparation of this book, Check Point assumes no responsibility for errors or omissions. This
publication and features described herein are subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in
subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and FAR 52.227-19.
TRADEMARKS:
Refer to the Copyright page http://www.checkpoint.com/copyright.html for a list of our
trademarks.
Refer to the Third Party copyright notices http://www.checkpoint.com/3rd_party_copyright.html
for a list of relevant copyrights and third-party licenses.
Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date

with the latest functional improvements, stability fixes, security enhancements and
protection against new and evolving attacks.
Check Point R77
For more about this release, see the R77 home page

http://supportcontent.checkpoint.com/solutions?id=sk104859.
Latest Version of this Document
Download the latest version of this document

http://supportcontent.checkpoint.com/documentation_download?ID=24849.
To learn more, visit the Check Point Support Center
http://supportcenter.checkpoint.com.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.

Please help us by sending your comments
(mailto:[email protected]?subject=Feedback on VPN R77
Versions Administration Guide).
Searching in Multiple PDFs
To search for text in all the R77 PDF documents, download and extract the complete

R77 documentation package
http://supportcontent.checkpoint.com/documentation_download?ID=26770.
Use Shift-Control-F in Adobe Reader or Foxit reader.
Revision History
Date Description
23 July 2015 Added Large Scale VPN (on page 90)
8 July 2015 Updated Configuring Numbered VTIs (on page 78)
06 May 2015 Updated for R77.30
Updated client names in Check Point Remote Access Solutions (on page
169)
Date Description
26 June 2014 New feature supported from R77.10:
Added Dead Peer Detection (on page 93)
Updates:
Configuring Link Selection for Remote Access Only (on page 259)
IPv6 Support and Limitations (on page 17)
Granting User Access Using RADIUS Server Groups (on page 185)
Removed some legacy material
18 February 2014 Updated Configuring Outgoing Route Selection (on page 118)
Updated Remote Access Solution Comparison (on page 170)
Updated Configuring Link Selection for Remote Access Only (on page
259)
13 January 2014 Corrected note in L2TP Global Configuration (on page 221)
Corrected diagram and added the note in IKE Phase I (on page 20)
Updated Configuring RIM in a Star Community ("Configuring RIM in a
Star Community:" on page 102).
Improved formatting and document layout
20 August 2013 First release of this document
Contents
Important Information ................................................................................................... 3
The Check Point VPN Solution ..................................................................................... 11
VPN Components .................................................................................................... 11
Understanding the Terminology ............................................................................. 12
Site to Site VPN ....................................................................................................... 12
VPN Communities ........................................................................................................... 13
Sample Combination VPN Community ............................................................................ 14
Routing VPN Traffic ......................................................................................................... 15
Granular Routing Control ................................................................................................ 15
Remote Access VPN ................................................................................................ 15
Client-Based vs. Clientless ............................................................................................. 15
Using Remote Access VPN .............................................................................................. 16
IPv6 Support and Limitations .................................................................................. 17
SmartDashboard Toolbar ........................................................................................ 18
IPsec & IKE .................................................................................................................. 20
Overview .................................................................................................................. 20
IKE Phase I ...................................................................................................................... 20
IKE Phase II (Quick mode or IPSec Phase) ...................................................................... 22
IKEv1 and IKEv2 .............................................................................................................. 23
Methods of Encryption and Integrity ............................................................................... 23
Phase I modes ................................................................................................................. 24
Renegotiating IKE & IPsec Lifetimes .............................................................................. 24
Perfect Forward Secrecy ................................................................................................ 25
IP Compression ............................................................................................................... 25
Subnets and Security Associations ................................................................................. 26
IKE DoS Protection .................................................................................................. 27
Understanding DoS Attacks ............................................................................................ 27
IKE DoS Attacks ............................................................................................................... 27
Defense Against IKE DoS Attacks .................................................................................... 28
SmartDashboard IKE DoS Attack Protection Settings .................................................... 28
Advanced IKE DoS Attack Protection Settings ................................................................ 28
Configuring Advanced IKE Properties ..................................................................... 30
On the VPN Community Network Object ......................................................................... 30
On the Gateway Network Object ...................................................................................... 31
Public Key Infrastructure ............................................................................................ 32
Need for Integration with Different PKI Solutions .................................................. 32
Supporting a Wide Variety of PKI Solutions ............................................................ 33
PKI and Remote Access Users ........................................................................................ 33
PKI Deployments and VPN .............................................................................................. 33
Trusting An External CA .................................................................................................. 35
Enrolling a Managed Entity ............................................................................................. 36
Validation of a Certificate ................................................................................................ 36
Special Considerations for PKI ............................................................................... 40
Using the Internal CA vs. Deploying a Third Party CA ..................................................... 40
Distributed Key Management and Storage ..................................................................... 40
Configuration of PKI Operations.............................................................................. 41
Trusting a CA – Step-By-Step ......................................................................................... 41
Certificate Revocation (All CA Types) .............................................................................. 43
Certificate Recovery and Renewal .................................................................................. 43
CA Certificate Rollover .................................................................................................... 43
Adding Matching Criteria to the Validation Process ........................................................ 45
CRL Cache Usage ............................................................................................................ 45
Modifying the CRL Pre-Fetch Cache ............................................................................... 45
Configuring CRL Grace Period ........................................................................................ 45
Configuring OCSP .................................................................................................... 46
Introduction to VPN ..................................................................................................... 47
The Need for VPN .................................................................................................... 47
Confidentiality ................................................................................................................. 47
Authentication ................................................................................................................. 47
Integrity ........................................................................................................................... 47
How VPN Works ...................................................................................................... 48
VPN Communities ........................................................................................................... 48
Authentication Between Community Members ............................................................... 50
VPN Topologies ............................................................................................................... 50
Access Control and VPN Communities ........................................................................... 56
Routing Traffic within a VPN Community ........................................................................ 57
Excluded Services ........................................................................................................... 57
Special Considerations for Planning a VPN Topology ............................................. 58
Configuring Site to Site VPNs .................................................................................. 58
Migrating from Traditional Mode to Simplified Mode ..................................................... 58
Configuring a Meshed Community Between Internally Managed Gateways ................... 58
Configuring a Star VPN Community ................................................................................ 59
Confirming a VPN Tunnel Successfully Opens ................................................................ 60
Configuring a VPN with External Security Gateways Using PKI .............................. 60
Configuring a VPN with External Security Gateways Using Pre-Shared Secret ..... 62
How to Authorize Firewall Control Connections in VPN Communities ................... 64
Why Turning off Firewall Implied Rules Blocks Control Connections ............................ 64
Allowing Firewall Control Connections Inside a VPN ..................................................... 65
Discovering Which Services are Used for Control Connections ...................................... 65
Working with Site-to-Site VPN .................................................................................... 66
Domain Based VPN ................................................................................................. 67
Overview of Domain-based VPN ...................................................................................... 67
VPN Routing and Access Control .................................................................................... 68
Configuring Domain Based VPN ...................................................................................... 68
Route Based VPN .................................................................................................... 76
Overview of Route-based VPN ......................................................................................... 76
VPN Tunnel Interface (VTI) .............................................................................................. 77
Using Dynamic Routing Protocols ................................................................................... 78
Configuring Numbered VTIs ............................................................................................ 78
VTIs in a Clustered Environment ..................................................................................... 80
Configuring VTIs in a Clustered Environment ................................................................. 81
Enabling Dynamic Routing Protocols on VTIs ................................................................. 84
Configuring VTIs in a Gaia Environment .......................................................................... 87
Configuring Anti-Spoofing on VTIs .................................................................................. 87
Configuring a Loopback Interface ................................................................................... 87
Configuring Unnumbered VTIs ........................................................................................ 88
Routing Multicast Packets Through VPN Tunnels .......................................................... 88
Large Scale VPN...................................................................................................... 90
Monitoring LSV Peers and Tunnels ................................................................................. 90
Tunnel Management ............................................................................................... 91
Overview of Tunnel Management .................................................................................... 91
Configuring Tunnel Features .......................................................................................... 95
Route Injection Mechanism ..................................................................................... 98
Overview of Route Injection ............................................................................................. 98
Automatic RIM ................................................................................................................. 98
Custom Scripts .............................................................................................................. 100
Injecting Peer Security Gateway Interfaces .................................................................. 101
Configuring RIM ............................................................................................................ 102
Configuring RIM on Gaia ................................................................................................ 104
Wire Mode ............................................................................................................. 106
Overview of Wire Mode .................................................................................................. 106
Wire Mode Scenarios .................................................................................................... 106
Special Considerations for Wire Mode .......................................................................... 109
Configuring Wire Mode.................................................................................................. 110
Directional VPN Enforcement ............................................................................... 111
Overview of Directional VPN ......................................................................................... 111
Directional Enforcement within a Community .............................................................. 111
Configurable Objects in a Direction ............................................................................... 112
Directional Enforcement between Communities .......................................................... 112
Configuring Directional VPN Within a Community ........................................................ 114
Configuring Directional VPN Between Communities .................................................... 114
Link Selection ....................................................................................................... 115
Link Selection Overview ................................................................................................ 115
Configuring IP Selection by Remote Peer ..................................................................... 115
Configuring Outgoing Route Selection .......................................................................... 118
When Initiating a Tunnel ............................................................................................... 118
Configuring Source IP Address Settings ....................................................................... 120
Outgoing Link Tracking ................................................................................................. 120
Link Selection Scenarios ............................................................................................... 121
Service Based Link Selection ........................................................................................ 124
Trusted Links ................................................................................................................ 129
On Demand Links (ODL) ................................................................................................ 131
Link Selection and ISP Redundancy .............................................................................. 133
Link Selection and ISP Redundancy Scenarios ............................................................. 134
Link Selection with non-Check Point Devices ............................................................... 135
Multiple Entry Point VPNs ..................................................................................... 136
Overview of MEP ............................................................................................................ 136
Explicit MEP .................................................................................................................. 137
Implicit MEP .................................................................................................................. 143
Routing Return Packets ................................................................................................ 146
Special Considerations .................................................................................................. 147
Configuring MEP ........................................................................................................... 148
Traditional Mode VPNs .......................................................................................... 152
Introduction to Traditional Mode VPNs ......................................................................... 152
VPN Domains and Encryption Rules.............................................................................. 153
Defining VPN Properties ............................................................................................... 154
Internally and Externally Managed Security Gateways ................................................. 154
Considerations for VPN Creation .................................................................................. 154
Configuring Traditional Mode VPNs .............................................................................. 155
Converting a Traditional Policy to a Community Based Policy .............................. 160
Introduction to Converting to Simplified VPN Mode ...................................................... 160
How Traditional VPN Mode Differs from a Simplified VPN Mode .................................. 160
How an Encrypt Rule Works in Traditional Mode .......................................................... 162
Principles of the Conversion to Simplified Mode .......................................................... 163
Placing the Security Gateways into the Communities ................................................... 163
Conversion of Encrypt Rule ........................................................................................... 164
Working with Remote Access VPN ............................................................................ 168
Check Point Remote Access Solutions .................................................................. 169
Providing Secure Remote Access ................................................................................. 169
Types of Solutions ......................................................................................................... 169
Remote Access Solution Comparison ........................................................................... 170
Summary of Remote Access Options ............................................................................ 173
Remote Access VPN Overview .............................................................................. 178
Overview ........................................................................................................................ 178
Establishing a Connection Between a Remote User and a Security Gateway ............... 179
Remote Access Community ........................................................................................... 179
Identifying Elements of the Network to the Remote Client ........................................... 180
Connection Mode ........................................................................................................... 180
Access Control for Remote Access Community ............................................................ 180
Client-Security Gateway Authentication Schemes ........................................................ 181
Advanced Features ........................................................................................................ 183
VPN for Remote Access Considerations ............................................................... 184
Policy Definition for Remote Access ............................................................................. 184
User Certificate Creation Methods when Using the ICA ................................................ 184
Multiple Certificates per User ....................................................................................... 184
Internal User Database vs. External User Database ..................................................... 184
NT Group/RADIUS Class Authentication Feature .......................................................... 185
Granting User Access Using RADIUS Server Groups .................................................... 185
Associating a RADIUS Server with Security Gateway .................................................... 187
Configuring Remote Access VPN .......................................................................... 188
Remote Access VPN Workflow ...................................................................................... 189
Creating Remote Access VPN Certificates for Users .................................................... 189
Creating and Configuring the Security Gateway ........................................................... 191
Defining User and Authentication Methods in LDAP ..................................................... 191
Enrolling User Certificates - ICA Management Tool ..................................................... 192
Configuring Certificates Using Third Party PKI ............................................................. 192
Enabling Hybrid Mode and Methods of Authentication ................................................. 193
Configuring Authentication for NT groups and RADIUS Classes .................................. 193
Using a Pre-Shared Secret ........................................................................................... 193
Defining an LDAP User Group ....................................................................................... 194
Defining a User Group ................................................................................................... 194
Defining a VPN Community and its Participants ........................................................... 194
Defining Access Control Rules ...................................................................................... 194
Installing the Policy ....................................................................................................... 194
User Certificate Management ....................................................................................... 195
Modifying Encryption Properties for Remote Access VPN ............................................ 196
Working with RSA Hard and Soft Tokens ...................................................................... 196
Office Mode ........................................................................................................... 199
The Need for Remote Clients to be Part of the LAN ...................................................... 199
Office Mode .................................................................................................................... 199
Enabling IP Address per User ....................................................................................... 204
Office Mode Considerations .......................................................................................... 206
Configuring Office Mode ................................................................................................ 207
Desktop Security ................................................................................................... 213
The Need for Desktop Security ..................................................................................... 213
Desktop Security Solution ............................................................................................. 213
Desktop Security Considerations .................................................................................. 216
Configuring Desktop Security ....................................................................................... 217
Layer Two Tunneling Protocol (L2TP) Clients ....................................................... 219
The Need for Supporting L2TP Clients .......................................................................... 219
Introduction to L2TP Clients ......................................................................................... 219
Establishing a VPN between a IPsec / L2TP Client and a Gateway ............................... 220
Behavior of an L2TP Connection ................................................................................... 221
Security Gateway Requirements for IPsec / L2TP ........................................................ 221
L2TP Global Configuration ............................................................................................ 221
Authentication of Users ................................................................................................. 221
User Certificate Purposes ............................................................................................. 223
Considerations for Choosing Microsoft IPsec / L2TP Clients ........................................ 223
Configuring Remote Access for Microsoft IPsec / L2TP Clients ................................... 223
Secure Configuration Verification ......................................................................... 228
The Need to Verify Remote Client's Security Status ..................................................... 228
The Secure Configuration Verification Solution ............................................................ 228
Considerations regarding SCV ...................................................................................... 232
Configuring SCV ............................................................................................................ 232
VPN Routing - Remote Access .............................................................................. 253
The Need for VPN Routing ............................................................................................. 253
Check Point Solution for Greater Connectivity and Security ......................................... 253
Configuring VPN Routing for Remote Access VPN ........................................................ 257
Link Selection for Remote Access Clients ............................................................ 259
Overview ........................................................................................................................ 259
Configuring Link Selection for Remote Access Only ..................................................... 259
Using Directional VPN for Remote Access ............................................................ 261
Directional VPN in RA Communities ............................................................................. 261
Configuring Directional VPN with Remote Access Communities .................................. 261
Remote Access Advanced Configuration ............................................................... 263
Non-Private Client IP Addresses .................................................................................. 263
Preventing a Client Inside the Encryption Domain from Encrypting ............................. 264
Authentication Timeout and Password Caching ............................................................ 267
Secure Domain Logon (SDL) ......................................................................................... 267
Auto Topology Update (Connect Mode only) .................................................................. 269
How to Work with non-Check Point Firewalls ............................................................... 269
Resolving Internal Names with the SecuRemote DNS Server ...................................... 270
Multiple Entry Point for Remote Access VPNs ...................................................... 271
The Need for Multiple Entry Point Security Gateways .................................................. 271
The Check Point Solution for Multiple Entry Points ...................................................... 271
Disabling MEP ............................................................................................................... 273
Configuring MEP ........................................................................................................... 273
Configuring Preferred Backup Security Gateway ......................................................... 275
Disabling MEP ............................................................................................................... 275
SSL Network Extender .......................................................................................... 276
Introduction to the SSL Network Extender ................................................................... 276
How the SSL Network Extender Works ......................................................................... 277
Commonly Used Concepts ............................................................................................ 277
Special Considerations for the SSL Network Extender ................................................ 279
Configuring the SSL Network Extender ........................................................................ 280
SSL Network Extender User Experience ...................................................................... 288
Troubleshooting SSL Network Extender ....................................................................... 295
Resolving Connectivity Issues ............................................................................... 297
The Need for Connectivity Resolution Features ............................................................ 297
Check Point Solution for Connectivity Issues ................................................................ 297
Overcoming NAT Related Issues ................................................................................... 297
Overcoming Restricted Internet Access ........................................................................ 302
Configuring Remote Access Connectivity ...................................................................... 305
VPN Command Line Interface ................................................................................... 311
VPN Commands .................................................................................................... 311
SecureClient Commands....................................................................................... 312
Desktop Policy Commands .................................................................................... 314
VPN Shell .................................................................................................................. 315
Configuring a Virtual Interface Using the VPN Shell ............................................. 315
Index.......................................................................................................................... 317