Checkpoint产品培训

©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPointQuickStart产品培训2©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityAgendaCheckPoint防火墙基本架构UTM-1设备初始化SmartConsole安装UTM-1对象定义–UTM-1防火墙属性的基本配置–UTM-1防火墙的网络对象定义–UTM-1防火墙的服务对象定义–UTM-1防火墙的时间对象定义UTM-1防火墙的访问控制规则配置UTM-1防火墙的NAT规则配置RemoteAccessVPN配置备份和恢复©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPoint防火墙基本架构—基本模块和部署模式4©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPoint防火墙基本架构基本架构介绍–SmartConsole管理客户端（用户管理的主界面）–SmartCenter管理服务器–Gateway防火墙功能执行模块5©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPoint防火墙的部署方式—分布式（Distributed）分布式部署–防火墙模块和SmartCenter部署在不同的设备上6©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurity分布式部署的通信模式两个基本要素–SVNFoundation（CheckPoint基本安全系统）–SecureInternalCommunications(SIC)（内部安全通信机制，基于SSL和内部数字证书）7©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPoint防火墙的部署方式—独立式（Standlone）SmartCenter和Gateway模块部署在同一台设备上©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityCheckPoint防火墙基本架构—SmartConsole各管理模块9©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecuritySmartDashboard进行产品配置的管理客户端10©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecuritySmartViewTracker进行日志管理的管理客户端11©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecuritySmartViewMonitor–进行系统状态检测和流量监测的管理客户端12©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityEventiaReporter–进行报表处理的管理客户端©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityUTM-1设备初始化14©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep1，登录UTM-1设备1.PC机连接UTM-1设备INT端口（内端口）2.浏览器输入，©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep2，网络、时间等信息配置根据系统提示，配置UTM-1设备网络地址，时间，DNS等信息16©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep3，CheckPoint应用模块初始化初始化设备的CheckPoint应用模块LocallyManaged—Standlone安装，SmartCenter和Gateway模块将同时安装在该UTM-1设备上；CentrallyManaged—Distribute安装，只有Gateway模块安装在该UTM-1设备上，此时，将需要额外的SmartCenter来管理该UTM-1s设备注意，该过程是不可逆的。要更改Local或者Central的配置，只能恢复出厂配置后，再重新初始化©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurity登录UTM-1设备安装配置SmartConsole18©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep1：登录WEB管理界面19©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep2：下载SmartConsole20©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep3：安装SmartConsole（傻瓜式安装）根据安装程序引导，安装SmartConsole21©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep4：启动SmartDashBoard22©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep5：登录SmartCenter•如果选择Demo模式，则运行模拟程序•如果不选择，则登录到实际的SmartCenter输入SmartCenterIP地址DEMO模式是进行产品学习和模拟操作的重要工具在Demo模式可以模拟完成绝大多数的实际环境操作23©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep6：关于Fingerprint如果是第一次登录，会让你确认系统的Fingerprint，单击“是”，将登录到SmartCenter24©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep7:登录到SmartCenter配置界面25©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep8如何登录到SmartViewTracker？如何登录到SmartViewMonitor？方法一：–和SmartDashboard相同；方法二：–在SmartDashboard直接打开上述两个程序©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityUTM-1防火墙的基本属性配置27©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep1：定义UTM-1基本属性启用你所需要的功能，考虑到性能优化，只启用你需要的功能。详细说明，请参考本页注释28©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep2：定义拓扑结构•通过定义拓扑结构，UTM-1将自动获取已经定义的端口（网卡）配置；•拓扑结构定义是UTM-1配置的重要步骤，一定要注意29©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep3：定义端口（网卡）属性（1）定义端口的基本属性：名称，IP地址，子网掩码；需要注意的是，这些基本属性，是通过Topology自动获取的，不要手工更改；修改端口IP地址的正确方法是：1，通过WEB界面（或者命令行）修改端口的IP地址和子网掩码；2，通过上一页PPT的“Get”按钮，自动获取该端口的IP地址信息；30©2003-2007CheckPointSoftwareTechnologiesLtd.Allrightsreserved.Proprietaryandconfidential.puresecurityStep4，定义端口的其他属性（2）-External端口External端口—连接Internet的端口定义为Exnternal；In