W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Technical Lab n°1 Guidelines End-to-End Security and VPN

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Agenda Introduction Introduction Lab Presentation Lab Presentation Lab 1-1 : VPN Client to Gateway Lab 1-1 : VPN Client to Gateway Lab 1-2 : Hybrid Mode Lab 1-2 : Hybrid Mode Lab 1-3 : SecureClient Lab 1-3 : SecureClient Lab 1-4 : SecureServer Lab 1-4 : SecureServer Lab 1-5 : SR/SC behind NAT Hide Lab 1-5 : SR/SC behind NAT Hide

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Introduction : Objectives Understand End-to-End Security and secure communications Understand End-to-End Security and secure communications Setup Hybrid Mode (strong authentication) Setup Hybrid Mode (strong authentication) Setup / Manage VPN-1 SecureServer Setup / Manage VPN-1 SecureServer Understand and setup the new SP2 fonctionnality : UDP encapsulation Understand and setup the new SP2 fonctionnality : UDP encapsulation

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab Architecture – Lab 1 VPN-1 HUBHUB FW/VPN Module + Management CLIENT SERVER HUBHUB SecureServer Telnet Server SecureServer RADIUS SecureClient

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Components VPN-1 VPN-1  NT 4.0 SP6a  VPN SP2 SERVER SERVER  NT 4.0 SP6a  Radius Server SecureServer SecureServer  NT 4.0 SP6a  Telnet Server + SecureServer 4.1 SP2 Client Client  NT 4.0 SP6a  VPN-1 SecureClient build 4165

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Lab 1-1 : VPN Client to Gateway

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Logical architecture VPN-1 HUBHUB FW/VPN Module + Management CLIENT SERVER HUBHUB SecureServer VPN

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-1 : VPN Client to Gateway Configure VPN-1 to support client-to- site encryption Configure VPN-1 to support client-to- site encryption Create a remote user Create a remote user Create SecuRemote Site Create SecuRemote Site Access SecureServer with telnet Access SecureServer with telnet  Check logs

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-1 : VPN Client to Gateway (ADVANCED) Debug SecuRemote Debug SecuRemote  fwenc.log file  SRinfo file Debug IKE negotiation Debug IKE negotiation  Use IKEview

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-1 : VPN Client to Gateway (ADVANCED) Ike.elg and Ikeview Use with FireWall-1/SecuRemote 4.1: Use with FireWall-1/SecuRemote 4.1:  Generate a file IKE.elg on FW or SR4.1. To do it, you need to :  Create the environment variable FWIKE_DEBUG=1 (set FWIKE_DEBUG=1)  On FW-1 : fwstop, fwstart  On SR4.1 : kill SR, create a log directory (in SRDIR directory) and reload SR.  The file IKE.elg will be created in the log directory.  Load IKEView and open the IKE.elg file.

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Lab 1-2 : Hybrid Mode

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Logical architecture VPN-1 HUBHUB FW/VPN Module + Management CLIENT SERVER HUBHUB SecureServer VPN RADIUS Auth

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-2 : Hybrid Mode Goal : establish a client-to-site IKE VPN using Radius to authenticate the remote user. Goal : establish a client-to-site IKE VPN using Radius to authenticate the remote user. IMPORTANT: You must define a user with pre-shared secret to download the topology. IMPORTANT: You must define a user with pre-shared secret to download the topology.

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-2 : Hybrid Mode Define a user with pre-shared secret to dowload the topology Define a user with pre-shared secret to dowload the topology  Not member of any group Create the Internal CA on the Management Station Create the Internal CA on the Management Station Create a Certificate for the VPN/Firewall Module Create a Certificate for the VPN/Firewall Module Allow "Hybrid" Mode SecuRemote Authentication on the Firewall Object (IKE Tab) Allow "Hybrid" Mode SecuRemote Authentication on the Firewall Object (IKE Tab) Define a User with one of the classical authentication methods (ex: RADIUS) Define a User with one of the classical authentication methods (ex: RADIUS) Update the SecuRemote Site with the first user Update the SecuRemote Site with the first user Test authentication Test authentication  Check logs

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Lab 1-3 : SecureClient

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Logical architecture VPN-1 HUBHUB FW/VPN Module + Management + Policy Server CLIENT SERVER HUBHUB SecureServer VPN

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-3 : SecureClient Define a Policy Server Define a Policy Server Define a policy (encrypt only) Define a policy (encrypt only) Update SecureClient Site Update SecureClient Site Reach TelnetServer Reach TelnetServer  Try to ping Configure SCV (Desktop Configuration Verification) Configure SCV (Desktop Configuration Verification)  Then bind NetBeui on the client Try to reach TelnetServer Try to reach TelnetServer  Then uncheck SCV

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-3 : SecureClient (Advanced) View unauthorized actions on SecureClient View unauthorized actions on SecureClient  View SR.log file

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Lab 1-4 : SecureServer

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Logical architecture VPN-1 HUBHUB FW/VPN Module + Management CLIENT SERVER HUBHUB SecureServer VPN

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-4 : SecureServer Goal is to establish end-to-end VPN between client and Server. Goal is to establish end-to-end VPN between client and Server. Create new encryption domain for VPN1 Create new encryption domain for VPN1 Change VPN properties for VPN1 Change VPN properties for VPN1  Encryption domain Enable VPN for SecureServer Enable VPN for SecureServer Create Certificate for Secureserver (Hybrid mode) Create Certificate for Secureserver (Hybrid mode) Register SecureServer as a Radius Client Register SecureServer as a Radius Client

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-4 : SecureServer Update topology Update topology Access Secureserver with telnet Access Secureserver with telnet Check Logs Check Logs

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Lab 1-4 : SecureServer Warning: A security rule, with the field « Install on » filled with « Gateways », doesn’t take care of SecureServer (just gateways ) A security rule, with the field « Install on » filled with « Gateways », doesn’t take care of SecureServer (just gateways ) Features not available on SecureServer Features not available on SecureServer  User Authentication  Content Security (CVP, UFP..)  NAT  IP forwarding is turned off (…)

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Lab 1-5 : SR/SC behind NAT Hide

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Logical architecture SecureServer VPN-1 HUBHUB FW/VPN Module + Management CLIENT SERVER HUBHUB SecureServer VPN SR/SC is NATed Hide behind this address (=Routeur) Customer site

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential NAT with SecuRemote Cont. Create a new network object for Net Create a new network object for Net  Nated Hide behind Uncheck VPN properties for VPN1 Uncheck VPN properties for VPN1 Bind Policy Server to SecureServer Bind Policy Server to SecureServer Modify Rulebase Modify Rulebase Create new SR site (Secureserver) Create new SR site (Secureserver) Access SecureServer with telnet Access SecureServer with telnet Check Logs Check Logs

©2000 Check Point Software Technologies Ltd. - Proprietary & Confidential Agenda Lab 1-1 : VPN Client to Gateway Lab 1-1 : VPN Client to Gateway Lab 1-2 : Hybrid Mode Lab 1-2 : Hybrid Mode Lab 1-3 : SecureClient Lab 1-3 : SecureClient Lab 1-4 : SecureServer Lab 1-4 : SecureServer Lab 1-5 : SR/SC behind NAT Hide Lab 1-5 : SR/SC behind NAT Hide

W O R L D W I D E L E A D E R I N S E C U R I N G T H E I N T E R N E T Q & A ? Thank you