Chapter 6 - Firewall and DMZ Design: Check Point NG

Abstract

This chapter reviews the basics of Check Point NG FireWall-1/VPN (virtual private network)-1 to give a solid understanding about firewall's operating process and features. Check Point NG FireWall-1/VPN-1 is a full-featured firewall that runs on a variety of platforms including Sun Solaris, Microsoft Windows NT/2000, and dedicated appliances manufactured by Nokia and Check Point. A key component of any security policy is a well-designed demilitarized zone (DMZ). Because hosts in the DMZ are externally accessible over the Internet, DMZ's design can make or break the overall security of network because the DMZ can be the entry point for malicious-minded individuals into the network. FireWall-1/VPN-1 also has significant VPN capability for both site-to-site and user-to-site configurations. Site-to-site VPN is interoperable with products from all other major firewall vendors. For user VPN access, two varieties of VPN client—SeculKemote and SecureClient— are available with the latter providing personal firewall functionality in addition to the standard VPN features of SeculKemote.