CheckPoint NG

Article
02/29/2008

This topic describes how to configure Checkpoint NG to work in a virtual private network (VPN) site-to-site solution with ISA Server.

Checkpoint: Preshared Secret Configuration Overview

The following IPSec settings will be used in this section of this configuration document:

Phase I
- Main mode
- 3DES
- SHA-1
- MODP Group 2 (1024 bits) for DH
- SA lifetime of 28,800 seconds
- Preshared secret
Phase II
- 3DES
- SHA-1
- PFS & MODP Group 2 (1024 bits) for DH
- SA lifetime of 3600 seconds
- ESP tunnel mode

Preshared Secret Checklist

Use the following checklist for preshared secrets.

____	Install and configure the Sonicwall device
____	Determine remote gateway external IP address
____	Determine remote networks IP address and netmask protected by the remote gateway
____	Set preshared secret
____	Configure new policy
____	Configure network and group objects
____	Modify CheckPoint object
____	Configure VPN peer gateway
____	Configure encryption rule
____	Test IPSec tunnel

For installation and configuration information and documentation, refer to the documents found on the CheckPoint website (www.checkpoint.com).

Checkpoint Configuration Walk-through Procedure 1: Configuring the Preshared Secret Solution

This topic describes in detail the process to configure the CheckPoint NG FP3 to successfully establish a site-to-site IPSec tunnel with the ISA Server computer using the settings specified in Checkpoint: Preshared Secret Configuration Overview. This section includes tips that can be used to improve the functionality of the IPSec tunnel, performance of the device, or the security of the device.

Note

The step-by-step instructions in the following sections assume that you have a working knowledge of CheckPoint NG FP3, and only the parameters directly related to the scenarios are described in detail.
If the CheckPoint Firewall is loaded onto a Windows-based operating system, the registry key \HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\Tcpip\ Parameters requires a change from a value of 0 to a value of 1 to allow for the proper routing of encrypted communications through the IPSec tunnel.

Configure New Policy

Use the following steps to configure new policy.

Log on to the CheckPoint Management Server using the CheckPoint Smart Dashboard.
Choose Global Properties from the Policy menu. On this page:
- Select VPN-1 Pro from the left menu.
- Select Traditional or Simplified mode per new Security Policy.
Choose New from the File menu. On this page:
- Enter a name in New Policy Package Name.
- Select Security and Address Translation.
- Select Traditional mode.

Configure Network and Group Objects

Use the following steps to configure network and group objects.

From the left menu of the CheckPoint Smart Dashboard, right-click Networks and select New. On the General tab:
- Enter Internal_AL as the Name of the network.
- Enter 10.5.6.0 as the Network Address.
- Enter 255.255.255.0 as the Net Mask.
Repeat the steps. On the General tab:
- Enter Internal_CL as the Name of the network.
- Enter 10.4.5.0 as the Network Address.
- Enter 255.255.255.0 as the Net Mask.
From the left menu of the CheckPoint Smart Dashboard, right-click Groups and select new simplified. On this page:
- Enter ISAServer-Remote as the Name of the network.
- Highlight Internal_AL.
- Select Add to move Internal_AL from Not in Group into In Group.
- Highlight Internal_BL.
- Select Add to move Internal_BL from Not in Group into In Group.

Modify CheckPoint Object

Use the following steps to modify the checkpoint object.

From the left menu of the CheckPoint Smart Dashboard, expand the Check Point menu and double-click the checkpoint object to display the Check Point Gateway – checkpoint properties screen.
Select Topology from the left menu:
- Review the Topology settings for accuracy.
- Review the VPN Domain settings to ensure that All IP Addresses behind Gateway based on Topology information is selected.
Select VPN from the left menu, and then select Traditional mode configuration.
In the Traditional mode IKE properties screen:
- Select 3DES.
- Select SHA1.
- Select Pre-Shared Secret.
- Select Edit Secrets.
In the Shared Secret screen:
- Highlight ISAServer.
- Select Edit.
- Enter Cool-Dude! in Enter secret.
- Select Set.
Select Advanced in the Traditional mode IKE properties screen.
In the Traditional mode advanced IKE properties screen:
- Select Group 2 (1024 bit).
- Enter 480 in Renegotiate IKE (phase 1) Security Associations every**.**
- Enter 3600 in Renegotiate IPSec (IKE phase 2) Security associations every**.**

Configure VPN Peer Gateway

Use the following steps to configure the VPN peer gateway.

From the left menu of the CheckPoint Smart Dashboard, right-click Interoperable Device and select new. On this screen:
- Enter ISAServer as the Name of the interoperable device.
- Enter 14.15.16.17 as IP Address of the interoperable device.
Select Topology from the left menu. On this screen:
- Select Manually defined under VPN Domain
- Select ISAServer-Remote from the drop-down list.
Select VPN from the left menu, and then select Traditional mode configuration.
In the Traditional mode IKE properties screen:
- Select 3DES.
- Select SHA1.
- Select Pre-Shared Secret.
- Select Edit Secrets.
In the Shared Secret screen:
- Highlight checkpoint.
- Select Edit.
- Verify Cool-Dude! is the shared secret.
Select Advanced in the Traditional mode IKE properties screen.
On the Traditional mode advanced IKE properties screen:
- Check Group 2 (1024 bit).
- Enter 480 in Renegotiate IKE (phase 1) Security Associations every**.**
- Enter 3600 in Renegotiate IPSec (IKE phase 2) Security associations every**.**

Configure Encryption Rule

Use the following steps to configure an encryption rule.

Choose Add Rule --> Top from the Rules menu.
In the new rule:
- Select ISAServer-Remote for the Source.
- Select Internal_BL for the Destination.
- Select Encrypt as the Action.
- Select Log as the Track.
Choose Add Rule --> Top from the Rules menu.
In the new rule:
- Select Internal_BL for the Source.
- Select ISAServer-Remote for the Destination.
- Select Encrypt as the Action.
- Select Log as the Track.
Right-click Encrypt under Action for rule number 1. On the General tab:
- Highlight IKE.
- Select Edit.
Right-click Encrypt under Action for rule number 1. On the General tab:
- Select 3DES as the Encryption Algorithm from the drop-down list.
- Select SHA1 as the Data Integrity from the drop-down list.
- Select Use Perfect Forward Secrecy.
- Select Group 2 (1024 bit) as the Use DH Group from the drop-down list.
Test the IPSec tunnel after the third-party gateway peer has been configured by sending icmp traffic to the remote internal network through the IPSec tunnel using the ping utility.

Checkpoint: Certificate Configuration Overview

This section outlines the IPSec settings and the specific settings required for this device to perform Certificate Authentication.

The following IPSec settings will be used in this section of this configuration document:

Phase I
- Main mode
- 3DES
- SHA-1
- MODP Group 2 (1024 bits) for DH
- SA lifetime of 28,800 seconds
- Certificate Authentication
Phase II
- 3DES
- SHA-1
- PFS & MODP Group 2 (1024 bits) for DH
- SA lifetime of 3600 seconds
- ESP tunnel mode

Certificate Checklist

Use the following checklist for certificates.

____	Install and configure Cisco Concentrator 3005 VPN Concentrator
____	Determine remote gateway external IP address
____	Determine remote networks protected by the remote gateway
____	Determine certification authority to use to create the local certificate
____	Configure new policy
____	Configure network and group objects
____	Configure certification authority
____	Modify CheckPoint object
____	Configure VPN gateway peer
____	Configure encryption rule
____	Test IPSec tunnel

For installation and configuration information and documentation, refer to the documents found on the CheckPoint website (www.checkpoint.com).

Checkpoint Walk-through Procedure 2: Configuring the Certificate Solution

This topic describes in detail the process to configure the CheckPoint NG FP3 to successfully establish a site-to-site IPSec tunnel with the ISA Server computer using the settings specified in Checkpoint: Certificate Configuration Overview. This section includes tips that can be used to improve the functionality of the IPSec tunnel, performance of the device, or the security of the device.

Note

The step-by-step instructions in the following sections assume that you have a working knowledge of CheckPoint NG FP3, and only the parameters directly related to the scenarios are described in detail.
If the CheckPoint Firewall is loaded onto a Windows-based operating system, the registry key \HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\Tcpip\ Parameters requires the change from a value of 0 to a value of 1 to allow for the proper routing of encrypted communications through the IPSec tunnel.