Checkpoint 簡單配置手冊

①號s與odMu圭uCheckPointWeSecdF?the,■>MoreSecuritySolutions9ContactInformationCheckpoint簡單配置手冊一?客戶端軟件SmartConsole安裝1.運行Checkpoint集成安裝包ThankyouforchoosingCheckPointSoftwareTechnologiesTheworldwideleaderinInternetsecurityPleasemakesureyouhaveobtainedalicensebeforecontinuing.IfyoudonothavealicansejseeyourresellerorvisittheC：h曰匚kPed門tU邑er匚日門ter.①號s與odMu圭uCheckPointWeSecdF?the,■>MoreSecuritySolutions9ContactInformationWerecommendthatyoucloseallotherapplicationsbeforerunningthisinstallationprogram.???EvaluationOptions???ReadMoreAboutInstallationThisproductisprotectedcopyrightI■幫and

■allunauthorizedreproductionifforbidden.安裝管理防火墻的客戶端2Findthe七up?tT?dmtHinformationabouttheproductsInstallserverproductsbasedonimportedconfigurationfromanotherSmartCentarsarveronthisCD.C*CheckPointEnterprise/ProCheckPointEnterprise/Pro-forheadquartersandbranchoffices.CCheckPointEwpressCheckPointExpress-formediurr-sizedWeSecurethefnii&nwrt.中MoreSecuritySolutionsContactInformationPleaseselectonaofthefollowingoptions:Don'thaueaconfigurationfileyet?Le.mr「?「「心0.■CDemoInstallationInstallSmartconsoleGUIclientsonly(*NevjInstallationInstallSmartconsoleGUIcliantsand/oradditionalserverordesktopsecurityproductsInstallationUsingImportMoreSecuritySolutionsContactInformation只選擇安裝SmartConsole,別的都不選H1Movemouseover■n?mctoH1Movemouseover■n?mctoreadaboutI%thatproduct.ChecktheboxnexttoIthenametoinstallthatproduct./WoStCjr-Crr(?Il：criut?部MoreSecuritySolutions令ContactInformationdashboard-styleGUI.ThisarchitecturedeliversthemostrobustmechanismtocreateVPN,firewall,andQoSpoliciesandautomaticallydistributethemtomultipleenforcementpoint5,thusreducinglaborandcuttingcosts.GATEWAYI-VPN-1ProPiVPN-1AccalEratorCards.FloodGate-1I-SecuraClientPolicyServer[GmartViewMonitorr~UserAuthorityMANAGEMENTSERVER|~SmartCantar|—SmartViewReportarMANAGEMENTCDMSOLEpSmartConsoleVPNCLIENTAVPN-1SecuRsmote/VPN-1SecuraClientCheckPoint'sthree-tierarchitectureCheckPoint'sthree-tisrarchitectureconsistsofgateway-,client-.,andhost-bassdsecurity日nforcementpointsjacentralizedmanagementserverandanintuitiveVf^lX■BackINextIExit選擇安裝SmartConsole的所有組件二.配置Checkpoint防火墻1.運行SmartConsole中的SmartDashboard組件IiAEiUN我的電腦PacketGnideSecureCRT4.0WindowsUpdate英語小精靈《網(wǎng)絡(luò)鸚鵡.聽新聞》打開Office文檔新建Office文檔Yahoo!MessengerLaunchRealOnePlayerACDSystemsCPDameWareNTUtilitiesffdshowFlashFXF2.0.910GetRigjitHyperSnap-DXNetAntsPacketGnideforPacketWisedD件XV陽宕宕三宕宕宕宕SecureCRT4.0VobSubWiriairipWinlSOWinEAR金山詞霸2005Faust6.IiAEiUN我的電腦PacketGnideSecureCRT4.0WindowsUpdate英語小精靈《網(wǎng)絡(luò)鸚鵡.聽新聞》打開Office文檔新建Office文檔Yahoo!MessengerLaunchRealOnePlayerACDSystemsCPDameWareNTUtilitiesffdshowFlashFXF2.0.910GetRigjitHyperSnap-DXNetAntsPacketGnideforPacketWisedD件XV陽宕宕三宕宕宕宕SecureCRT4.0VobSubWiriairipWinlSOWinEAR金山詞霸2005Faust6.0密WinHexIsCheckPointSmartConsoleR55Yahoo!Yahoo!MailYahoo!MessengerFoundstoneMSXfflL4.0BitCometEtherealBosonSoftwareCheckPointVFNTSecureClientSkyManagerKealOneFlayer聯(lián)眾世界SmartI￡M淮SmartDashboardSmartUpdateSmartViewSmartViewSmartViewSmartViewMonitor位置：C：\PrograiTiFiles\CheckFoint\SmartConsole\E55\FROGRAMReporterStatusTrackerUserMonitor管理工具啟動一.aB1^。^文檔?設(shè)置⑤搜索(￡)幫助QD運行3).O關(guān)機更).宕[Con...|未..?、$MSNMessenger6.2TeleportProInternetExplorerOutlookExpressVfflwareMicrosoftOffice工具SnifferPro閃客F0北播放器英語小精靈AcrobatDistiller5.0AdobeAcrobat5.0MicrosoftMicrosoftMicrosoftMicrosoftMicrosoftMicrosoftSerWFT]AccessExcelFrontPageOutlookPowerPointWord'Server2.登錄防火墻管理模塊SmartCenter?CheckPointSmartDashboardFileEditViewManageRulesFolicySeal*ch.WindowHelpqq奇醯囑H瞰!迫版鼬|]回|]明，冒皆笛崽取h導(dǎo)擊晝目亨工區(qū)|[]廂廂I目君81|]￡鼠|讖吸國X|]&N嗜|南|曜富斗憐|4|賽|呂|險|ForHelp,pressFl輸入用戶名，密碼，防火墻管理模塊的IP地址;SmartDashboard要求驗證防火墻的指紋屬性，選擇“Approve”通過驗證即可進入防火墻配置界面3.建立被防火墻管理的網(wǎng)絡(luò)對象主機(Nodes)對象的建立右鍵選擇界面左側(cè)的對象欄里的Nodes，從彈出菜單里選擇newnodes->host

添加主機對象IP4填寫Name:IP4填寫IP：4選擇是否“WebServer”；如果選中了“WebServer”則Checkpoint會自動打開對該機的http服務(wù)的相關(guān)防護措施；靜態(tài)NAT配置因為該Server需要被靜態(tài)映射到外網(wǎng)段的38地址上去，所以必須必須選擇該主機屬性里的“NAT”選項配置NAT

選擇“AddAutomaticAddressTranslation(自動地址翻譯)”選項在Translation下拉選項框中選擇“Static”在TranslatetoIP文本框中填寫該主機映射之后的IP地址：3點擊“OK”網(wǎng)絡(luò)服務(wù)對象(Services)的添加進入services對象欄，右鍵點擊TCP對象，從彈出菜單里選擇NewTCP身高［&冒］日Q|*勉瞄|］餐也跳■|］國|］獸菌號妥電崇』

］壑工運|j用畫I霧:防|21留|］［V4|&q何:X|］%而1-1零甌_竺些I??s-s-..:B-.:a-.gl-1ffl-.:E-::s-::sl'!.ffl-Fc:MEpIcDCE-RPCOtherGroupNO.SOURCEDESPNAFONVPNSERVICEACTIONTRACKINSTALLON1AAny□IPAnyTraffic*accept-None*PolicyTargets在彈出對話框里填入必要的信息填寫Name:CaiWuPort:84443.安全規(guī)則(Rules)的添加從菜單欄里選擇Rules->AddRules->Bottom系統(tǒng)添加的默認策略是“anyanydrop”，即全部丟棄，需要對其進行修改右鍵點擊第一條規(guī)則“DESTINATION”欄里的“Any”對象，從彈出菜單里選擇“Add”從彈出對話框里選擇“IP”對象右鍵點擊第一條規(guī)則“SERVICE”欄里的“Any”對象，從彈出菜單里選擇“Add”從彈出對話框里選擇“CaiWu”對象右鍵點擊第一條規(guī)則“ACTION”欄里的“drop”對象，從彈出菜單里選擇“accept”；以使匹配該規(guī)則的數(shù)據(jù)包被允許通過FileEditViewManageRulesPolicySmartMapSearchWindowHelp||qoIx%n］輪膽眼典］國］艇鹵■哥■&理取||］呀宙魁囹IMx冒］所畫$：：JF國刀|］［VoH禰］%牛嗜|南日斗Netwoi'kObjacts由一|鳥CheckPoint-回Nodes'□Qi^iZhiJi:口WEB-SEKVERNetworks9…國Groupe白??盛］AdiiressRangee:一器IlB-SEmRFileEditViewManageRulesPolicySmartMapSearchWindowHelp||qoIx%n］輪膽眼典］國］艇鹵■哥■&理取||］呀宙魁囹IMx冒］所畫$：：JF國刀|］［VoH禰］%牛嗜|南日斗Netwoi'kObjacts由一|鳥CheckPoint-回Nodes'□Qi^iZhiJi:口WEB-SEKVERNetworks9…國Groupe白??盛］AdiiressRangee:一器IlB-SEmR+邕IijTL：=unicObjectsNO.SOURCEDESTINATIONVPNSERVICEACTIONTRACK帳TALLON*PolicyTargetsSecurity|AddressTranslation］SmartBefense|VPNManager|?□DesktopSecurityClientAuthSessionAuthQ.ueryCoIxutiil...ClearQuery2J:兇IForMelp^pressFlQe1x四「號高眥圖j婺X1=楚回=FM1：!仄Q|Q?詞XI%嘈11E54—CheckPointSaartDashbo?rd—StandardFileEditViewManageRulesPolicySm^i?圳apSearchtfindowHelp車冏鼠麻|￡|您|日…￡1.NetworkObjects由J皇|CheckPoint白?,阻］NodesIPIP4".國Networksjgg/<5roups白圜AddressRangesRangelO.11.0.2-5S1^1DynamicObjectsNO.SOURCEDESTINATIONVPNSERVICEACTIONTRACKINSTALLONTCPcaiWu1*Any□IP10.I1.0.I因AnyTrafficAddressTraxislatioxi|儡jSmartDefense|VPNManager|?□DeskiopSecurity|□IP10.19一0.34|*Any蕉Rangel0.11,0.2-T￡P(guān)scjinetl遂acceptgm?*PolicvTargets~:―:——■Nnnaaccept*AnyAnyTraffic*AnySnmpTrapMailUserDefinedUserDefined2UserDefined3Qu&f.Golumit-.按照上面的方法添加其余規(guī)則，以允許IP4訪問Range-5對象的sqlnetl服務(wù)He|xft