EasyManua.ls Logo

Check Point QUANTUM SPARK 1500 - User Manual

Check Point QUANTUM SPARK 1500
332 pages
Print Icon
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Loading...
31 August 2023
QUANTUM SPARK 1500,
1600, AND 1800
APPLIANCES
R81.10.X
Locally Managed
Administration Guide

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Check Point QUANTUM SPARK 1500 and is the answer not in the manual?

Summary

Overview of Quantum Spark 1500, 1600, and 1800 Appliance Series

1500 Appliances

Details the Quantum Spark 1500 appliance series, including its features and capabilities.

1600 and 1800 Appliances

Describes the Quantum Spark 1600 and 1800 Security Appliances and their enterprise-grade security features.

Getting Started with 1500, 1600, and 1800 Appliance Series

Workflow

Outlines the step-by-step process for getting started with the appliance setup and configuration.

Setting Up the Quantum Spark Appliance

Connecting the Cables

Provides instructions on connecting the necessary cables to the appliance for initial setup.

Using Default WiFi

Explains how to use the default SSID for WiFi connection setup.

First Time Deployment Options

Zero Touch Cloud Service

Details the Zero Touch Cloud Service for managing initial gateway deployments.

Deploying from a USB Drive or SD Card

Guides on deploying configuration files using USB or SD cards for quick appliance setup.

Deploying the Configuration File - Initial Configuration

Deploying the Configuration File - Existing Configuration

Viewing Configuration Logs

Explains how to view configuration logs after a successful USB drive configuration.

Troubleshooting Configuration Files

Configuration File Error

Addresses issues when the configuration file fails and the appliance is not fully configured.

Suggested Workflow - Configuration File Error

Provides a workflow for resolving errors with configuration files on a USB drive.

Configuring Cloud Services

To automatically connect to Cloud Services

Steps to automatically connect the appliance to Cloud Services via an activation link.

To connect manually to Cloud Services

Steps to manually connect the appliance to Cloud Services via the WebUI.

Configuring a Guest Network

Prerequisites

Lists requirements for configuring a guest network, such as a wireless network.

Configuration

Details the steps to configure a guest network, including hotspot settings.

Introduction to the WebUI

Controlling and Monitoring Software Blades

To enable or disable a Software Blade

Instructions on how to toggle the Software Blades between ON and OFF states.

To see or edit setting information

Steps to view and edit the settings for individual Software Blades.

Setting the Management Mode

Security Management Server

Details on viewing management connection status and adjusting trust settings.

Managing Licenses

To configure the proxy details

Steps to configure proxy details for license activation if required.

If your appliance is not registered

Instructions for registering the appliance and activating its license.

Managing Active Devices

Blocking a Device Temporarily

Procedure to temporarily block a device from network activity.

Viewing Monitoring Data

Network

Details network statistics like bandwidth usage, traffic, and top consumers.

Security

Provides information on infected devices, high-risk applications, and security events.

Using System Tools

Monitor System Resources

Opens popup windows showing CPU, memory, and disk usage history.

Show Routing Table

Opens a popup window displaying route information like source, destination, and gateway.

Test Cloud Services Ports

Tests Cloud Services connectivity using Gaia Clish command.

Configuring Internet Connectivity

The Configuration tab

Details configuration options for WAN, LAN, Bonds, USB/Serial, and ADSL/VDSL interfaces.

IPv6 connection types

Describes various connection types for IPv6, including Static, DHCPv6, PPPoE, and Bridge.

Creating a New Bond (WAN)

Operation mode

Selects the operation mode for the bond, such as 802.3ad, Round Robin, XOR, or High Availability.

Configuring the Wireless Network

To enable or disable the Wireless network

Instructions to enable or disable the wireless network and its VAPs.

To configure a new wireless network or edit an existing network

Steps to add, configure, or edit wireless networks (SSIDs) and their security settings.

Dynamic Frequency Selection (DFS)

Explains DFS feature for WiFi6, detecting radar signals and switching channels.

Configuring the Local Network

Reserved IP Address for Specific MAC

Configures static IP assignments for known hosts using MAC addresses.

Switch

Guides on creating and editing network switches for LAN ports.

WAN as LAN

Enables using the WAN port for internal LAN connections.

Monitor Mode

Configures the appliance to monitor traffic using Automatic Learning or user-defined networks.

Bridge

DHCP Server

Configuration options for the DHCP server within a bridge interface.

VLANs

Alias IP

Associates multiple IP addresses with a single network interface.

VPN Tunnel (VTI)

Configuring a Hotspot

To define a network interface for a Hotspot

Steps to define a network interface for Hotspot functionality.

Customize the Hotspot portal appearance

Guides on customizing the Hotspot portal's title, message, and logo.

Hotspot exceptions

Defines IP addresses, ranges, or networks to exclude from the Hotspot.

User Authentication

To require user authentication

Steps to enable user authentication for access control.

To configure the session timeout

Sets the duration for which a user remains logged in before session ends.

Configuring MAC Filtering

To enable MAC filtering

Enables MAC filtering by adding MAC addresses to the LAN MAC Filter allowlist.

To edit the LAN MAC Filter allowlist

Instructions to add, edit, or delete MAC addresses from the allowlist.

802.1 x Authentication Protocol

To enable 802.1 x authentication on a LAN switch or interface

Guides on enabling 802.1x authentication for LAN interfaces.

Configuring the DNS Server

To configure DNS

Steps to define DNS servers and configure the domain name.

Configuring the Proxy Server

Backup, Restore, Upgrade, and Other System Operations

To backup appliance settings

Procedure to create a backup file of appliance settings.

To restore a backed up configuration

Steps to restore appliance settings from a backup file.

Using the Software Upgrade Wizard

Guides on using the Software Upgrade Wizard for appliance firmware updates.

Configuring Local and Remote System Administrators

Administrator Roles

Details the different administrator roles and their permissions.

Local Administrators

Instructions for creating, editing, and deleting local administrators.

Remote Administrators

Configuration for allowing remote administrators access via RADIUS server.

Configuring a Steel-Belted RADIUS server for non-local appliance users

Configuring Administrator Access

To allow administrator access from any IP address

Steps to allow administrator access from any IP address.

To allow administrator access from specified IP addresses

Steps to allow administrator access from specified IP addresses.

Managing Device Details

To assign a Web portal certificate

Procedure to assign a Web portal certificate to the appliance.

Managing Date and Time

To configure date and time manually

Steps to manually set the appliance's date and time.

To set the date and time using a Network Time Protocol (NTP) server

Procedure to synchronize appliance clocks with an NTP server.

Configuring DDNS and Access Service

DDNS

Configures Dynamic DNS to update the provider with IP addresses for host name access.

Reach My Device

Enables remote connection to the appliance via WebUI or CLI through Check Point Cloud Service.

Using System Tools

Monitor System Resources

Opens popup windows showing CPU, memory, and disk usage history.

Show Routing Table

Opens a popup window displaying route information like source, destination, and gateway.

Test Cloud Services Ports

Tests Cloud Services connectivity using Gaia Clish command.

Advanced Routing

BGP

Configures Border Gateway Patrol (BGP) dynamic routing settings.

OSPF

Configures Open Shortest Path First (OSPF) dynamic routing settings.

Inbound Route Filters

Controls which external routes a routing protocol accepts.

Configuring the Routing Table

Routing Table Columns

Explains the columns in the routing table: Destination, Source, Service, Next Hop, Metric, Protocol, Rank.

Limitations

Details limitations regarding default routes and static routes with VPN Tunnels.

Adding a Specific IPv4 Static Route

Adding a Default IPv4 Static Route

Enabling or Disabling an Existing Static Route

Managing Installed Certificates

Covers creating, managing, and uploading appliance certificates.

Configuring High Availability

Limitations

Details limitations for cluster configuration, such as switches, bridges, and Bond interfaces.

Prerequisites

Lists requirements before configuring a cluster, like deleting bridges/switches.

Configuration Workflow

Configuring a Primary Cluster Member

Configuring a Secondary Cluster Member

Viewing Cluster Interfaces

List of Configured Interfaces

Shows information about the cluster interfaces, including name and status.

Viewing the Cluster Status

Failing Over Manually

Procedure for manually failing over between primary and secondary cluster members.

Managing the Access Policy

Configuring the Firewall Access Policy and Blade

Guides on setting default access policy control level and configuring Firewall Blade.

Firewall Policy

Details options for setting the default Access Policy: Strict, Standard, or Off.

Application & URL Filtering

Defines how to handle applications and URL categories for traffic control.

User Awareness

Identity Sources

Describes sources for user identification: AD Query, Browser-Based Authentication, Identity Collector.

Enabling User Awareness

Steps to enable and configure the User Awareness blade.

Working with the Firewall Access Policy

Firewall Policy

Explains how to manage the Firewall Rule Base, including creating and editing rules.

Configuring Access Rules

Provides steps to create new manually defined access rules for the policy.

Updatable Objects

To import an updatable object

Steps to import updatable objects for use in firewall policy rules.

Defining Firewall Servers

Step 1: Server Type

Selects the type of server for object definition.

Step 2: Server Definitions

Enters server name, IP address, and selects applicable options.

Step 3: Access

Selects zones from which the server is accessible.

Defining NAT Control

To disable NAT for outgoing traffic (Hide NAT)

Instructions to disable NAT by setting 'Hide internal networks' to OFF.

Advanced - Creating and Editing NAT Rules

Rule Base Field

Describes fields for managing NAT rules: Original Source, Destination, Service, Translated.

Inspecting VoIP Traffic

To configure VoIP inspection in the WebUI

Steps to enable and configure VoIP inspection settings in the WebUI.

On-premise Devices

Details on configuring on-premise devices for VoIP traffic inspection.

Configuring Smart Accel in R81.10.05 and higher

Smart Accel for Services

Enables Smart Accel for services to bypass network inspection.

Smart Accel for Assets

Enables Smart Accel for assets to bypass network inspection.

Working with User Awareness

Identity Sources

Describes sources for user identification: AD Query, Browser-Based Authentication, Identity Collector.

Enabling User Awareness

Steps to enable and configure the User Awareness blade.

Configuring QoS

Configuring the QoS Blade

Activates QoS and configures the default QoS policy.

Configuring the QoS Policy

Configures manual QoS policy rules for bandwidth control.

SSL Inspection Policy

SSL Inspection

Enables and configures SSL inspection to inspect encrypted traffic.

Deploying SSL Inspection

Steps to deploy SSL inspection by selecting and downloading the CA certificate.

SSL Inspection Bypass Policy

Configures exceptions to bypass SSL inspection for specific traffic.

Managing Threat Prevention

Configuring Threat Prevention Blade Control

Activates IPS, Anti-Virus, Anti-Bot, and Threat Emulation blades.

Configuring a Custom Policy for Threat Prevention

Steps to configure a custom policy for threat prevention with tracking and actions.

Configuring Threat Prevention Policy Exceptions

Threat Prevention Exceptions

Configures exception rules for traffic not inspected by IPS, Anti-Virus, and Anti-Bot.

Viewing Infected Devices

The Infected Devices table shows this information for each entry

Details columns in the Infected Devices table: Icon, Object name, IP/MAC address, Incident type, Severity, Protection name, Last incident.

Advanced Threat Prevention Engine Settings

IPS

Configures settings for newly downloaded protections like Active, Detect, or Inactive.

Anti-Virus

Scans incoming files for viruses and configures mail settings.

Threat Emulation

To configure the Threat Emulation settings

Sets up file type policy and HTTP connection emulation handling mode.

Configuring the Anti-Spam Blade Control

To configure Detect-only mode

Configures the Anti-Spam blade to log emails but not block them.

To configure the Anti-Spam Policy

Sets actions for spam emails: Block, Flag subject, or Flag header.

Configuring Anti-Spam Exceptions

SSH Authentication

Enables RSA key authorization for SSH login instead of password-based authentication.

Managing VPN

Configuring VPN

Configuring Remote Access VPN

Introduces options for remote access VPN like Check Point VPN clients and SSL VPN.

Remote Access Configuration

Details methods to configure remote access users: Local, RADIUS, and AD users.

Configuring Site to Site VPN with a Preshared Secret

Prerequisites

Ensures Site to Site VPN blade is ON and remote site is configured.

Configuration

Enters host name/IP and preshared secret for VPN authentication.

Configuring Site to Site VPN with a Certificate

Prerequisites

Ensures Site to Site VPN blade is ON and remote site is configured with certificates.

Configuring the Remote Access Blade

Configuring VPN

To configure Two-Factor Authentication

Steps to configure Two-Factor Authentication for VPN users.

Configuring Remote Access Users

Adding a new local user with remote access permissions

Procedure to add new local users with remote access permissions.

Adding new users from Active Directory; RADIUS

Populates users and groups from Active Directory or RADIUS servers.

Configuring Advanced Remote Access Options

Office Mode

Configures Office Mode network settings for remote access VPN clients.

To assign a VPN certificate

Assigns a VPN certificate for authentication.

Configuring the Site to Site VPN Blade

To enable or disable the VPN Site to Site blade

Enables or disables the appliance's ability to create VPN tunnels with remote sites.

To configure the default access policy from remote VPN sites

Configures default access policy for traffic from remote VPN sites.

Configuring VPN Sites

Remote Site

Configures remote site details: name, connection type, authentication, and encryption domain.

Encryption

Changes default settings for encryption and authentication details.

Advanced

Enables permanent tunnels, disables NAT, configures encryption, and certificate matching.

Viewing VPN Tunnels

To filter the list

Filters the list of VPN tunnels by entering criteria in the Type to filter box.

Configuring Advanced Site to Site Settings

Configuring the Appliance Interfaces

Specifies interfaces for incoming/outgoing VPN traffic and determines the best path.

Tunnel Health Monitoring

To test if a VPN tunnel is active

Selects a tunnel health monitoring method: Tunnel test or DPD.

Managing Trusted CAs

To add a trusted CA

Steps to add a CA certificate to the trusted CA list.

Managing Installed Certificates

To create a signed certificate

Steps to create a signing request, export it, and upload the signed certificate.

To create a new certificate to be signed by a CA

Procedure to create a new certificate signing request.

Managing Internal Certificates

To reinitialize certificates

Reinitializes certificates, especially when IP addresses change.

To replace an internal CA certificate

Replaces the internal CA certificate with a new one.

Managing Users and Objects

Working with User Awareness

Enforces access control and shows user-based logs.

Identity Sources

Describes sources for user identification: AD Query, Browser-Based Authentication, Identity Collector.

Configuring Local Users and User Groups

To add a new local user

Procedure to create a new local user with remote access permissions.

To add a new local users group with remote access permissions

Adds a new local users group with remote access permissions.

Configuring Local and Remote System Administrators

Administrator Roles

Details the different administrator roles and their permissions.

Local Administrators

Instructions for creating, editing, and deleting local administrators.

Remote Administrators

Configuration for allowing remote administrators access via RADIUS server.

Managing Authentication Servers

RADIUS server

Defines primary and secondary RADIUS server details for authentication.

Active Directory domain

Defines Active Directory domain details for user information and VPN authentication.

TACACS+ Server

Managing Applications & URLs

What is a custom application?

Defines a custom application using URL strings or regular expressions.

The Application and Categories List

Lists applications and categories filtered by Common, Custom, Categories, or All.

Managing System Services

To create a new service

Steps to add new services, defining name, type, ports, and IP protocol.

Managing Service Groups

To create a new service group

Steps to create new service groups by selecting services.

Managing Network Objects

To create a network object of type Single IP

Creates a network object representing a device with a single IP address.

To create a network object of type IP Range

Creates a network object representing a range of IP addresses.

To create a network object of type Network

Creates a network object representing a network address and subnet mask.

To create a network object of type Domain Name

Creates a network object representing a Domain Name (FQDN).

Managing Network Object Groups

To create a new network object group

Steps to create new network object groups by selecting network objects.

Logs and Monitoring

Viewing Security Logs

Shows the last 100 log records and allows searching and refreshing logs.

Viewing System Logs

To download the full log file

Procedure to download the full system log file.

Configuring External Log Servers

External Check Point Log Server

Configures an external Check Point Log Server for storing additional logs.

Syslog Server Configuration

Configures a gateway to send logs to multiple syslog servers.

Managing Active Devices

Blocking a Device Temporarily

Procedure to temporarily block a device from network activity.

Viewing VPN Tunnels

To filter the list

Filters the list of VPN tunnels by entering criteria in the Type to filter box.

Viewing Active Connections

Access Points

Viewing Monitoring Data

See 'Viewing Monitoring Data' on page 46.

Viewing Reports

See 'Viewing Reports' on page 48.

Dr. Spark

Checks appliance performance, sizing, and health status.

Using System Tools

Monitor System Resources

Opens popup windows showing CPU, memory, and disk usage history.

Show Routing Table

Opens a popup window displaying route information like source, destination, and gateway.

Test Cloud Services Ports

Tests Cloud Services connectivity using Gaia Clish command.

Advanced Configuration

Upgrade Using a USB Drive

Explains how to upgrade the appliance using a USB drive without a console connection.

Upgrade Using an SD Card

To upgrade using Gaia Clish commands

Lists file names for upgrading using Gaia Clish commands.

Boot Loader

Restoring Factory Defaults

To restore factory defaults with the WebUI

Steps to restore factory default settings using the WebUI.

To restore factory defaults with the button on the back panel

Procedure to restore factory defaults using the back panel button.

Custom Default Image

To update the default image

Command to update the default image with options to preserve settings.

RESTful API

Enabling and disabling the REST API

Gaia Clish commands to enable or disable the REST API on the gateway.

Request Structure

Details the HTTP Post request structure, port number, and HTTP Headers.

Versioning

Explains how to specify the API version in HTTP Post requests.

REST API Commands

(1) Login

Details the login process for the REST API, including request URL and headers.

(2) Logout

Describes how to log out from the current REST API session.

(3) Generate-Report

Generates security report data based on selected time frames (Hourly/Daily/Weekly/Monthly).

(4) Run-Clish-Command

Allows running a single Gaia Clish command via the REST API.

Check Point QUANTUM SPARK 1500 Specifications

General IconGeneral
BrandCheck Point
ModelQUANTUM SPARK 1500
CategoryNetwork Hardware
LanguageEnglish

Related product manuals