This article details the steps to configure a Check Point firewall to establish an IPSEC connection with the Web Security Service.
The instructions here are provided as a snapshot of content that is no longer included with the Web Security Service Help Centre. For current instructions to configure an IPSEC connection with your Check Point firewall, refer to the Check Point support site here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk53980 or consult the Check Point support team for assistance.
Symantec tested and validated that Check Point® devices are able to forward web traffic to the Web Security Service for policy checks and malware scanning. The following procedure demonstrates the Simplified Mode with pre-shared secret method, which requires a unique gateway IP address (no NAT-T).
Version Demonstrated:
This procedure provides a guideline configuration that you can apply to the above model or other Check Point models. It is likely that you have an existing Check Point device configured in your network; therefore, slight alterations to the existing deployment might be required.
Note: R77.20 is the minimum supported version because of the Dead Peer Detection requirement.
Deployment Notes
Note: Symantec has seen outages occur if the Phase 2 Timeout value is set to longer than four (4) hours. If the current setting is less than four hours, you can leave that value. Otherwise, adjust the time. The screenshots in the following procedure might not reflect this advisory.
This procedure assumes that the Check Point device is already configured with the inside interface or group object with multiple inside interfaces and an outside interface that will communicate with the Web Security Service.
Create a Simple Group of the five IP Address Ranges that define all Internet addresses. These ranges include loopback, RFC1918, and Class D and E.
The interface displays the Address Range Properties dialog.
a. Name the range.
b. In the First IP address field, enter 1.0.0.0.
c. In the Last IP address field, enter 9.255.255.255.
d. Click OK.
a. First IP address: 11.0.0.0; Last IP address: 126.255.255.255.
b. First IP address: 128.0.0.0; Last IP address: 172.15.255.255.
c. First IP address: 172.32.0.0; Last IP address: 192.167.255.255.
d. First IP address: 192.169.0.0; Last IP address: 223.255.255.255.
a. Name the group.
b. From the Not in Group area, select the five range objects that you created in Steps 1.3 and 1.4.
c. Click Add to move them In Group.
d. Click OK.
When a location is active, all outbound port 80 and 443 web traffic routes through the VPN tunnel to the Web Security Service. The following example identifies the subnets that you want sent to the service for processing.
Tip: Symantec assumes that this is an existing gateway device and that you have previously configured to send traffic to the Internet. If you do not have subnets configured, consult the documentation for your Check Point device.
a. Name the group.
b. From the Not in Group area, select internal subnets that transport Internet-bound traffic.
c. Click Add to move them In Group.
d. Click OK.
Tip: To perform Web Security Service testing, you can identify a single workstation to send rather than entire production subnets. When you are satisfied, edit the object to
add the production subnets.
Create an protocol group that excludes the non-web protocols from inclusion in the VPN tunnel that connects to the Web
Security Service.
Create a Gateway (Interoperable Device) that points to the nearest Symantec datacenter for the configured location. Refer to this article for current Data Center addresses.
Add the Check Point gateway and the Symantec device to participating gateways.
To avoid datacenter connection issues, you must enable Dead-Peer-Detection on your Check Point device. You cannot accomplish this through the SmartDashBoard. Rather, as of the versions of Check Point software used for this reference, you must use the Check Point Database Tool (GuiDBedit) to enable this option.
Note: If not done already, review step 5-3-e above and enable the option, Set Permanent Tunnels. The Tunnel Management section should appear as follows before you proceed:
If Auth Connector traffic requires access to the Internet through the Check Point gateway, you must exclude that traffic from routing to the Web Security Service. Many datacenters have several to many Auth IP addresses. This step describes how exclude subnets verses manually configuring individual addresses.
Tip: If your Access Method is Trans-Proxy (IPsec over VPN), you can skip this step.