Transparent Kerberos SSO with multiple GWs

Check Point Identity Awareness is a neat feature, especially with browser based transparent SSO authentication. It is also a challenging one. There is a lot of configurations to do on AD side, and that is not a strong domain for some of FW administrators. For example, I specifically started working with Check Point to be as far away as possible from a turmoil of Windows administration.

Jokes aside, there is something that Check Point documentation is not covering clear enough.

With Kerberos, one has to configure Kerberos Principal Name with a use account. Identity Awareness admin Guide is covering this point fairly well, on pages 58-59 (R77 version of the document). There is a caveat though. The document is written under assumption there is only a single FW or clsuter enforcing user identity with Kerberos. Ktpass command should how to map Kerberos parameters to the user account in the document are only working for a single portal URL.

What if one has more than one GW? Ktpass is no use here. Instead, administrators have to edit servicePrincipalName with Multi-valued String Editor to add multiple URLs there to enable IA working for the same user through multiple Identity Awareness enabled gateways. To simplify the config, just refer to this screenshot bellow.

Great collections of Check Point "How to" links

If you have not seen it yet, there is a great collection of "how to" solutions and guides in SK65385. It has been last updated 14th of March 2014, and I can guess, Check Point is adding new entries there from time to time.

If you do not know, how to start with some complex issue, that would be a good place to start. As complexity of SecureKnowledge grows fast, we need such high level references.

Great job, SecureKnowledge teem, great job indeed!

Stay away from Document security app on iPad

I have had to install Check Point Document Security application on my iPad the other night. I did not want to, but Check Point guys have sent me some secured doc. So I had to. Big, big mistake.

This morning my iPad was fully charged, this afternoon the battery was completely drained. Considering it was just lying on the table half a day, that was odd. Obviously some app was stuck using CPU. So I have managed to charge it again to around 15% and started to kill applications one by one.

When I was trying ti kill Document Security, iPad crashed. I have charged it again, same drill. I could not close this bloody app! More, I could not charge it to a decent percentage anymore. Once charged to 10%, iPad was booting, then some app was eating all the power again.

It took me some tricks to finally kill it. Guess what? Once I have done that, the battery percentage jumped from 9% to 23%.

I guess there is just a few people writing Apple apps in Check Point. I would sincerely ask them to do some QA. SecureKnowledge app is great, but it is crashing with iOS 7. But at least you have other means to get your support cases, one can access them from Safari. With document security one has to use an app, there is no other way around.

So guys, please stop releasing half backed good, that gives a wrong impression. Pretty please...


------------- UPDATE--------------

I have been contacted by Check Point concerning this issues. It seems they could not reproduce it, even after my deliberate explanation of my case. And guess what, my SecureKnowledge app is not crashing anymore. That's a miracle.

3D Security report tool is now fully integrated into R77.10

If you have been following my posts about 3D Security Analysis Report tool, there are good news. Check Point has made an effort to integrate the tool completely with R77.10 release.

No more packages to install, just fire up the version, open Event Analysis GUI and check 3D Security Analysis Report under View options.

You will still need MS Office installed on the machine generating reports.

VSX R6x to R7x migration tips

As you all know, VSX R65 is out of support, and VSX R67 is about to be. Check Point is recommending customers to move to R7x versions as quick as possible. Here are some tips about the migration procedure:

1. Remember - there is no upgrade in place. To "upgrade" VSX one has to re-install with the clean target version and to run vsx_util upgrade/reconfigure on MGMT part.
2. Run lab trials of vsx_util part of operation. In every second case of my VSX upgrades MGMT part of migration fails or hangs. If this happens to you in production, you are doomed. Replicate your SMS or MDM in the lab and run vsx_util upgrade. Correct all the error on the way, if necessary.
3. Use multi-step upgrade on MGMT side, if you skip a version. In my practice, running vsx_util upgrade R67 -> R75.40VS and then again R75.40VS -> R77 is much safer than just going all the way up. In most of the cases vsx_util just hangs for half an our and then fails, if version is skipped.
4. Take extreme caution if you are going to replace your old cluster with new HW. In case of replacing open servers with Check Point appliances and vice versa one has to run vsx_util change_interfaces to rename all VSX interfaces before pushing configuration with vsx_util reconfigure to the new machine. In many cases you can successfully rename interfaces with the script, but old interfaces are not removed. If this happens, open VSX cluster object with SmartDashboard and remove them manually before running vsx_util reconfigure.

And the last tip. If you are reading this, and it does not make any sense, read through VSX administration manual and upgrade guides.

MDM and VSX are my favourite products with Check Point, but they are also the most delicate and fragile ones. Any mistake in the process can cost you dearly.

If you are interested, I am inviting all readers to my classroom to MDM and VSX training. We discuss the architecture of both products, best practices with them, maintenance and upgrade procedures. To get more information, send me a personal message here or just use our Training Center enquiry form

Check Point Quick Tips blog

There is an interesting blog about Check Point tricks: "Check Point Quick Tips by Kishin Fatnani", check it out.

Kishin is a great Check Point trainer and engineer. His training and consulting centre is based in Mumbai, India.

Palo Alto acquires an Advanced Threat specialised startup

It has been announced that that Palo Alto has acquired Morta Security, a company specialised in APT. It is the second most interesting acquisition announced this year in the field of APT, after FireEye has acquired Mandiant for over $1 billion, reportedly.