Azure test drive with Check Point vsec

Azure cloud service has Check Point now. You even can test-drive it. 
The whole operation is open for three hours free of charge.

All you can get is a standalone GW+Mgmt machine plus a Window based GUI client and a test Web server.

The pre-installed policy is autogenerated and looks quite odd. 

Azure also provides some limited testing capabilities. There are three built-in tests; two of them are failing. Since there is no documentation about how and what is tested, I could not figure out whether it is something expected.


IPS, Application control, Antivirus and Anti-bot are included and enabled on the gateway.

Once you stopped the test drive or run out of time, the environment is disassembled in about 5 minutes.

According to the market description, you will be able to manage Azure vsec from your production management and even use your own license.



All in all, it seems to be easy to deploy and manage. Try it on your own and share your thoughts here.

Policy installation, is it taking too long?

About a month ago I was dealing with a customer's complain about policy installation taking way too much time. It is a valid concern for many organizations, apparently. If you think your policy is taking too long to install, there are several things to consider.

How it is done

Policy installation is a bit more complex that some people think. Let's see what's happening when you press an Install button in the GUI:

1. Policy package is saved
2. If you have Management High Availability in place with automatic sync, MGMT HA synchronization is invoked. Your whole MGMT database is being collected, zipped and transferred to the standby Management Server and then unpacked. Only when it is done (or failed, depending on the conditions), you go to the next step.
3. Policy Verification. Your rulebase is being checked for logic errors and shadowed rules.
4. Policy compilation. Management server calls a compilation process, that collects the rulebase info, objects descriptions, security settings for IPS and Threat Prevention, Application Control, etc and prepares all necessary files to for transfer to a Security Gateway. Files are zipped for transfer.
5. Now the policy files are sent to the gateway through SIC encrypted channel.
6. Gateway receives the files and unzip them. Once done, actual policy installation is about to begin.
7. Finally, GW is replacing existing security rules with the new one from the received package. Depending on the settings, this process may include all open connections to be re-matched with the new policy. Once done, GW reports to MGMT the success or failure

In summary, steps 1 to 5 are happening on the Management Server. Only the last three steps are happening on the Gateway side.

Why can it be slow?

There are several bottlenecks at the Management Server side: HDD access speed, RAM and CPU. All of them may slow down multiple operations with the files and compilation of the policy package. 

For example, if MGMT server is also doing logging, with high amount of logs disk access will be queued, and both verification and compilation may take significantly longer time than without logging. If your management CPUs are already running high (with logging, SmartLog indexing, any other CPU intensive operations) that would slow down policy installation. 

If by any chance you are running Windows based Management Server, a compulsory antivirus software will slow down policy installation enormously, scanning and rescanning again all MGMT database files that are being opened, created and changed on the way. 

Management HA sync adds five to ten minutes to the process. If this is your case, you may want to change MGMT HA settings to manual sync only. My customer mentioned at the beginning of this article was using fake management server objects for logging external FWs. Every time they were installing policies, MGMT HA process tried to talk to non-existing objects, finally failing and giving up. For that customer, the main pitfall was management high availability itself.

Bigger policy takes longer time to compile. More checks, more objects to touch, bigger files to create. 

File transfer from MGMT to GW may take some time if the connectivity between elements of your security system is slow.

Once the files are on the gateway, it usually takes less than a minute to install policy. Again, bigger the policy, slower the installation time. If your policy has more than 3000 rules, you may expect installation would take time. 

Will it be faster with R80?

Yes and no. 

For all R77.x and below it will be exactly the same process as before. 

With  some later R80.X version (but not R80.10, apparently), we expect that gateway will be able to receive only the delta changes of the policy package. In this case every consecutive policy push after the first one should take less time.

Want to know more?

All above is thoroughly discussed in my Troubleshooting course. If you are interested in it, do not hesitate to let me know. My email is varera (at) gmail. Looking forward to hear from you.

Commence the drum roll, R80.10 is coming

According to some rumors, R80.10 release is due in about two or three weeks. Are you excited?

I am biting my nails off, waiting to share with you something amazing about new GW architecture. I have hinted in 2015 something interesting is coming, cannot wait any longer.

Also, GW release is tied to something else that is long overdue...

How is it on your side? Are you ready for R80.10? What do you expect? Will you upgrade right away? Are you planning training your engineers or you just throw them into the deep to swim?

Please do not hesitate to share in the comments all your thoughts, expectations, reservations, you name it. 

PANW plunged 20%, should Check Point gloat?

Two days ago Palo Alto Networks share price has experienced a sharp fall, losing about 20% of its value in a single day, following second quarter results announcements and a warning towards the third quarter performance.

Some of my Check Point oriented friends would say reality is finally catching up with PAN, but I would not be that quick in judgement.

Being exposed to both vendors, I can say each one has its solid pros and cons, and technology competition is not only driving sales up (or down in some cases, lol) but also works for the best of information security in whole.

We all know that Wall Street indexes do not reflect directly the quality of the technology or even its market performance. It is all about making quick money, earning per share in this particular case. As FT explains, investors decided to get out of PANW because of the earning warning.

In reality we should be more interested in market share and its growth. During the last several years Check Point revenue grows organically with the market, plus or minus one percent, while its main competitors such as Fortinet and Palo Alto have double digit year to year growth numbers.

Yes, PAN growth is slowing down. It is not around 50%, as in 2015, but it is still estimated to reach more than 20% for 2017. Which is 2 or 3 times bigger than 7% to 9% growth achieved by Check Point through the last three years.

In other words, even while slowing down, Palo Alto Networks is catching up with Check Point market share.

Check Point still has a lot to do to change this tendency and start winning the market back.

Check Point breaks silence about CCSM issues

In my two previous posts I have I have shared my views about lack of continuity with CCSM certification and some other inconsistencies.

I have also reached out to Check Point Education Services for comments.  Wednesday afternoon new certification manager Jason Tugwell called me to make some comments of the situation. Following that call, hi has sent me an official response that I am happy to share with you now. This is what he has to say:


Valeri,

Thank you for speaking with me yesterday.  As a recap of our phone call, I would like to respond on behalf of Education Services to the issues we have had with the CCSM.

We agree that there are 2 primary issues:
1.       The inability to renew the CCSM since there is not a R80 CCSM currently
2.       Inconsistency of CCSM certification lengths of 2 years and 4 years

Response to #1 
·         We are aware that we have not released the R80 CCSM as intended.  As we await the official release of R80.10 we are currently working on an updated CCSE for R80.10 with a CCSM to follow.  Shortly after the release of R80.10 we will be releasing a CCSM with an update plan for the CCSM community.  In the interim, we have come up with a plan that will satisfy both the need for a quality CCSE and a way to extend the CCSM certification.  To any CCSM expired or not we have extended an offer to partner with CCSMs, via our email distribution group, to participate with the R80.10 CCSE exam question development.  This is an opportunity to contribute to the CCSE exam and extend the CCSM certification for 1 year.  We believe the CCSM community can contribute to make the exam a solid product with challenging skill.  If you are a CCSM and not part of our email distribution group, contact Jason Tugwell for more information.

Response to #2
·         We have identified that there have been the errors with CCSM certification listing two different validation dates, 2 year or 4 year.  This inconsistency is still undergoing investigation, however, it appears that it was a clerical error that has affected a small percentage of the CCSM’s.  We do apologize for the error and the confusion it has generated nevertheless, going forward all CCSM certifications will be a 2-year certification as intended.  (See the Check Point Certification FAQ: All professional certifications - those taken in a proctored exam environment - are good for, or considered “Current”, for two years.)  When the investigation is concluded, we will alert the community.

Let me express my sincere apologies for any issues this has caused and my gratitude to the network of Check Point Certified professionals that are interested in maintaining their certifications.

Regards,
Jason Tugwell “Tug” 

Thank you for your response, Jason. I will continue monitoring the situation and will share with the community any further development.

CCSM, more warning signs

In my previous post I have started to write about issues around CCSM certification with Check Point. As said there, if your CCSM certificate expires soon, you will not be able to renew it, as no new exam version is available yet.

Since then I have been approached by several people with questions and stories about their own CCSM certifications.

Surprisingly, I have realized there is a mess with CCSM certification period. While majority of CCSM professionals have got certificates valid for two years only, some others got four years of certification.
Here are some stories.

CCSM certification extended for two more years.

A colleague of mine passed CCSM exam in 2015. As soon as the qualification had appeared on his profile in UserCenter, he downloaded his e-certificate PDF. Earlier this year, when the company was updating its partner status, he checked his status, and UC said, his CCSM expires early February 2017. That statement was also backed up by e-certificate he downloaded again. Now, here is the twist: although e-cert downloaded in 2017 shows two years of CCSM, the older 2015 e-cert has four years. Most interestingly, his certificates have the same name and ID number, but different expiration dates. Later on, my colleague has raised a ticket with account management, and after sending them 2015 e-cert he has received two year extension.

2017 CCSM get four years

Someone who asked me not to reveal his name said he has been granted CCSM for four years at the beginning of 2017. Same situation is mentioned in the comments to the previous post by one of my readers as well.

Trying to get to the bottom

Being surprised by the inconsistencies, I have put my investigative blogger hat, trying get to the bottom of the truth. I have reached out to Shay Solomon, Director of Education Services at Check Point, asking for a clarification. Shay has answered that CCSM is valid for two years only. My next question was, how comes some people get four year of certification.

Then something strange happen. Shay has asked me to provide the names of my sources. I have made several attempts to get more specific information and then even acknowledgement of the problem's existence and Check Point plans to fix it. Instead, all I have got was "We will look into in".

So here it is, folks. Check Point not only fails to provide means to maintain CCSM status without interruption, but also cannot decide if it is valid for two or four years. The Director of Education Services says two years, but people get certificates for four.

At this point I do not know the gravity of the situation. To assess it, please let me know if your current CCSM has two or four years. Please check both your e-cert you have downloaded and UserCenter status, as they can show different things.

As the issue might be quite delicate, please do not use your real name in the comments or, alternatively, just send the info to my private email address: "varera (at) gmail dot com".

Most importantly, if your e-cert shows four years, keep it in a safe place. You may have to appeal later, if CP takes some sort of a corrective action.

I will continue writing the story as it develops.

CCSM lacks continuity, and it is Check Point's fault

Security Master program (CCSM) is the highest certification with Check Point available today. It was introduced at the end of 2014 to replaces failing CCMA certification.

It is clear now that CCSM is also experiencing some road bumps on its way.

During the last two weeks I have received several reports from CCSM professionals about inability to extend their CCSM status.

The issue is, CCSM certification is valid for two years only. Just to remind you, CCMA privileges had four year. Many people who jumped into CCSM at the beginning of 2015 are now facing the fact their certification is about to expire. Yet, there is no way to extend it.

Yes, that is not a mistake. You cannot extend your current CCSM certification. The usual was would be to take a new CCSM exam. But here's the caveat, it is still the same CCSM exam based on R77 version. And, not surprisingly, you cannot retake the same exam twice, if you passed it the last time.

One could extent one's CCSE for a year by taking two blade exams, but there is no such an option for CCSM. Nothing can be done. You may only wait till the next version based on R80 will be out.

I have asked Check Point Educational Services to comment on this situation. This is what they say:

"CCSM certification cannot be extended until the R80.10 software, certification training course, and certification exam is released.  This is a known issue."

I personally find the situation quite unsettling. I am privileged to know personally many of Check Point Education Services team members; and trust me, those people are dedicated, intelligent and hardworking.

Why are the processes failing then? Is it something about the system itself? I can't say. Yet I find necessary to start a dialog and to discuss openly and freely good and bad of being a Check Point certified professional.

Please do not hesitate to share your opinion too.

I will continue writing about history, issues and wins of Check Point certification system in this blog. Stay tuned.