Policy: Firewall-VPN Last Modified: Wed Oct 27 07:28:53 2004 Global Properties Installation Targets

Type	Name			IP Address	Products	Properties	Properties	Comments
Check Point Host
	Corporate-internal-terminal-server			172.16.1.10	General Properties General Properties Version: NGX R60 OS: Linux Type: Check Point Enterprise/Pro Check Point Products SVN Foundation UserAuthority Server Web Server Web Server Operating System: Other Application Engines: PHP JET ODBC SQL Server ASPX ASP Oracle General Perl Ports configurations Server uses Standard Port: 80 Server uses additional ports: Protection Protected by: All Protections Protections Web Intelligence HTTP Malicious Code Protector Medium Cross Site Scripting Low LDAP Injection Medium SQL Injection Medium Command Injection Medium Directory Traversal Header Spoofing Non Ascii Headers HTTP Methods HTTP Methods HTTP Methods Configure the protection data: Block default HTTP methods: Block standard Safe HTTP methods Block standard Unsafe HTTP methods Block WebDAV HTTP methods Block selected HTTP methods (configured globally from Web Intelligence). Note: Additional protections are configured globally from Web Intelligence	NAT NAT Values for Address Translation Add Automatic Address Translation rules	Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription:	Terminal Server with UserAuthority Server
	Corporate-WA-proxy-server			172.16.2.3	General Properties General Properties Version: NGX R60 OS: Windows Type: Check Point Enterprise/Pro Check Point Products SVN Foundation UserAuthority WebAccess UserAuthority WebAccess UserAuthority WebAccess UserAuthority Server: On Corporate-gw On this machine UserAuthority Server service: FW1_uaa Action taken for URL outside the scope of the policy: Reject Track: None Advanced... Advanced... Limits and Timeouts Maximal client request buffer size: 40 KBytes Communication to UserAuthority Server timeout: 5000 milliseconds HTTP session timeout: 900 secons SSL SSL redirection methodology: Redirect to original URL by HTTPS Windows Groups: Get Windows group data for Windows users Case Sensitivity: Case sensitivity naming convention for URLs Web Server Web Server Operating System: Other Application Engines: PHP JET ODBC SQL Server ASPX ASP Oracle General Perl Ports configurations Server uses Standard Port: 80 Server uses additional ports: Protection Protected by: All Protections Protections Web Intelligence HTTP Malicious Code Protector Medium Cross Site Scripting Low LDAP Injection Medium SQL Injection Medium Command Injection Medium Directory Traversal Header Spoofing Non Ascii Headers HTTP Methods HTTP Methods HTTP Methods Configure the protection data: Block default HTTP methods: Block standard Safe HTTP methods Block standard Unsafe HTTP methods Block WebDAV HTTP methods Block selected HTTP methods (configured globally from Web Intelligence). Note: Additional protections are configured globally from Web Intelligence	NAT NAT Values for Address Translation Add Automatic Address Translation rules Translation method: Static Translate to IP address: 143.100.75.3 Install on Gateway: All Apply for VPN-1 Pro/Express control connections	Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription:	Corporate UserAuthoity WebAccess Proxy server
	Management-b			172.16.1.201	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Secondary SmartCenter Server SVN Foundation Log Server	NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Member of the following VPN Communities: (none) VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription:	Backup Gateway Management Server
	Remote-1-web-server			192.168.2.2	General Properties General Properties Version: NGX R60 OS: Linux Type: Check Point Enterprise/Pro Check Point Products SVN Foundation UserAuthority WebAccess UserAuthority WebAccess UserAuthority WebAccess UserAuthority Server: On Remote-1-gw On this machine UserAuthority Server service: FW1_uaa Action taken for URL outside the scope of the policy: Reject Track: None Advanced... Advanced... Limits and Timeouts Maximal client request buffer size: 40 KBytes Communication to UserAuthority Server timeout: 5000 milliseconds HTTP session timeout: 900 secons SSL SSL redirection methodology: Redirect to original URL by HTTPS Windows Groups: Get Windows group data for Windows users Case Sensitivity: Case sensitivity naming convention for URLs Web Server Web Server Operating System: Other Application Engines: PHP JET ODBC SQL Server ASPX ASP Oracle General Perl Ports configurations Server uses Standard Port: 80 Server uses additional ports: Protection Protected by: All Protections Protections Web Intelligence HTTP Malicious Code Protector Medium Cross Site Scripting Low LDAP Injection Medium SQL Injection Medium Command Injection Medium Directory Traversal Header Spoofing Non Ascii Headers HTTP Methods HTTP Methods HTTP Methods Configure the protection data: Block default HTTP methods: Block standard Safe HTTP methods Block standard Unsafe HTTP methods Block WebDAV HTTP methods Block selected HTTP methods (configured globally from Web Intelligence). Note: Additional protections are configured globally from Web Intelligence	NAT NAT Values for Address Translation Add Automatic Address Translation rules Translation method: Static Translate to IP address: 198.75.100.2 Install on Gateway: Remote-1-gw Apply for VPN-1 Pro/Express control connections	Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription:	Remote 1 Web Server
	Remote-2-windows-domain-controller			10.0.2.10	General Properties General Properties Version: NGX R60 OS: Windows Type: Check Point Enterprise/Pro Check Point Products SVN Foundation UserAuthority Server	NAT NAT Values for Address Translation Add Automatic Address Translation rules	Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription:	Windows Domain Controller for the site
Check Point Gateway
	Corporate-gw			143.100.75.1	General Properties General Properties Version: NGX R60 OS: Windows Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SecureClient Policy Server SVN Foundation Eventia Reporter SmartView Monitor UserAuthority Server SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications. UserAuthority Server UserAuthority Server Configuration Method Automatic Configuration Manual Configuration Export Policy Export the following data to externally-managed UserAuthority Servers: User name DN User groups Source IP Authentication Scheme Logging Level UserAuthority Logging Level: Low	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  143.100.75.1/24  External  eth1  172.16.2.1/24  This Network  eth2  172.16.1.1/24  Undefined  eth3  10.1.0.1/24  This Network  eth4  10.2.0.1/24  This Network  eth5  10.3.0.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender The gateway authenticates with this certificate: defaultCert Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy Policy Server: Users: All Users	VPN VPN Member of the following VPN Communities: (none) Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Corporate-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Corporate Gateway
	GX			Dynamic Address	General Properties General Properties Version: NGX R60 OS: SecurePlatform Type: Check Point Enterprise/Pro Check Point Products Firewall VPN SVN Foundation	Topology Topology Interfaces Name  IP address  Allowed IP  GX  10.200.0.0/16  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: (none) Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart Wire mode Support Wire mode (and Wire mode routing - route uninspected encrypted traffic in VPN routing configurations) NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Use DNS resolving: None (use last known IP address) Outgoing Route Selection Determine the outgoing interface using one of the following methods: When initiating a tunnel Operating system routing table Route based probing When responding to a remotely initiated tunnel Use outgoing traffic configuration Reply from the same interface Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (GX) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
	Integrity-1			10.14.1.132	General Properties General Properties Version: NGX R60 OS: SecurePlatform Type: Check Point Enterprise/Pro Check Point Products SVN Foundation	NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway
	Management			143.29.47.78	General Properties General Properties Version: NGX R60 OS: SecurePlatform Type: Check Point Enterprise/Pro Check Point Products Primary SmartCenter Server SVN Foundation Log Server	Topology Topology Interfaces Name  IP address  Allowed IP  Intel  143.29.47.78/24  Undefined  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Member of the following VPN Communities: (none) VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart Wire mode Support Wire mode (and Wire mode routing - route uninspected encrypted traffic in VPN routing configurations) NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection Determine the outgoing interface using one of the following methods: When initiating a tunnel Operating system routing table Route based probing Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None
	Remote-1-gw			198.75.100.1	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SVN Foundation SmartView Monitor UserAuthority Server SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications. UserAuthority Server UserAuthority Server Configuration Method Automatic Configuration Manual Configuration Export Policy Export the following data to externally-managed UserAuthority Servers: User name DN User groups Source IP Authentication Scheme Logging Level UserAuthority Logging Level: Low	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  198.75.100.1/24  External  eth1  192.168.1.1/24  This Network  eth3  192.168.2.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Authentication Method: MD5-Challenge Use this certificate: Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group: L2TP-vpn-user Allow Office Mode to all users Office Mode Method Allocate IP address by sequentially trying the checked methods, until success: From ipassignment.conf located in $FWDIR/conf - always tried first From the RADIUS server used to authenticate the user Using one of the following methods: Manual (using IP pool) Allocate IP from network: Remote-1-dmz Automatic (using DHCP) Optional Parameters... Optional Parameters... This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data. DNS servers Primary: First backup: WINS servers Primary: First backup: Domain name: IP Lease Duration IP lease duration: 15 minutes Multiple Interfaces Support connectivity enhancement for gateways with multiple external interfaces Anti-Spoofing Perform Anti-Spoofing on Office Mode addresses Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Remote-1-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Remote 1 Gateway
	Remote-2-gw			205.50.200.1	General Properties General Properties Version: NGX R60 OS: Windows Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SVN Foundation SmartView Monitor UserAuthority Server SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications. UserAuthority Server UserAuthority Server Configuration Method Automatic Configuration Manual Configuration Export Policy Export the following data to externally-managed UserAuthority Servers: User name DN User groups Source IP Authentication Scheme Logging Level UserAuthority Logging Level: Medium	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  205.50.200.1/24  External  eth1  10.0.2.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Remote-2-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Remote 2 Gateway
	Remote-3-gw			100.75.25.1	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SVN Foundation SmartView Monitor SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications.	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  100.75.25.1/24  External  eth1  10.0.3.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Remote-3-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Remote 3 Gateway
	Remote-4-gw			75.125.100.1	General Properties General Properties Version: NGX R60 OS: Windows Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SVN Foundation SmartView Monitor SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications.	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  75.125.100.1/24  External  eth1  10.0.4.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Remote-4-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Remote 4 Gateway
	Remote-5-gw			155.150.25.1	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall VPN QoS SVN Foundation SmartView Monitor SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications.	Topology Topology Interfaces Name  IP address  Allowed IP  eth0  155.150.25.1/24  External  eth1  10.0.5.1/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Remote-5-gw) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection	Remote 5 Gateway
Check Point Gateway Cluster
	Corporate-Cluster-1			143.100.76.100	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall VPN ClusterXL SmartView Monitor Cluster Members Cluster Members Name  IP address  Corporate-Cluster-1-member-A  143.100.76.1  Corporate-Cluster-1-member-B  143.100.76.2  ClusterXL ClusterXL Cluster Mode High Availability Load Sharing Multicast Mode Unicast Mode Advanced... Advanced... Use sharing method based on: IPs, Ports, SPIs (default) IPs, Ports IPs Use Sticky Decision Function SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications.	Topology Topology Interfaces Name  IP address  Allowed IP  DMZ  172.16.5.100/24  This Network  External  143.100.76.100/24  External  Internal  10.0.0.100/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined Synchronization Synchronization Synchronization networks: Network Name  IP Address  Network Mask  Corporate-Cluster-1-sync  10.100.0.0  255.255.255.0  Make sure the above networks are safe. NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Corporate-Cluster-1) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		Corporate-Cluster-1-member-A		143.100.76.1		Topology Topology Interfaces Name  IP address  Allowed IP  eth0  143.100.76.1/24  Cluster  eth1  10.0.0.1/24  Cluster  eth2  10.100.0.1/24  This Network  eth3  172.16.5.1/24  Cluster  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
		Corporate-Cluster-1-member-B		143.100.76.2		Topology Topology Interfaces Name  IP address  Allowed IP  eth0  143.100.76.2/24  Cluster  eth1  10.0.0.2/24  Cluster  eth2  10.100.0.2/24  This Network  eth3  172.16.5.2/24  Cluster  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
	Corporate-Cluster-2			143.100.80.100	General Properties General Properties Version: NGX R60 OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall VPN SmartView Monitor Cluster Members Cluster Members Name  IP address  Corporate-Cluster-2-member-A  143.100.80.1  Corporate-Cluster-2-member-B  143.100.80.2  3rd Party Configuration 3rd Party Configuration Cluster operating mode: High Availability Load Sharing 3rd Party Solution: Nokia IP Clustering Use State Synchronization See the OPSEC cluster solution's manual for the correct settings of these check boxes. Support non-sticky connections Hide Cluster Members' outgoing traffice behind the Cluster's IP Address Forward Cluster's incoming traffice to Cluster Members' IP Addresses SmartView Monitor SmartView Monitor Select data to be stored for SmartView Monitor history reports: Check Point system counters (e.g. CPU usage, accepted packets) Traffic Connections Traffic Throughput (Bytes per second) The history database is located on the gateway. This is a cyclic database that can consume up to 20 MB. Note: The implementation of Traffic's history reports may have performance implications.	Topology Topology Interfaces Name  IP address  Allowed IP  External  143.100.80.100/24  External  Internal  10.0.10.100/24  This Network  VPN Domain All IP addresses behind interfaces Manually defined Synchronization Synchronization Synchronization networks: Network Name  IP Address  Network Mask  Corporate-Cluster-2-sync  10.200.0.0  255.255.255.0  Make sure the above networks are safe. NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: MyIntranet Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection When initiating a tunnel the outgoing interface will be selected by the operating system. Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (Corporate-Cluster-2) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		Corporate-Cluster-2-member-A		143.100.80.1		Topology Topology Interfaces Name  IP address  Allowed IP  eth-s3p1  143.100.80.1/24  Cluster  eth-s4p1  10.0.10.1/24  Cluster  eth-s5p1  10.200.0.1/24  This Network  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
		Corporate-Cluster-2-member-B		143.100.80.2		Topology Topology Interfaces Name  IP address  Allowed IP  eth-s3p1  143.100.80.2/24  Cluster  eth-s4p1  10.0.10.2/24  Cluster  eth-s5p1  10.200.0.2/24  This Network  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
	V4V6_cluster			10.2.3.4	General Properties General Properties Version: NGX R60 OS: SecurePlatform Pro Type: Check Point Enterprise/Pro Check Point Products Firewall VPN ClusterXL Cluster Members Cluster Members Name  IP address  V4V6_member1  10.2.3.10  V4V6_member2  10.2.3.11  ClusterXL ClusterXL Cluster Mode High Availability New Mode Legacy Mode Load Sharing Use State Synchronization Upon Gateway recovery Maintain current active Gateway Switch to higher priority Gateway Fail-Over Tracking: Log	Topology Topology Interfaces Name  IP address  Allowed IP  int  10.2.3.10/24  Undefined  int1  10.3.2.10/24  Undefined  VPN Domain All IP addresses behind interfaces Manually defined Synchronization Synchronization Synchronization networks: Network Name  IP Address  Network Mask  1st Sync  10.10.10.0  255.255.255.0  Make sure the above networks are safe. NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: (none) Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Restart Options Perform an organized shutdown of tunnels upon gateway restart Wire mode Support Wire mode (and Wire mode routing - route uninspected encrypted traffic in VPN routing configurations) NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Always use this IP address: Main address Selected address from topology table: Statically NATed IP: Calculate IP based on network topology Use DNS resolving: Use a probing method: Outgoing Route Selection Determine the outgoing interface using one of the following methods: When initiating a tunnel Operating system routing table Route based probing When responding to a remotely initiated tunnel Use outgoing traffic configuration Reply from the same interface Source IP address settings... Source IP address settings... When initiating a tunnel use the following IP address as the source IP of outgoing packets: Automatic (derived from method of IP selection by remote peer) Manual: Tracking Outgoing link tracking: None Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (V4V6_cluster) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		V4V6_member1		10.2.3.10		Topology Topology Interfaces Name  IP address  Allowed IP  eth0  10.10.10.10/24  Undefined  inter1  10.3.2.11/24  Cluster  internal  10.2.3.11/24  Cluster  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
		V4V6_member2		10.2.3.11		Topology Topology Interfaces Name  IP address  Allowed IP  eth0  10.10.10.11/24  Undefined  inter1  10.3.2.12/24  Cluster  internal  10.2.3.12/24  Cluster  NAT NAT Values for Address Translation Add Automatic Address Translation rules	VPN VPN Office Mode for Remote Access Offer Manual Office Mode (using IP pool)
VPN-1 Edge/Embedded Gateway
	Branch-Office-gw			Dynamic Address	General Properties General Properties VPN Enabled Connects as Site to Site Gateway Connects as Remote Access Client Type: VPN-1_Edge_X_Industrial_Series Externally Managed Gateway Content Filtering Content Filtering Use UFP Use CVP Note: Global UFP/CVP configuration will be done via the "VPN-1 Edge/Embedded Gateway" tab under the Global Properties.	Topology Topology Interfaces Name  IP address  Allowed IP  DMZ  /  Undefined  LAN  /  Undefined  WAN  /  External  VPN Domain This gateway Manually defined	VPN VPN Member of the following VPN Communities: MyIntranet Link Selection Link Selection IP Selection by Remote Peer Locally managed VPN peers will determine this gateway's IP address using one of the following methods: Use DNS resolving: None (use last known IP address) Tracking Outgoing link tracking: None Advanced Advanced Licensing Product Key: MAC Address:
Check Point VSX Gateway
	VSX-gw-1			100.100.100.100	General Properties General Properties VSX Gateway Name: VSX-gw-1 VSX Gateway Version: VSX 2.0.1 System Interfaces System Interfaces Interfaces for Virtual Systems  Allow VLAN  eth0    eth1    eth2	Topology Topology Interfaces Name  VLAN  Virtual Router  IP address  Allowed IP  eth0        100.100.100.100/24  This Network  Routes Destination  Gateway  Interface  Metric  Propagate  100.100.100.0/24     eth0   0  No  Default Gateway: NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS	Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (VSX-gw-1) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 15000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 200 Advanced Advanced Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		VSX-gw-1_VR		3.3.3.3	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall SVN Foundation	Topology Topology Interfaces Name  VLAN  IP address  Allowed IP  eth2.35  35  3.3.3.3/24  External  Routes Destination  Gateway  Interface  Metric  Propagate  3.3.3.0/24     eth2.35   0  No  0.0.0.0/0  3.3.3.9   0  No  Default Gateway:
		VSX-gw-1_VS		1.1.1.1	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall	Topology Topology Interfaces Name  VLAN  Virtual Router  IP address  Allowed IP  eth2.12  12     2.2.2.2/24  This Network  wrp-new0     VSX-gw-1_VSW  1.1.1.1/24  This Network  Routes Destination  Gateway  Interface  Metric  Propagate  1.1.1.0/24  VSX-gw-1_VSW  wrp-new0   0  No  2.2.2.0/24     eth2.12   0  No  Default Gateway: NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS	Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (VSX-gw-1_VS) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 15000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 200 Advanced Advanced Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		VSX-gw-1_VSW		Dynamic Address	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products SVN Foundation	Topology Topology Interfaces Name  VLAN  IP address  Allowed IP  eth1     0.0.0.0/0  Undefined
	VSX-gw-2			200.200.200.200	General Properties General Properties VSX Gateway Name: VSX-gw-2 VSX Gateway Version: VSX 2.0.1 System Interfaces System Interfaces Interfaces for Virtual Systems  Allow VLAN  eth0    eth1    eth2	Topology Topology Interfaces Name  VLAN  Virtual Router  IP address  Allowed IP  eth0        200.200.200.200/24  This Network  Routes Destination  Gateway  Interface  Metric  Propagate  200.200.200.0/24     eth0   0  No  Default Gateway: NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS	Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (VSX-gw-2) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 15000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 200 Advanced Advanced Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		VSX-gw-2_VR		6.6.6.6	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall SVN Foundation	Topology Topology Interfaces Name  VLAN  IP address  Allowed IP  eth2.45  45  6.6.6.6/24  This Network  Routes Destination  Gateway  Interface  Metric  Propagate  6.6.6.0/24     eth2.45   0  No  Default Gateway:
		VSX-gw-2_VS		5.5.5.5	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall	Topology Topology Interfaces Name  VLAN  Virtual Router  IP address  Allowed IP  eth2.25  25     5.5.5.5/24  External  eth2.26  26     8.8.8.8/24  This Network  Routes Destination  Gateway  Interface  Metric  Propagate  5.5.5.0/24     eth2.25   0  No  0.0.0.0/0  5.5.5.8   0  No  8.8.8.0/24     eth2.26   0  No  Default Gateway: NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS	Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (VSX-gw-2_VS) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 15000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 200 Advanced Advanced Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		VSX-gw-2_VSB		Dynamic Address	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products Firewall	Topology Topology Interfaces Name  VLAN  Virtual Router  IP address  Allowed IP  eth2.74  74     0.0.0.0/0  External  eth2.75  75     0.0.0.0/0  Corporate-internal-net  NAT NAT Values for Address Translation Add Automatic Address Translation rules Automatice Hide NAT for Internal Networks Hide all connections from internal interfaces to external interfaces behind the gateway Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS	Logs and Masters Logs and Masters Log switch Log switch when file size is: - MBytes Schedule log switch to: Disk space management Measure free disk space in: MBytes Required Free Disk Space: - MBytes Alert when free disk space is below: 20 MBytes Stop logging when free disk space is below: - MBytes Additional Logging Additional Logging Log forwarding settings Forward log files to Management Server: - Log forwarding schedule: - Advanced settings Update Account Log every: 3600 Seconds Turn on QoS Logging Detect new Citrix ICA application names Masters Masters Use local definitions for Masters Define Masters Use the following Management Stations for fetch and install: Management Log Servers Log Servers Use local definitions for Log Servers Define Log Servers Save logs locally, on this machine (VSX-gw-2_VSB) Always send logs to: Log Server  Logs  Alerts  Management      When a Log Server is unreachable, send logs to: (none) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 15000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 200 Advanced Advanced Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections Permissions to Install Permissions to Install Only the listed groups are allowed to install policies on this object. Any SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
		VSX-gw-2_VSW		Dynamic Address	General Properties General Properties Version: NG with Application Intelligence - R55W OS: Unknown OS Type: Check Point Enterprise/Pro Check Point Products SVN Foundation	Topology Topology Interfaces Name  VLAN  IP address  Allowed IP  eth2.777  777  0.0.0.0/0  Undefined
Interspect Gateway
	Interspect-gw			192.71.71.71	Device Properties Device Properties Version: Interspect 1.0 / 1.1 / 1.5
Connectra Gateway
	Connectra-gw			191.1.2.3	Device Properties Device Properties Port: 4433	Topology Topology VPN Domain All IP addresses behind interfaces Manually defined Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Allocated port: CP_SSL_Network_Extender Allocated IP Address: All IPs Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Office Mode Method Allocate IP address by sequentially trying the checked methods, until success: From ipassignment.conf located in $FWDIR/conf - always tried first From the RADIUS server used to authenticate the user Using one of the following methods: Manual (using IP pool) Allocate IP from network: CP_default_Office_Mode_addresses_pool Automatic (using DHCP) Optional Parameters... Optional Parameters... This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data. DNS servers Primary: First backup: WINS servers Primary: First backup: Domain name: IP Lease Duration IP lease duration: 0 minutes Multiple Interfaces Support connectivity enhancement for gateways with multiple external interfaces Anti-Spoofing Perform Anti-Spoofing on Office Mode addresses Clientless VPN Clientless VPN Support Clientless VPN Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: (none) Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Allowed certificates When negotiating with a locally managed peer gateway: The gateway can use any of its certificates The gateway must use a certificate issued by this Certificate Authority Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
	gw1			1.2.3.4	Device Properties Device Properties Port: 4433	Topology Topology VPN Domain All IP addresses behind interfaces Manually defined Remote Access Remote Access L2TP Support Support L2TP (relevant only when Office Mode is active) Hub Mode Configuration Allow SecureClient to route traffic through this gateway NAT traversal Support NAT traversal mechanism (UDP encapsulation) Allocated port: VPN1_IPSEC_encapsulation Visitor Mode configuration Support Visitor Mode Office Mode Office Mode Do not offer Office Mode Offer Office Mode to group Allow Office Mode to all users Office Mode Method Allocate IP address by sequentially trying the checked methods, until success: From ipassignment.conf located in $FWDIR/conf - always tried first From the RADIUS server used to authenticate the user Using one of the following methods: Manual (using IP pool) Allocate IP from network: CP_default_Office_Mode_addresses_pool Automatic (using DHCP) Optional Parameters... Optional Parameters... This configuration applies to all Office Mode methods except Automatic (using DHCP) and ipassignment.conf entries which contain this data. DNS servers Primary: First backup: WINS servers Primary: First backup: Domain name: IP Lease Duration IP lease duration: 0 minutes Multiple Interfaces Support connectivity enhancement for gateways with multiple external interfaces Anti-Spoofing Perform Anti-Spoofing on Office Mode addresses Clientless VPN Clientless VPN Support Clientless VPN SSL Network Extender SSL Network Extender Support SSL Network Extender The gateway authenticates with this certificate: defaultCert Authentication Authentication Enabled Authentication Schemes: VPN-1 & Firewall-1 Password SecurID OS Password RADIUS TACACS Authentication Settings: User Authentication session timeout: 15 Minutes Enable wait mode for Client Authentication Authentication Failure Track: Popup Alert HTTP Security Server: Use Next Proxy	VPN VPN Member of the following VPN Communities: (none) Traditional mode configuration Traditional mode configuration Key exchange: AES-256 3DES DES CAST Data integrity: MD5 SHA1 Support authentication methods: Pre-Shared Secret Public Key Signatures Allowed certificates When negotiating with a locally managed peer gateway: The gateway can use any of its certificates The gateway must use a certificate issued by this Certificate Authority Exportable for SecuRemote/SecureClient Traditional mode Advanced Traditional mode Advanced Support Diffie-Hellman groups for IKE (phase 1) Security associations Group 1 (768 bit) Group 2 (1024 bit) Group 5 (1536 bit) Group 14 (2048 bit) Rekeying Parameters Renegotiate IKE (phase 1) Security associations every 1440 Minutes Renegotiate IPSEC (phase 2) Security associations every 3600 Seconds Renegotiate IPSEC (phase 2) Security associations every Misc Support agressive mode VPN Advanced VPN Advanced VPN Tunnel Sharing Control the number of VPN tunnels opened between peer Gateways Use the community settings Custom settings Wire mode Support Wire mode (and Wire mode routing - route uninspected encrypted traffic in VPN routing configurations) NAT traversal (Industry standard) Support NAT traversal (applies to Remote Access and Site to Site connections) Capacity Optimization Capacity Optimization Capacity Optimization Maximum concurrent connections: 25000 Calculate connections hash table size and memory pool Automatically Manually VPN Capacity Optimization Maximum concurrent IKE negotiations: 200 Maximum concurrent tunnels: 10000 Advanced Advanced SNMP sysName: sysLocation: sysContact: sysDescription: SMTP SMTP Connection timeout: 90 Sec Dequeuer scan period: 2 Sec Mail resend period: 600 Sec Mail abandon time: 43200 Sec Maximum number of recipients: 50 Maximum generated concurrent connections: 40 Maximum generated concurrent connections per site: 6 Don't accept mail larger than: 10000 Kb Maximum number of mail messages in spool: 20000 Check if spool goes over/under the limit every: 20 Sec Spool Directory: - Postmaster Name: - SAM SAM Using the SAM protocol, configure the manner in which dynamic restrictions are added to the VPN-1 & FW-1 Rule Base. Forward SAM clients' request to other SAM servers When connecting to this SAM server Use early versions compatibility mode Purge SAM file when it reaches: - KBytes Connection Persistence Connection Persistence Handling established connections when installing a new policy: Keep all connections Keep data connections Rematch connections SYNDefender SYNDefender Warning: All modules' SYNDefender settings might've been overriden by the SmartDefense configuration Activate SYN Attack protection
VPN-1 Edge/Embedded Profile
	VPN-1-Edge_Profile