Chapter 1 — Introduction to Advanced Deployments
Covers the different deployment architectures supported by Check Point R81.10, from standalone lab setups to large-scale distributed and multi-domain enterprise environments.
Standalone Deployment
SMS + Gateway on one machine. Suitable for labs and small environments. Not recommended for production due to resource contention between management and enforcement.
Distributed Deployment
Separate SMS and Security Gateway(s). Standard production setup. SMS manages one or more remote gateways via SIC over the management network.
Multi-Domain Management (MDM / MDS)
Single physical server hosting multiple CMAs, each managing its own domain with independent policy, objects, and administrators. Used by MSSPs and large segmented enterprises.
Log Server
Dedicated server offloading log storage and indexing from the SMS. Reduces SMS load in high-traffic environments. Requires the FWD daemon and a valid log server license.
SmartEvent Server
Runs the correlation engine for SmartEvent. Can be co-located on SMS or Log Server, or deployed standalone for large environments generating high event volumes.
SIC (Secure Internal Communication)
Certificate-based mutual authentication between all CP components. Established during initial gateway configuration. Reset via cpconfig → SIC reset (gateway) or fwm sic_reset (SMS).
GAiA OS
Unified OS for all Check Point appliances. Two shells: Clish (restricted, role-based) and Expert mode (full bash). Configuration is saved with save config in Clish.
CPUSE
Check Point Upgrade Service Engine — manages OS upgrades, Jumbo HFAs, and hotfixes. Accessed via installer in Clish or the Gaia Portal. Fetches packages from CP cloud or local repository.
Exam tip: Know Standalone vs. Distributed and when MDM is appropriate. SIC reset scenarios (trust failure, certificate expiry) are frequently tested — know both the gateway-side and SMS-side commands.
Chapter 2 — Management High Availability
Management HA provides redundancy for the Security Management Server. Unlike ClusterXL gateway HA, management failover is always manual — an administrator must promote the secondary server.
Active / Standby
Primary SMS is Active; Secondary SMS is Standby. Only the Active server accepts SmartConsole connections and policy installs. Both servers store a copy of the database.
Synchronization
Automatic sync occurs on policy publish and install. Manual sync available via SmartConsole (Manage & Settings → High Availability) or the fwm CLI utility.
Sync States
Three states: Synchronized (identical), Never Synchronized (fresh secondary, never synced), Out of Sync (diverged after changes). Check with cpstat ha.
Manual Failover
No automatic promotion. Admin connects SmartConsole to the Secondary and promotes it to Active. The old Primary becomes Standby once it reconnects and resolves the conflict.
Key CLI Commands
cpstat ha — shows sync state and HA role. fwm utility — management HA operations. Always verify sync state is "Synchronized" before performing planned failover.
Log Unification
Logs generated while connected to each server are stored separately but unified and merged in the SmartConsole log view, providing a single pane of glass across both servers.
MDM HA
In Multi-Domain environments, each CMA can have its own Active/Standby HA pair. MDS-level HA is independent of individual CMA HA configurations.
Best Practice
Perform manual sync before planned maintenance to minimize divergence risk. Keep the Standby server updated with hotfixes matching the Active server to allow clean failover.
Exam tip: Management HA failover is always manual — this is a common exam trap. Know all three sync states. Automatic sync only triggers on publish/install, not on every object change.
Chapter 3 — Advanced Gateway Deployment
Covers advanced gateway features including multi-core processing (CoreXL), hardware acceleration (SecureXL), virtual system extension (VSX), and flexible interface configuration options.
CoreXL
Distributes firewall processing across multiple CPU cores using FW Worker instances. Configure instance count via cpconfig (requires reboot). Status: fw ctl multik stat.
SecureXL
Kernel-bypass acceleration for established connections. Three processing paths: Accelerated (F2F) — fastest, kernel bypass; Medium path; Slow path (F2V) — full inspection. Toggle: fwaccel on/off.
What Forces Slow Path
IPS inspection, anti-spoofing, multicast, non-standard protocols, NAT with port translation. Use fwaccel stats -s to see the accelerated vs. slow-path ratio.
VSX (Virtual System Extension)
Multiple virtual firewalls on one physical box. Components: VS (Virtual System — firewall), VSW (Virtual Switch — L2), VR (Virtual Router). Each VS has its own policy and routing table.
Bridge Mode
Gateway operates as a Layer 2 transparent device — no routing, no IP on bridge interfaces. Enables inline deployment without changing existing network IP topology.
Interface Bonding
Link aggregation in Gaia. Modes: Active-Backup (HA failover), 802.3ad/LACP (load balancing). Configure via Gaia Portal or Clish set bonding group commands.
VLAN Sub-interfaces
Tagged sub-interfaces formatted as eth1.100 for VLAN 100 on eth1. Configure in Gaia Portal or via Clish: set interface eth1.100 vlan 100.
CPU Affinity
Assign specific CPUs to FW Workers or the SND (Secure Network Distributor). View current affinity with sim affinity -l and fw ctl affinity -l -r.
Exam tip: CoreXL changes require a reboot; SecureXL can be toggled live. Know the three SecureXL paths. VSX VS/VSW/VR roles are often tested — VS is a virtual firewall, VSW is a virtual switch.
Chapter 4 — Advanced Policy Configuration
Deep dive into policy layers, packages, Threat Prevention profiles, and rule base techniques for managing complex security policies across multiple gateways from a single SMS.
Ordered Layers
Layers evaluated sequentially — first match in the first layer wins and terminates evaluation of that layer. Multiple ordered layers are stacked; traffic passes through each in sequence.
Inline Layers
Nested sub-policy within a specific parent rule. Only evaluated when the parent rule matches. Enables delegated management — e.g., a DMZ admin manages only the inline layer for DMZ traffic.
Policy Packages
A collection of Access Control and Threat Prevention layers deployed together as a unit to a gateway. One package per gateway. Shared layers can appear in multiple packages.
Threat Prevention Policy
Unified policy combining IPS, Anti-Virus, Anti-Bot, Threat Emulation, Threat Extraction. Profile-based: Optimized, Strict, Basic — or per-rule custom profiles for granular tuning.
Exception Objects
Exclude specific traffic from Threat Prevention checks. Three scopes: per-protection, per-rule (exception column in TP rule), global exceptions (apply to all TP rules).
Rule Base Optimization
Most specific rules first; frequently matched rules near top; cleanup deny-all + log rule at the very bottom. Eliminate shadowed rules that can never be reached.
Geo Policy
Block or allow traffic by country/region using Updatable Objects → Geo. Updated automatically from Check Point cloud. No additional blade required for basic geo blocking.
Time Objects
Restrict rules to specific time windows (business hours, maintenance windows). Defined as Time objects in SmartConsole. Gateway enforces based on its own local clock.
Exam tip: Inline layers create a sub-policy evaluated only when the parent rule matches — the key difference from ordered layers. Know that a package must be installed to a gateway before changes take effect.
Chapter 5 — Advanced User Access Management
Identity Awareness maps IP addresses to users and machines, enabling identity-based policy enforcement. Covers all acquisition methods, Access Role objects, LDAP integration, and the PDP/PEP architecture.
Identity Awareness Blade
Maps IP → user identity for policy enforcement. Required for Access Role objects in rules. Supported acquisition sources: AD Query, Identity Collector, Captive Portal, Terminal Server Agent.
AD Query (WMI)
Agentless acquisition via Windows Management Instrumentation. SMS or gateway queries DC security event logs for login/logoff events. Requires domain credentials and WMI firewall access.
Identity Collector
Lightweight agent installed on AD/Exchange servers. More scalable than AD Query for large environments (>10k users). Communicates to gateway PDP on TCP/443.
Captive Portal
Browser-Based Authentication — redirects unknown users to a login page. Credentials validated against LDAP/RADIUS. Portal served on TCP 443 or 80. PDPD daemon handles identity decisions.
Terminal Server Agent
Installed on Citrix/RDP servers where multiple users share one IP. Tags each session with a unique port range for per-user identity tracking — the only solution for shared-IP environments.
Access Role Objects
Combines network + user + machine into a single policy object for use in the Source/Destination columns of Access Control rules. Requires Identity Awareness blade to be active.
LDAP Account Unit
Object connecting SMS to Active Directory or other LDAP directory. Defines LDAP server, bind credentials, and branches (OUs) to query for user authentication and group membership.
PDP / PEP Architecture
PDP (Policy Decision Point): makes identity-based decisions. PEP (Policy Enforcement Point): enforces the decision on traffic. In distributed IA, PDP and PEP can be on different gateways.
Exam tip: Terminal Server Agent is the only solution for Citrix/RDP shared-IP environments. AD Query is agentless but less scalable. Identity Collector requires an agent on the DC but handles larger deployments.
Chapter 6 — Custom Threat Prevention
Covers customizing and tuning the Threat Prevention stack — IPS, Anti-Virus, Anti-Bot, Threat Emulation, and Threat Extraction — including custom protections, exceptions, and performance trade-offs.
IPS Profiles
Pre-built: Optimized (recommended balance), Strict (max protection, more false positives), Basic (critical protections only). Custom profiles allow per-protection Prevent / Detect / Inactive tuning.
Threat Emulation (SandBlast)
Sends suspicious files to a sandbox (local or ThreatCloud). Daemon: ted. Most CPU/resource-intensive blade. Supports PDF, Office documents, executables. Verdict: Malicious / Benign / Unknown.
Threat Extraction
Delivers a sanitized clean copy of documents (strips macros, active content, embedded objects) without waiting for emulation verdict. Near-zero latency. Complements Threat Emulation.
Anti-Bot
Blocks C&C communication from infected hosts using ThreatCloud reputation. Classified by botnet campaign/family. The RAD daemon performs real-time cloud lookups.
Custom IPS Protections
Import Snort rules via IPS Protections → Actions → Import. Custom signatures can target environment-specific threats not covered by standard IPS updates. Requires IPS blade license.
Exceptions
Three scopes: per-protection (exclude specific traffic from one protection), per-rule (exception column in the TP rule), global exceptions (bypass all TP for specified traffic).
ThreatCloud
Shared threat intelligence network. Provides real-time IPS, AV, Anti-Bot, and TE verdict updates. All participating gateways contribute anonymized telemetry and receive shared intelligence.
Bypass Under Load
Configure IPS/TP to bypass inspection when CPU exceeds a threshold — trades security for gateway availability during traffic spikes. Set in IPS profile → Performance Impact.
Exam tip: Threat Extraction delivers a clean file immediately; Threat Emulation provides a definitive verdict after sandboxing — they are complementary. RAD handles Anti-Bot/AV lookups; ted handles Threat Emulation.
Chapter 7 — Advanced Site-to-Site VPN
Advanced S2S VPN configuration covering VPN communities, domain-based vs. route-based VPN, IKEv1/v2 differences, troubleshooting methodology, and MEP for gateway redundancy.
VPN Communities — Mesh
All members communicate directly with each other. N gateways = N×(N-1)/2 tunnels. Use for any-to-any topology where all sites need direct connectivity.
VPN Communities — Star
Hub-and-spoke — satellite gateways communicate only through the center hub. Satellite-to-satellite traffic is hairpinned via the hub. Use when central inspection of branch traffic is required.
Domain-Based VPN
Encryption domains (network objects) define what subnets are encrypted. Traditional mode — traffic matching both peers' encryption domains is automatically tunneled. Simpler to configure.
Route-Based VPN (VTI)
Virtual Tunnel Interfaces — VPN treated as a routed interface. Routing protocols (BGP/OSPF) run over the tunnel. More flexible for complex topologies and dynamic routing. Configured in Gateway → VPN → VTI.
IKEv1 vs. IKEv2
IKEv1: Phase 1 (ISAKMP SA) + Phase 2 (IPSec SA), 9 message exchanges. IKEv2: single CREATE_CHILD_SA exchange, built-in NAT-T, EAP auth, more efficient and resilient.
vpn tu — Tunnel Utility
Interactive tool to list, delete, and re-establish IKE/IPSec SAs. First step when a tunnel shows up but traffic is not passing — delete SAs to force full renegotiation.
VPN Debug
vpn debug on → logs in $FWDIR/log/vpnd.elg and ike.elg. Always run vpn debug trunc first to clear old logs. Disable with vpn debug off after collection.
MEP (Multiple Entry Points)
Multiple gateways in one VPN community for redundancy. Primary + Backup selection via probing or routing. Clients and peer gateways automatically fail over to the responding gateway.
Exam tip: Star topology means satellite-to-satellite traffic goes through the hub (hairpin). VTI (route-based) supports dynamic routing protocols over the tunnel; domain-based does not. vpn tu is the primary troubleshooting command.
Chapter 8 — Check Point Remote Access VPN
Remote Access VPN enables secure user connections from outside using Check Point clients (Endpoint Security VPN / CP Mobile). Covers Office Mode, split tunneling, authentication methods, and troubleshooting.
Endpoint Security VPN Client
Full IPSec/SSL VPN client for Windows/macOS/Linux/Mobile. Connects via IKE (UDP 500/4500) for IPSec or Visitor Mode (TCP 443) as fallback when UDP is blocked.
Office Mode
Assigns a routable internal IP to the remote client. Almost always required — without it, return traffic from internal hosts cannot reach the client. IP sourced from pool, DHCP relay, or RADIUS.
Split Tunneling
Enabled: only traffic to corporate subnets is encrypted; internet goes direct (client downloads topology on TCP/264 to know what to encrypt). Disabled: all traffic tunneled — higher gateway load but more secure.
Visitor Mode
Encapsulates IKE/IPSec in TCP 443 for clients behind NAT or firewalls blocking UDP. Falls back automatically if IKE fails. Handled by the vpnd daemon on port 443/444.
Authentication Methods
Username/password (LDAP/RADIUS), certificates (PKI from ICA), two-factor (DynamicID SMS token, RADIUS OTP, certificate + password). Multiple schemes configurable per user group.
Topology Push
Client downloads the encryption domain from the gateway on TCP 264. Used in split-tunneling mode to determine which traffic to encrypt vs. send direct.
MEP for Remote Access
Client selects the closest / responding gateway from a MEP list via probing (ICMP) or DNS-based load balancing. Provides seamless failover for remote users.
Troubleshooting
vpn tu — clear remote access SAs to force renegotiation. vpn debug on — IKE negotiation log. If client connects but can't reach internal hosts, suspect missing Office Mode IP or routing issue on the gateway.
Exam tip: Office Mode is effectively always required in real deployments. Visitor Mode is the UDP-blocked fallback via TCP 443. Know that topology is downloaded on TCP 264 and drives split-tunneling decisions.
Chapter 9 — Check Point Mobile Access VPN
Mobile Access blade provides SSL VPN via a web portal, enabling clientless browser-based access and thin-client (SNX) network access without a full IPSec VPN client installation.
Mobile Access Blade
SSL VPN solution using TCP 443 only. No IPSec. Accessible via browser portal or SNX thin client. Managed by the HTTPD daemon. Can coexist on the same gateway as Remote Access VPN.
Web Portal (Clientless)
Browser-based access to published applications: web apps (reverse proxy), file shares (CIFS/NFS), RDP/SSH via browser applet. True clientless — no software installation required.
SSL Network Extender (SNX)
Thin client providing full Layer 3 network access over SSL. Downloaded via browser (Java or ActiveX). More capable than portal alone but requires browser plugin support.
Application Publishing
Each published app in the Mobile Access Policy defines: URL/service, authentication scheme, and endpoint compliance requirement. Per-app granularity — different apps can have different access controls.
Endpoint Compliance
Checks device security posture before granting access: AV installed, OS patch level, disk encryption. Requires Endpoint Compliance blade. Enforceable per-application.
Authentication
Supports LDAP, RADIUS, Certificates, DynamicID (2FA). Different apps can require different authentication strength — e.g., sensitive apps require 2FA while read-only apps require only password.
Link Translation Modes
Portal rewrites internal URLs for reverse-proxy access. Modes: Path (recommended, most compatible), Hostname (requires wildcard DNS), Port (uses different TCP ports per app).
MAB vs. Remote Access VPN
Mobile Access = SSL only, app-level granularity, clientless option. Remote Access VPN = IPSec+SSL, full network access, requires full client. Both can run on the same gateway simultaneously.
Exam tip: Mobile Access is app-level SSL VPN (portal/SNX); Remote Access VPN is full network-level IPSec/SSL. Key differentiators: Mobile Access can be clientless; Endpoint Compliance check is a Mobile Access feature.
Chapter 10 — Advanced Security Monitoring
Covers SmartLog for real-time log analysis, SmartEvent for security event correlation, custom automatic reactions, and integration with external monitoring systems via SNMP and syslog/SIEM.
SmartLog
Real-time indexed full-text log search across all gateways and log servers. Instant results from indexed log store in $FWDIR/log. CLI equivalent: fw log and fw log -f (follow live).
SmartEvent
Correlation engine aggregating logs into security events based on correlation rules. Requires SmartEvent Server role. Events visible in SmartConsole → Logs & Monitor → Security Events.
Correlation Rules
Define event triggers, thresholds, and time windows. Example: "5 failed logins from same IP in 60 seconds = brute-force event." Custom rules created via SmartEvent Policy editor.
Automatic Reactions
SmartEvent can trigger automated responses: block attacker IP, send email alert, run a custom script. Configured under SmartEvent Policy → Automatic Reactions. Reduces mean-time-to-respond.
CPView
CLI real-time performance monitor (cpview). Interactive ncurses UI — navigate with arrow keys/Tab. Shows CPU per core, memory, connections, blade throughput. Safe to run in production — read-only.
fw log CLI
fw log — view log. fw log -f — follow live. fw log -m audit — admin audit trail. fw log -n — no DNS resolution (faster). Log files in $FWDIR/log/*.log.
SNMP Monitoring
SNMPD daemon handles GET requests (UDP/161) and sends TRAPs (UDP/162). Check Point MIBs in $CPDIR/lib/snmp. cpstat provides blade-specific statistics accessible via SNMP OIDs.
Syslog / SIEM Integration
Configure log forwarding in SmartConsole → Log Server → Syslog. Supports CEF (Common Event Format) for SIEM ingestion. Transport: UDP/514 (plaintext) or TCP/6514 (TLS-encrypted).
Exam tip: SmartLog = search logs fast. SmartEvent = correlate logs into actionable events. SmartEvent requires its own dedicated server role — it cannot run without a proper SmartEvent license and configuration.
Chapter 11 — Performance Tuning
Systematic approach to identifying and resolving gateway performance bottlenecks, covering SecureXL acceleration paths, CoreXL tuning, connection table limits, and the key diagnostic commands.
fw ctl pstat
Shows connection table statistics: current count, peak, allocated slots, and the limit. First command for suspected connection table exhaustion. If current approaches limit, action is required immediately.
SecureXL — Three Paths
Accelerated (F2F): kernel bypass, fastest. Medium path: partial acceleration. Slow path (F2V): full kernel inspection — used for IPS, anti-spoofing, multicast, and non-TCP protocols.
fwaccel stats -s
SecureXL statistics summary — shows percentage of traffic on each processing path. A low accelerated ratio is a tuning signal. Also use fwaccel conns to inspect the accelerated connection table.
CoreXL Tuning
Increase FW Worker instances via cpconfig (requires reboot). Best practice: leave ≥1 core for SND and ≥1 for the OS. Optimal: FW Workers = physical cores − 2 (minimum).
Connection Table Limits
Tune via fw_conn_table_limit in $FWDIR/conf/fwkern.conf (persistent, needs reboot) or live: fw ctl set int fw_conn_table_limit <N> (immediate, non-persistent).
Heavy-Hitter Table
SecureXL feature that rate-limits top connection-rate sources to protect the connection table from exhaustion by a single host. Enabled by default. View with fwaccel stats -v.
CPView
Interactive CLI monitor (cpview). Shows CPU per core, memory, blade throughput, top connections in real time. Navigate with arrow keys / Tab. Non-disruptive and safe to run on live production systems.
IPS Bypass Under Load
Configure IPS to bypass inspection when CPU exceeds a threshold — availability over security during spikes. Set in IPS profile → Performance Impact → Bypass under load. Use with caution.
Exam tip: fw ctl pstat and fwaccel stats are the two most important performance diagnostic commands. Know what forces the slow path (IPS, anti-spoofing, multicast). CoreXL changes need a reboot; connection table limit can be tuned live.
Chapter 12 — Advanced Security Maintenance
Covers the full maintenance lifecycle for Check Point R81.10: backups, upgrades, hotfix deployment, database revision control, and recovery procedures when things go wrong.
CPUSE
Manages OS upgrades, Jumbo HFAs, and hotfixes. Access via Clish installer command or Gaia Portal. Downloads from Check Point cloud or a local package repository. No reboot required for some hotfixes.
migrate export / import
migrate export: backs up the management database to a .tgz file. migrate import: restores it. Replaces deprecated upgrade_export. Run from Expert mode on the SMS before any major upgrade.
Gaia Snapshot
Full system image (OS + CP config). Create: snapshot create name <name>. List: show snapshots. Revert: snapshot revert name <name>. Stored locally on the device — not a substitute for offsite backup.
Database Revision Control
SmartConsole → Manage & Settings → Revisions. Automatic revision on each publish. Manual revision for pre-change snapshots. Allows rollback of policy/object changes without OS-level restore.
Pre-Upgrade Verification
Run pre_upgrade_verifier before any major version upgrade. Checks OS/HW compatibility, license status, disk space, and known blockers. Resolve all reported issues before committing to the upgrade.
fw fetchlocal
Reinstalls the last policy from the gateway's local cache without contacting SMS. Use when the SMS is unreachable but policy needs to be restored after a gateway reboot or crash.
cpstop / cpstart
cpstop: stops all CP processes — drops traffic on a gateway. cpstart: starts them. cpstop --no-unload: stops user-space daemons but keeps the kernel policy loaded so traffic continues flowing.
Jumbo HFA
Jumbo Hotfix Accumulator — cumulative collection of fixes for a major release (e.g., R81.10 Take N). Always take a snapshot + migrate export before applying a JHF to enable rollback if issues arise.
Exam tip: Pre-upgrade backup order: snapshot first, then migrate export. cpstop drops traffic; cpstop --no-unload keeps traffic flowing. fw fetchlocal is the recovery tool when the SMS is unreachable after a gateway reboot.