topic Re: SMB Questions (management & fetching policy) in Spark Firewall (SMB)

SMB Questions (management & fetching policy)

Patrick_Tuttle1 — Mon, 25 Nov 2019 13:54:36 GMT

Hello CheckMates;

We have some questions regarding the SMB platform.

We were under the impression that these device could call home ang grad policy from centrally managed check point. We are testing this in our lab with R77.20 and 1200R R7720.81

Looking at /var/log/log/sfwd.elg we see it calling out but then saying "Local security policy is up to date" "same policy as already on module"

We are also considering deploying these in our SCADA environment in the field over very slow links and were hoping the policy install would be a quicker process compared to a regular gateway running full Gaia. Not sure this would be a smaller file resulting in a faster (lass bandwidth intensive) policy install.

And our other question is whats the differences between using Smart Provisioning (LSM) or the newer product SMP? Are there any advantages? One thing We would need in our environment is to keep all management local on Prem as opposed to being in the cloud. We are told this due to NERC-CIP guidelines.

Thanks and appreciate any direction / experience anyone can share.

Re: SMB Questions (management & fetching policy)

PhoneBoy — Tue, 26 Nov 2019 04:32:04 GMT

SMP is cloud-based, so if on-Prem is required, it’s not an option.

SmartLSM creates a “profile” that represents many different gateways, not necessarily SMB gateways.
When you push policy to a SmartLSM gateway, it doesn’t actually push the policy to the gateway but creates a new policy for the gateway to fetch, which they will then do periodically.
SmartLSM has a few limitations in terms of features/blades supported, so it may not be appropriate in every situation.

Current SMB appliances don’t necessarily need SmartLSM insofar as they periodically fetch policy from management already.
The compiled policy isn’t necessarily smaller if you use SmartLSM.

Re: SMB Questions (management & fetching policy)

Patrick_Tuttle1 — Tue, 26 Nov 2019 18:22:53 GMT

Thanks for your reply. I missed the part about installing policy in dashboard to a provisioning profile as opposed to the gateway itself. but now the problem is getting the provisioning profile to show up under the smartprovisioning application in order to tie it to the gateway. When going through the wizard, the gateway does not show up the window is supposed to show the list of appliances and devices that you can assign to a Provisioning Profile., but nothing there.

Re: SMB Questions (management & fetching policy)

PhoneBoy — Wed, 27 Nov 2019 02:35:47 GMT

So you followed steps similar to https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk107164 correct?
(Yes, this mentions an 1100, but the process should be similar)
You may want to engage with the TAC.

Re: SMB Questions (management & fetching policy)

Patrick_Tuttle1 — Wed, 27 Nov 2019 17:45:29 GMT

THANKS !!! very much. I didn't see this and made the mistake of adding in the gateway into dashboard then tried to get provisioning to work. Looking better now. Thanks.