Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Eyal_Rashelbach
Employee
Employee

SCADA protocols DPI Visibility and Enforcement

#There is a confusion with our SCADA support definitions.

  • What is DPI (Deep Packet/Protocol  Inspection)?
  • Which protocols are supported in DPI level ?
  • What are our enforcement capabilities with regards to DPI?

 

So, let’s use the following update from R&D to make some order in this repeated question.

 

 

We have 3 levels of Protocol support by Application Control Blade:

  • 1st level -  Protocol Identification – we have over 15 different identified protocols
  • 2nd level - Function (Command) level.  
    An updated list may be found in appwiki.checkpoint.com  – currently 918 commands support >15 different protocols.
  • 3rd level - Deep Protocol Inspection 
    Ability to identify Parameters within the commands, such as Values and Addresses
    (can’t be seen in appwiki.checkpoint.com and therefore the report below gives the current status).

All the 4 protocols below are identified in the 3 levels:

Protocol

Ability to identify protocol

Ability to identify commands within protocol

Ability to identify parameters within protocol

Modbus

YES

YES

YES

IEC104

YES

YES

YES

DNP3

YES

YES

YES

CIP

YES

YES

YES

 

As you can see below, the ability to Log detailed information (Addresses and Values) and supply high visibility (in DPI level), doesn’t equal to our ability to Enforce policies based on all details – See the differences in the following tables:

 

Ability to log:

Protocol

Unit ID

Function

Address

Group

Value

Modbus

V

V

V

 

V (only for registers)

IEC104

V

V

V

 

V

DNP3

 

V

V

V

V

CIP

V

V

V

 

V

 

 

Ability to enforce :

 

 

Protocol

Unit ID

Function

Address

Group

Value

Modbus

V

V

V

 

V (only for registers)

IEC104

V

V

V

 

V

DNP3

 

V

V

V

 

CIP

V

V

V

 

 

 

  

SCADA Set-Up and Troubleshooting

  1. Follow installation instructions from Release Notes at SK106020:

    For Management Side:

    • Install R77.30
    • Install R77.30 add-on
    • Update Deployment Agent
    • Install CFG jumbo hotfix take 225
    • Install SCADA hotfix
    • If managing 1200R, then install BC package

     

    For Gateway Side:

    • Install R77.30
    • Update Deployment Agent
    • Install CFG jumbo hotfix take 225
    • Install SCADA hotfix

  2. Install SmartConsole from Release Notes at SK106020
    Installing it will allow the administrator to create custom SCADA applications for relevant protocols 





  3. Rulebase: Make sure “complete log” is the selected tracking option


  4. Application Control blade. SCADA is run as application, Make sure it is checked under Gateway properties



  5. For each protocol you wish to apply Deep Packet Inspection (DPI), you will need to first create a custom SCADA application for that protocol and then create a rule with “complete log

Feel free to ask any question you might have. 

Thanks to Mati Epstein‌ for this elaboration

26 Replies
PhoneBoy
Admin
Admin

This is great information, thanks for sharing!

Evan_Dumas
Employee Alumnus
Employee Alumnus

Hey https://community.checkpoint.com/people/eyalre2474d7c-0b58-4fab-8e04-107bb8721a28‌ do we have any commentary on why the status for logging and enforcement is in the current status? and any plans for modification or enhacement?

Eyal_Rashelbach
Employee
Employee

Hi i'm not sure what do you refer in:
"...the status for logging and enforcement is in the current status? "

If you referred to the  Ability to log and Ability to enforce  tables above, pls. note they are not completely the same...

Regarding modification or enhancements if you have special requests please issue RFE

Maciej_Maczka
Contributor

Hi,

Can we do this on R80.10?

MM

Ivan_Pedraza
Explorer

Thanks a lot!! is it possible with R80.10?

0 Kudos
Maciej_Maczka
Contributor

Hi,

can you please update instructions as sk106020 was removed?

Best Regards

MM

0 Kudos
DeletedUser
Not applicable

As of today the sk106020 access level is internal. Am sure this will change, but for now you'll have to contact your Check Point rep to get access.

hth,

bob

0 Kudos
Iain_Keir1
Contributor

Given that sk106020 is now internal, is the above process still the Check Point endorsed method of delivering their ICS solution? If so it seems very prohibitive. 

Iain
CISSP
Eyal_Rashelbach
Employee
Employee

Yes, The process is the same.

We work to simplified the clean I.

Yet the policy setting will be the same.

Best Regards,

Eyal Rashelbach

David_PALA
Explorer

Hey Bob !

Any "public" release date for the SK as we urgently need it, and asking our rep will take too loooooonnnnnnggggg...?

🙂

TIA

Best Regards

David

0 Kudos
Raymond_Chin
Explorer

Can this be done on a 1200R appliance standalone?  

0 Kudos
G_W_Albrecht
Legend
Legend

Here, you do have a Applications & URL Filtering category "SCADA Protocols" - but you can not see what it contains. sk105738 lists: Application Control: Introducing the extended ICS SCADA offering with over 10 protocols (e.g: Modbus, DNP3, OPC, IEC-104, etc.), 500 command-level monitoring as well as granular parameter visibility of Modbus traffic.

But there is no mentioning of SCADA neither in Local or Central Admin Guide nor in any sk...

CCSE CCTE CCSM SMB Specialist
0 Kudos
Shlomi_Feldman
Employee
Employee

Hi Guenther,

could please explain me what is the issue you are claiming above?

do you want to know what is the SK which describe the extended SCADA capabilities?

0 Kudos
G_W_Albrecht
Legend
Legend

Hi Shlomi,

i claim no issue, but wrote that the only place i found referring to SCADA details is sk105738 - so if you you know the SK which describe the extended SCADA capabilities fpr Embedded GAIA devices, please let me know!

CCSE CCTE CCSM SMB Specialist
0 Kudos
Richard_Quick
Contributor

Can someone please point me to the documentation to change Level 2 & Level 3 settings for ICS protocols when using R80.10 MDS and R80.10 Gateway versions?  We see this is possible with R77.30 but are missing the information for R80.10.

0 Kudos
PhoneBoy
Admin
Admin

Some of those settings are not yet available in R80.10 (particularly the Level 3 settings).

0 Kudos
Shlomi_Feldman
Employee
Employee

level 3 settings are available in R80.10 and it is possible to develop a SCADA application by CLI (no UI yet)

PhoneBoy
Admin
Admin

Is there docs we can point at that explains how to do this?

0 Kudos
Shlomi_Feldman
Employee
Employee

0 Kudos
PhoneBoy
Admin
Admin

Is that info available externally for customers?

0 Kudos
Pablo_Barriga
Advisor

Could you please post some of the commands required to achive that, on version 77.30 I just needed o modify the database to get those options.

0 Kudos
Shlomi_Feldman
Employee
Employee

Pablo.

In 77.30 you needed to install a specific HF and then you had UI for generating DPI applications.

In 80.10 after you install the HF, you are able to generate the DPI application but without UI using CLI.

The CLI syntax can be found in the document I attached yesterday.

Examples:
mgmt_cli add scada-application name modbus_unit_3 scada-properties.0.key protocol scada-properties.0.value Modbus scada-properties.1.key unit scada-properties.1.value 3
mgmt_cli add scada-application name cip_function_4 scada-properties.0.key protocol scada-properties.0.value CIP scada-properties.1.key function scada-properties.1.value 4

Pablo_Barriga
Advisor

thanks for the information

0 Kudos
Ken_Coyer1
Explorer

Shlomi, this must be an internal link because it does not take me anywhere.

0 Kudos
PhoneBoy
Admin
Admin

It's an internal link.

Shlomi Feldman‌ can you share the relevant details from that link to CheckMates?

0 Kudos
Marcos_Vieira
Contributor

I think this is an internal site as pointed by PhoneBoy in his comment below. I was unable to access it.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events