CPUSE Deployment Agent build 1669 shows a strange image

[G_W_Albrecht]

Blink image of Check Point Now R80.20 Jumbo HF T13 is now available for download. File Name: blink_image_Check_Point_Now_R80.20_JHF_T13.tgz Package Size: 2433.5 MB Release Date: 20-Mar-2019

But what is this ? GW R80.20 3.1 has take 11, a R80.20 JT 13 i never did find...

[Nir_Naaman]

This is not GW R80.20, this is Now R80.20.

Now is a new Check Point product, a derivative of the gateway that makes threat prevention easy. It does that by making the gateway plug and play and providing the threat prevention management as a cloud-based service.

The reason you can find it in CPUSE is that it's easy to Blink almost any Check Point gateway into a Now. Download and install the image - and if you've pre-registered the appliance on the cloud, it will automatically connect to the cloud and become operational.

[G_W_Albrecht]

Fact is that i can find out nothing about CheckPoint NOW R80.20 anywhere - can you point out the corresponding web page / sk(s) ?

[Nir_Naaman]

Now is a new security as a service (SECaaS) offering, recently demoed at the CPXs. While it is already in production, our marketing collateral is still under construction. That's why you couldn't find it. I'm attaching a presentation of the product. 

The reason you're seeing the image on CPUSE is that almost any Check Point appliance can be converted to a Now, simply by blinking it with this image. After the reboot, the appliance will automatically attempt to connect to the Now Cloud. Assuming you've registered an account on the cloud, the appliance will receive threat prevention policy and become operational, with no further configuration required. It implements the threat prevention blades, with no access policy. No policy means you don't need a management server - just a standard Web browser to access the Now portal for logs, views, and visualizations and to provide basic control and monitoring.

Some customers have deployed Now under fire to repel cyber attacks - this was the subject of our "Threat Hunting with SandBlast Now" breakout presentation at CPX. Having a threat prevention appliance that can be deployed in minutes, when and where it is needed, allows cyber defenders, whether in-house or as Customer Premises Equipment (CPE) for a managed service, to regain visibility and control even in the darkest reaches of their physical and virtualized networks.

[Vladimir]

Nir,

Few questions about Now:

1. You are saying that any GW could be converted to NOW, but not any GW has the "Fail-Open" NICs, so we are talking about "Detect Only" mode off the span ports, correct?

2. Does NOW offers essentially the same capabilities as NGTX on GWs, but with real-time updates instead of the scheduled updates?

3. SSL/TLS support. Does NOW inline has the capability of analyzing encrypted traffic, if it's cert(s) are installed in the infrastructure?

Thank you,

Vladimir

[Nir_Naaman]

1. Yes, without the FONIC we would be talking about detect only; but the conversion would normally include adding the FONIC too.

2. NOW offers essentially the same capabilities as NGTX; minus access control; plus cloud management. NOW is committed to providing "always the latest security". With NOW you don't need to upgrade your existing management and gateway estate in order to enjoy the latest version. 

3. I assume you're referring to outbound HTTPS Inspection. This should be possible, but we haven't added the capability to the portal yet - we can enable it manually by request. 

[Nir_Naaman]

The latest Check Point Now image is now based on R80.30.

Search for: blink_image_Check_Point_Now_80.30.0.12.tgz.

[Nir_Naaman]

Latest is blink_image_Check_Point_Now_80.30.0.15.tgz.

[HeikoAnkenbrand]

nice info