Check Point Threat Prevention Packet Flow and Architecture

[Moti]

Check Point Security Gateway Architecture and Packet Flow

Abstract

This document describes the packet flow in a Check Point Next Generation Threat Prevention gateway. Stateful inspection, network and port address translation (NAT), Virtual Private Network (VPN) functions and forwarding are applied per-packet on the inbound and outbound interfaces of the device. State-related information is extracted from packets and maintained in dynamic state tables to evaluate subsequent connection attempts. When possible, throughput and session rate are accelerated by a security acceleration (SecureXL) module.

Session-based processing enforces advanced access control and threat detection and prevention capabilities. To do this we assemble packets into a stream, parse the stream for relevant content and then security modules (Software Blades) inspect the content. When possible, a common pattern matcher does simultaneous inspection of the content for multiple security modules. In multi-core systems this processing is distributed amongst the cores to provide near linear scalability on each additional core.

Security modules use a local cache to detect known threats. This local cache is backed up with real-time lookups of an online cloud service. The result of cloud lookups are then cached in the kernel for subsequent lookups. Cloud assist also enhances unknown threat detection and prevention. In particular a file whose signature is not known in a local cache is sent to our sandbox cloud service for processing where compute, disk and memory are virtually unlimited. Our sandboxing technology, SandBlast Threat Emulation, identifies threats in their infancy before malware has an opportunity to deploy and evade detection. If the protocol requires immediate delivery as is the case with HTTP/S, we extract active content from the file and deliver only safe content to the user while the emulation happens in the background. Newly discovered threats are sent to the cloud database to protect other Check Point connected gateways.

Security is applied at every layer and networking, policy lookup, protocol decoding, and content security is performed only once.

• R77 Security Gateway Architecture
• R77 Security Gateway Packet Flow

References

Content for this document came from the following SecureKnowledge articles. More information is available in the SKs.

• SecureKnowledge sk98799: Kernel Debug
• SecureKnowledge sk104760: ATRG VPN Core.
• SecureKnowledge sk65133: Connection Table Format.
• SecureKnowledge sk98722: ATRG SecureXL.
• SecureKnowledge sk98737: ATRG CoreXL.
• SecureKnowledge sk95193: ATRG IPS.
• SecureKnowledge sk92264: ATRG Anti-Bot and Anti-Virus.
• SecureKnowledge sk98348: Best Practices - Security Gateway Performance.
• Check Point Support Channel on Youtube: Security Gateway Performance Optimization

source: sk116255

[Eric_Beasley]

Thank you, this is great information for R77.30 and prior.

Do we have an updated version of this for R80.10 and later with the changes from improved SecureXL handling and Unified Policy elements for Access Control, like Data Awareness?

[Alfred_Trevino]

Moti- awesome info! I second the request for an updated version of the above for R80.10.  Thanks!

[Moti]

Thx , I think Bob Bent made one 

[Moti]

Also see https://community.checkpoint.com/docs/DOC-2241-infinity-ngtp-architecture