Check Point Firewall v2.1.0

About the connector

Check Point Firewall provides small, medium, and large customers with the latest data and network security protection in an integrated next-generation firewall platform, which reduces complexity and lowers the total cost of ownership. Whether you need next-generation security for your data center, enterprise, small business or home office, Check Point has a solution for you.

This document provides information about the Check Point Firewall connector, which facilitates automated interactions, with a Check Point Firewall server using FortiSOAR™ playbooks. Add the Checkpoint Firewall connector as a step in FortiSOAR™ playbooks and perform automated operations, such as blocking or unblocking IP addresses, URLs, or applications, or retrieving a list of blocked IP addresses, URLs, or applications.

Version information

Connector Version: 2.1.0

Authored By: Fortinet

Contributor: Mahdi Naili

Certified: No

Release Notes for version 2.1.0

Following enhancements have been made to the Check Point Firewall Connector in version 2.1.0:

• Added a new configuration parameter Domain.
• Fixed a bug where the action Block IP returned null response when the configuration parameter Install Policy After Publish was not selected.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-checkpoint-firewall

Prerequisites to configuring the connector

• You must have the URL of the Check Point Firewall server to which you will connect and perform the automated operations and the credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Check Point Firewall server.
• To block or unblock IP addresses, URLs, or applications, you need to add the necessary configuration to the Check Point Firewall. See the Blocking or Unblocking IP addresses, URLs, or applications in Check Point Firewallsection.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the Check Point Firewall connector card. On the connector popup, click the Configurations tab to enter the required configuration details.

{ "session-description": ""}

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 and onwards:

operation: Block URLs

Input parameters

Output

The JSON output contains a status message of whether or not the URLs are successfully blocked.

The output contains a non-dictionary value.

operation: Unblock URLs

Input parameters

Output

The JSON output contains a status message of whether or not the URLs are successfully unblocked.

The output contains a non-dictionary value.

operation: Block IP Address

Input parameters

Output

The JSON output contains a status message of whether or not the IP addresses are successfully blocked.

The output contains a non-dictionary value.

operation: Unblock IP Address

Input parameters

Output

The JSON output contains a status message of whether or not the IP addresses are successfully unblocked.

The output contains a non-dictionary value.

operation: Block Applications

Input parameters

Output

The JSON output contains a status message of whether or not the applications are successfully blocked.

The output contains a non-dictionary value.

operation: Unblock Applications

Input parameters

Output

The JSON output contains a status message of whether or not the applications are successfully unblocked.

The output contains a non-dictionary value.

operation: Get Blocked URLs

Input parameters

None

Output

The JSON output contains a list of URLs that are blocked on Check Point Firewall.

No output schema is available at this time.

operation: Get Blocked IP Addresses

Input parameters

None

Output

The JSON output contains a list of IP addresses that are blocked on Check Point Firewall.

Following image displays a sample output:

No output schema is available at this time.

operation: Get Blocked Application Names

Input parameters

None

Output

The JSON output contains a list of application names that are blocked on Check Point Firewall.

No output schema is available at this time.

operation: Validate Configuration Policies

Input parameters

None

Output

The output contains the following populated JSON schema:

{
    "Application Block Policy": "",
    "IP Address Block Policy": "",
    "URL Block Policy": ""
}

operation: Get Sessions

Input parameters

None

Output

The output contains the following populated JSON schema:

{
    "to": "",
    "total": "",
    "from": "",
    "objects": [
        {
            "domain": {
                "domain-type": "",
                "name": "",
                "uid": ""
            },
            "uid": "",
            "type": ""
        }
    ]
}

operation: Get Session

Input parameters

Output

The output contains the following populated JSON schema:

{
    "uid": "",
    "state": "",
    "ip-address": "",
    "locks": "",
    "application": "",
    "connection-mode": "",
    "type": "",
    "description": "",
    "changes": "",
    "domain": {
        "name": "",
        "uid": "",
        "domain-type": ""
    },
    "expired-session": "",
    "in-work": ""
}

operation: Terminate Session

Input parameters

Output

The output contains the following populated JSON schema:

{
    "message": "",
    "number-of-discarded-changes": ""
}

operation: Get Applications Detail

Input parameters

Output

The output contains the following populated JSON schema:

{
    "to": "",
    "total": "",
    "from": "",
    "objects": [
        {
            "domain": {
                "domain-type": "",
                "name": "",
                "uid": ""
            },
            "name": "",
            "uid": "",
            "type": ""
        }
    ]
}

Included playbooks

The Sample - Check Point Firewall - 2.1.0 playbook collection comes bundled with the Check Point Firewall connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Check Point Firewall connector.

• Block Applications
• Block IP Address
• Block URLs
• Get Applications Detail
• Get Blocked Application Names
• Get Blocked IP Addresses
• Get Blocked URLs
• Get Sessions
• Get Session
• Terminate Disconnected Sessions
• Terminate Session
• Unblock Applications
• Unblock IP Address
• Unblock URLs
• Validate Configuration Policies

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Blocking or Unblocking IP addresses, URLs, or applications in Check Point Firewall

1. Log on to Check Point Firewall with the necessary credentials.
   

2. To block or unblock IP Addresses, you must create a policy. The following steps define the process of adding a policy

   1. Create a network group.
   2. Add a new policy in Access Control, and then add the newly created network group in Source. Set the Destination As any and the Action as Drop, as shown in the image in step 1.
      When you are configuring your Check Point Firewall connector in FortiSOAR™, you must use the name that you have specified in this step as your IP Block Policy configuration parameter. In our example, we have named our network group as fortisoar-block-ip, therefore, you must enter fortisoar-block-ip in the IP Block Policy field.
   3. To block or unblock URLs, you must create a policy. The following steps define the process of adding a policy
   4. Create an application or site object.
   5. Add a new policy in Access Control, and add the newly created application or site object in Services & Applications, as shown in the image in step 1.
      When you are configuring your Check Point Firewall connector in FortiSOAR™, you must use the name that you have specified in this step as your URL Block Policy configuration parameter. In our example, we have named our application or site object as fortisoar-url-block, therefore, you must enter fortisoar-url-block in the URL Block Policy field.
   6. To block or unblock applications, you must create a policy. The following steps define the process of adding a policy
   7. Create an application or site group object.
   8. Add a new policy in Access Control, and then add the newly created application or site group object in Services & Applications, as shown in the image in step 1.
      When you are configuring your Check Point Firewall connector in FortiSOAR™, you must use the name that you have specified in this step as your Application Block Policyconfiguration parameter. In our example, we have named our application or site group object as fortisoar-app-block-group, therefore, you must enter fortisoar-app-block-group in the Application Block Policy field.
   9. Configure the firewall using the following steps:
   10. Open SmartConsole and log on to your management server. If you have a multi-domain environment, log on to the MDS domain.
   11. On the left navigation, click Manage & Settings.
   12. Click Blades.
   13. In the Management API section, click Advanced Settings.
   14. Choose between the following options: Accept API calls from the management server only (this is the default setting), All IP addresses that can be used for GUI clients (select this if you want to allow the API server to accept requests only from IP addresses that can be used to connect with the management server using SmartConsole), or All IP addresses.
   15. Once you have made the selection, click the Publish button and use SSH to log on to the management server in the expert mode and type api restart.