Check Point Firewall Processes and Daemons FWM,FWD,FWSSD ,CPD,CPWD explained with real time examples

hello guys and welcome back to my channel firewall gan today we are going to discuss very important topic of firewall world which is checkpoint firewall security components and their architecture let's deep drive into that checkpoint security components are divided into followings one is your gui client one is your security management and one is your gateways gui client smart console applications such as smart logs smart events smart reporters smart dashboards these are some examples of the gui client we used to get the executor executables for these clients and and we get the executables and these executables are very useful to perform a different gateway operations and help us to provide our different features security management involves all of these security management processes and the gateway security gateway involves all security gateway processes we are going to deep dry on uh components like security management and security gateway uh on this video we are not going to talk about the gui clients so let's start the management components the management components is responsible for all management operations such as reporting login policy initialization uh i mean policy initialization etc checkpoint components architectures actually divided into two mode or phases you can say one is your user mode phase or a process and the other one is kernel mode process or phase where each process is responsible for several operations as shown on the screen cp components architectures which is divided into two mode one is user mode and another one is kernel mode user mode have a different processes involved altogether like kernel mode also have a different processes involved all together please note all of the functionality of the management server is implemented in user mode processes and kernel mode is more of responsible for the you know majority of the security gateway related operations kernel mode decides in the lowest possible location uh as you can see on the screen user mode allows firewalls to function more efficiently in the application layer there is interdependency between the user mode and the kernel mode in some situation there is a requirement that user mode and the kernel mode process need to communicate to allow this i mean some of the application to work well there are two mechanism uh using that kernel mode and the user mode process communicate to each other one is input output controls in short we call it ioctl and the other one is traps when kernel more process wishes to signal to a user mode process it set a trap it is actually changes the value in a registry key and how the traps sit the user mode process monitoring that flags those are like stumbles on the traps and perform the requested operations and when the user mode entity needs to write information to kernel process it uses input output controls ioctl which is an interface which is an uh infrastructure which allows the in entity to call a function in the kernel and supply the required parameters you know when administrator trying to debug the firewall by looking at this details he can decide which process functionality is implemented in the user space and which is implemented in the kernel mode process we are going to deep drive into the processes which resides at the or which functions at the user mode and which functions at the corner mode so next slides give gives you all the processes and the details now let's see what are the processes we get in the management servers and what are the processes we get in a security gateways management servers or management component processes are below management's server or the management component one of the important process what they have is fwm fwm is management process which is available on any management products including multi-domain security management and on the product that require direct gui access such as your smart event below are the main functionality of the fwm number one number one fwm is management process so it performs all gui client communication related things this is a communication between the management server and the gui client and which is done by the gui client communication part second one is debi manipulation database manipulation this includes all the actions that are performed on the management mgmt such as object creations rule creations user creations etc number three policy compilation fwm handles the policy compilations that is later applied to the network traffic during the inspection process management ha sync or management ac sort of functionality the sync management is handled in management high availability as well we can use in a latest boxes previously with the utm1 hybrid deployment as well next important management process is cpd cpd stands for checkpoint daemon cpd is a core process available on every checkpoint product cpd works on management server as well as security gateway below are these security uh below these some features or functions of cpd daemon or a cpd process number one cpd used for secure internal communication functionality secure internet communication is very important part uh when we talk about the communication need to be happen between the management server and the gateway it has to be done via sick the port where the sick is listen those are ports under 180 series i mean the one at xxx uh i mean ports are sick 18209 uh certificate pool also one of the important port uh for the certificate pulling uh is one of the important port which is one eight two one zero and certificate push we use 18211 second important functionality of cpd is status i mean it pull aim on status from the gateway monitoring status from the gateway which is used for the management using uh gui functionality like i mean or you're using a smart event or a smart monitoring the third important functionality of the cpd is transferring messages between the firewall processes so we will be see that part how the messages are transferred between the different firewall processes as well and the last functionality and important critical functionality what cpd performs which is policy installation using this it receives the policy on the gateway and pushes it forward to the relevant processes and to the kernel now let's see next uh important management process which is fwd fwd stands for firewall demon awt allows other processes including the kernel to forward logs to the server as well as to the management server fwd is related to the policy installation i mean fwd also use when policy installation begins and also used to communicate with the kernel using the command line tools such as the command we use fw commands for example uh when setting the kernel variable or when we change the any parameter in the kernel variable that time this fwd process also invoke or whenever you run the commands using uh i mean the kernel control commands when you run those commands that time also the fwd come into the picture basically fwd most of the time we refer whenever the login you know come into the picture if you have any issue related to the login uh administrator initially or first time uh he look into this fwd process whether it's listening well and communication happening with the fwd so most of the login related issues got resolved with the help of ability process now let's see the next process which is a wssd fw ssd is a child process of fwd and fw ssd is responsible for manipulating the security servers in some other videos we'll see what is security servers and how uh they work if you talk about the example fw ssd in walk according to whenever you activate the features such as dlp corresponding rules with the dlp or whenever you invoke with the url resource or smtp resource or sort of authentication so basically fw ssd is a child process of fwd and a lot of features it performs so whenever you have a any sort of issues such as with respect to the you know dlp blade activated and the rule creation and everything you know it's impacting or whenever you you know create your urls and any issues with that in in terms of the you know firewall functionality or the management server functionality or in sort of you know smtp sort of uh smtp resource or authentication issues you need to look into this fw ssd process as well and the last process which i would like to mention here is cpwd we also call it like a watchdog cpwd or a watchdog is a process that invokes and monitor critical processes such as checkpoint demand cpd fwd uh you know fwm on the local machine it has a functionality to attain the restart to this process as well when this process get filled for example when you run the cp stop and cp start uh that time cp wd watchdog also come into the picture in a background to restarting these processes and it has a built-in feature where uh if this process is going down because one of the another reason it's restarted then or is try to attempt uh its attempt to restart these processes among the processes monitored by the watchdogs are like cpd as i said cpd fwm uh fwd and all of the processes just learn the command cpwd underscore admin list space list you will see the different processes which watchdog or cpwd monitor let's talk about something on security gateway processes as well accept the fwm process desktop the process uh works in security gateway as well the security gateway usually referred in a simple simple word is firewall and security gateways components are responsible for the security enforcement encryption decryption authentication and accounting the functionality of the security gateway is implemented both in user mode and the kernel mode as a security gateway is the first and foremost network device running an os it is inherently vulnerable to various network layer attacks to mitigate this risk and the others others some of the fun firewall functionalities implemented at the os level this allows the traffic to be inspected before and getting to the os or to the ip stack so basically this processes are useful to handle the traffic and inspect the traffic if you like to see more of how these cpd fwd fwm and other processes work together i have another video where i have in brief about the packet inspection please go ahead and watch that video and understand how these processes are interrelated and how they work together to process bracket for this video this is what uh i have for you guys

Channel: Firewall Gyaan

Views: 272

Keywords: check point firewall

Id: HBt0DmAIwOU

Length: 17min 31sec (1051 seconds)

Published: Thu Sep 23 2021