VPN-1 Gateway 4.1
Primarily known for its excellent firewall products, Check Point also has a foothold in the VPN market. Check Point sent me the VPN-1 Gateway SP1 package, its combination VPN-1 and Firewall-1 product for NT Server. (The VPN-1 management and firewall modules don't support Win2K.) The hard-copy and PDF-based documentation effectively describes the technology and the complex software. The inclusion of a Recommended Reading section is a nice touch.
The installation, however, wasn't as pleasant. I ran the standard Check Point installation program on my test gateway and found myself in an annoying installation loop. Check Point had sent me an invalid evaluation license key, so the installation failed. Because the installation failed, the process never installed the uninstallation program. Therefore, I had a half-installed firewall-and-VPN gateway. After a brief call to Check Point's extremely helpful technical support team, I obtained a new key. With the new key, I completed the installation and was ready for configuration.
You must install the software's firewall component—a requirement that might be a disadvantage if you already have another vendor's firewall in place. (Running two firewalls is becoming increasingly common, however.) The VPN-1 Gateway architecture is a bit more distributed than that of other VPN solutions, but the installation program gives you the option of installing the management and firewall modules on one server. VPN-1 Gateway consists of three components: the Policy Editor GUI, in which you manage the polices and configure VPN and Firewall services; the Management Module, which stores all the policies, databases, logging files, and other object information files; and the Firewall Module, which inspects the packets on its defined network interfaces. I installed the Policy Editor on the back-end host behind the gateway, and I installed the Management Module and Firewall Module on the Compaq gateway.
You can connect the VPN clients to VPN-1 Gateway in two ways. You can use the SecuRemote client, which is a typical VPN client that lets remote (i.e., Internet-connected) and local (i.e., intranet-connected) users establish secure tunnels to VPN-1 Gateway. Alternatively, you can use the more secure SecureClient.
The SecureClient has a nice feature that lets you dictate to remote clients how the system handles incoming connections. You can use the Policy Editor to set up policies that deny incoming connections to the remote client, thereby ensuring that an intruder can't "piggyback" a connection from the gateway to the client. (A piggyback attack occurs when an intruder exploits the remote VPN client's vulnerability and breaks into the corporate network through the remote client's established tunnel.) You install SecureClient on the remote PCs—and local PCs, if you want to establish a VPN on the local private subnet—that you want to tunnel into the corporate LAN.
I installed the SecureClient on the test laptop. The SecureClient installation is somewhat less rigorous than a full firewall installation, but I wouldn't want to perform the installation over the phone with a CEO. You can choose from an assortment of authentication mechanisms—from a gateway-established user account and password to a more elaborate mechanism such as RADIUS or RSA Security's SecurID. I chose the simple gateway user ID and password mechanism.
The documentation was indispensable as I set up users, groups, encryption domains, and tunnels—all of which the product requires for proper operation. I quickly set up a temporary user, all the appropriate network entities, and the rules to which my test laptop would adhere when connecting into the back-end host behind the gateway.
I launched the Policy Editor, which Figure 7 shows, and successfully connected to the gateway. Policy Editor boasts the impressive and popular Check Point firewall interface, and VPN administration is essentially a function of firewall administration. Only after you learn the fundamentals of the Check Point firewall and Policy Editor will you be able to set up appropriate rules for VPN communication—and standard Check Point firewall schemes.
The bottom line is that this solid product is a firewall solution that gives you VPN functionality. Because of the product's comprehensive and complex nature, its installation was cumbersome. The configuration was also difficult, but after delving into the excellent printed and online documentation, I finally established a tunnel between my remote laptop and back-end server. VPN-1 Gateway's price is reasonable when you compare the product's excellent support and abundant features with that of its competitors.
Choose Carefully
Implementing a VPN solution on a network can be expensive and labor-intensive, especially if the solution involves a firewall installation. Take your time, read the documentation twice, install the demonstration versions, and choose wisely.