Summary

This chapter looked at some of the options you have when dealing with an event recorded by CP VPN-1/FW-1. It examined, in some depth, the ability for you to exercise some strong control over these settings and how their judicious use can greatly enhance the security of your network.

Also examined were the alert commands configuration panels, the default settings, and how to alter them to better suit your security policy. You saw that you can modify not only the data that is logged, and when it is recorded, but also what action to take based on event criteria.

The chapter then went on to discuss the process of defining your own programs to handle an event and some of the increased flexibility this allows you when designing your security policy. We even saw how user -defined alerts can be a sort of lightweight IDS system.

Finally, this chapter also showed the GUI interface to SAM, how to interface with the SmartView Tracker GUI to block connections, and how to use the command-line interface to SAM. All in all, the additional features and function added by the ability to define your own alerts, SAM and SmartDefense make Check Point FW-1 NG AI a real standout in the firewall.