smartoptimize sample report.pdf
CHECK POINT SMARTOPTIMIZE REPORT
Prepared for
By
Date
Table of Contents
- Executive Summary
- System Health
- Objects Database
- Services Database
- Rulebase Analysis
- Policy: DMZ-VSX-policy
- Policy: DMZ1-policy
- Policy: DMZ2-policy
- Consultant Comments
- Remediation Recommendations
- Disclaimer
Check Point Professional Services
Executive Summary
The following document presents the result of a policy optimization project performed by Check Point. The project examined the deployment of your Check Point solutions and identified opportunities to optimize your network security management system. Each recommendation is rated as follows:
- Serious: Needs immediate attention (8 Items)
- Attention: Needs attention (15 Items)
- Good: No need for any action (23 Items)
System Health
Monitoring the system health of your Check Point solutions is critical to identify health issues before they affect system resources. The table below provides a summary on the system health of your management server.
| Status | Comments | |
|---|---|---|
| Disk Usage | √ | |
| Memory Usage | √ | |
| License | √ | |
| Contract | X | 2 out of 4 contracts are expired. |
| Policies Assigned | ! | 3 out of 6 policies are not assigned. |
| Service Analysis | ! | Some of the services are not using their default timeouts. For more details refer to System Report. |
Objects Database
The objects database size can affect performance and policy installation time. The table below provides a summary of the network objects database.
| Status | Count | Percent | Remediation | |
|---|---|---|---|---|
| Total Network Objects | √ | 45786 | 100% | |
| Unused Network Objects | √ | 4 | 0.01% | |
| Duplicate Network Objects | X | 6456 | 14.1% | Consider deleting copies. |
| Nested Network Objects | √ | 395 | 0.86% |
Services Database
The services database size can affect performance and policy installation time. The table below provides a summary of the services objects database.
| Status | Count | Percent | Remediation | |
|---|---|---|---|---|
| Total Services Objects | √ | 1375 | 100% | |
| Unused Services Objects | ⚠️ | 46 | 3.35% | Consider deleting these objects. |
| Nested Services Objects | √ | 7 | 0.51% |
Rulebase Analysis
Policy Optimization Overview
The tables below provide general information about the current status of the active policies analyzed.
| Status | Count | Percent | Remediation | |
|---|---|---|---|---|
| Total Rules | √ | 77 | 100% | |
| Rules utilizing "Any" | X | 21 | 27.27% | -ANY in Source:5-ANY in Destination:14-ANY in Service:2 |
| Disabled Rules | (3) | 3 | 3.9% | Check if rules are required. |
| Unnamed Rules | (4) | 30 | 38.96% | Naming rules helps log analysis. |
| Times Rules | ✓ | 0 | 0% | |
| Non Logging Rules | (5) | 20 | 25.97% | Log rules for better tracking. |
Policy: DMZ1-policy
| Status | Count | Percent | Remediation | |
|---|---|---|---|---|
| Total Rules | √ | 190 | 100% | |
| Rules utilizing "Any" | X | 39 | 20.53% | -ANY in Source:13-ANY in Destination:21-ANY in Service:5 |
| Disabled Rules | (4) | 4 | 2.11% | Check if rules are required. |
| Unnamed Rules | (4) | 123 | 64.74% | Naming rules helps log analysis. |
| Times Rules | √ | 0 | 0% | |
| Non Logging Rules | (4) | 23 | 12.11% | Log rules for better tracking. |
| Stealth Rule | X | Not Found | ||
| Cleanup Rule | √ | Found | ||
| Uncommented Rules | (4) | 3 | 1.58% | Comment rules for better tracking. |
| Section Titles | √ | 49 | 49 section titles found. | |
| Optimization Potential | √ | 10 | 5.35% |
Policy: DMZ2-policy
| Status | Count | Percent | Remediation | |
|---|---|---|---|---|
| Total Rules | √ | 123 | 100% | |
| Rules utilizing "Any" | X | 30 | 24.39% | -ANY in Source:8-ANY in Destination:18-ANY in Service:4 |
| Disabled Rules | (a) | 21 | 17.07% | Check if rules are required. |
| Unnamed Rules | (a) | 65 | 52.85% | Naming rules helps log analysis. |
| Times Rules | √ | 0 | 0% | |
| Non Logging Rules | (a) | 23 | 18.7% | Log rules for better tracking. |
| Stealth Rule | X | Not Found | ||
| Cleanup Rule | √ | Found | ||
| Uncommented Rules | (a) | 7 | 5.69% | Comment rules for better tracking. |
| Section Titles | √ | 31 | 31 section titles found. | |
| Optimization Potential | √ | 2 | 1.65% |
Consultant Comments
PLEASE UPDATE THE SECTION BELOW WITH RELEVANT COMMENTS AND FINDINGS
Findings:
This SmartOptimize service took an export of the Check Point management station and submitted it for review. The general feedback is that the Check Point configuration is adequate but improvements must be made to reach the standard of “best practice.”
Remediation Recommendations
| System Health | |
|---|---|
| Contract | Remediation |
| Contracts complete licenses and are required for upgrades. | If your contract files are invalid or expired, please follow the steps in the "Health check" to remediate the problem. |
| Users | Remediation |
| Redundant local users should be removed. | Please follow instructions in the "health check section. |
| Anti-Spoofing | Remediation |
| Check Point recommends enabling "Anti-spoofing" on GWs. | Refer to "SystemInfo" document for incompatible GWs. |
| Global Properties | Remediation |
| Review Global Properties as per analysis found in "SystemInfo" document. | |
| Policy Optimization | |
| Rulebase Size | Remediation |
| Limit the rulebase to a few hundred rules. | Follow steps to reduce the size accordingly. |
Disclaimer
The Customer hereby attests and acknowledges that the Check Point Professional Services Engineer has completed the project work described above. This work meets the requirements specified by the Customer and has been completed to the satisfaction of the Customer.
Post Project Contact Information
Technical Issues
Check Point Software offers customer support through Worldwide Technical Assistance Centers for customers with a support contract.