Security Management
Security Management
The Security Management domain tests how a Check Point management server stores, versions, and deploys policy. The management database contains objects (hosts, networks, services, gateways), policy packages, layers, and revisions. SmartConsole is a client; edits happen inside a session. Nothing reaches a gateway until an administrator publishes the session and installs the policy on the target gateway or cluster.
Core rules
- Publish makes session edits visible to other administrators; it does not push policy.
- Install Policy compiles the selected policy package and sends it to the chosen gateways, creating a new policy installation entry in the gateway's history.
- Revisions are database snapshots; you can restore a revision, but restoring is itself a management action with consequences.
- A policy package can contain multiple layers: ordered layers, inline layers, and a default cleanup layer. Rule order across layers matters.
- Permission profiles limit what an administrator can edit or install; read-only access still allows viewing logs.
- In Multi-Domain Security Management, a Global Policy can be assigned above domain policies; global rules are enforced before domain rules where the global layer is positioned.
Worked example
Two administrators are logged into the same management server. Admin A edits rule 12 in the Standard layer to add a new service, clicks Publish, then leaves. Admin B opens the policy and clicks Install Policy without publishing an unrelated change of their own. The gateway receives rule 12 with the new service because A published before B installed. If A had not published, B's install would compile the last published revision and the change would not reach the gateway. The reasoning: install reads the published database, not another administrator's private session.
Traps
- Treating Publish as deployment. It is not.
- Installing policy while a session is unpublished and expecting those edits to apply.
- Assuming restoring a revision automatically installs it on gateways.
- Forgetting that policy installation is per gateway or cluster, not global to every managed gateway.
- Confusing a policy package with a layer; packages are installed, layers are evaluated.