Check Point Next Generation Firewall

Why do you need Check Point Next Generation Firewall?

A firewall that looks only at ports and addresses passes anything able to look like ordinary web traffic. SaaS applications, AI tools and file downloads use the same encrypted connections as the browser, and employees connect to the company from outside the office. A perimeter firewall is where cybersecurity turns into a concrete rule — and where configuration debt builds up fastest.

Check Point Next Generation Firewall (formerly Quantum NGFW) is Check Point’s family of network firewalls with threat prevention, application control and remote access on a single gateway. The vendor describes them as firewalls that, alongside protection against zero-day, DDoS and IoT threats, include SD-WAN and VPN remote access, among other services, and protect AI tools, agents and applications at the network level. The range covers appliances for data centers, large enterprises, the network perimeter, branch offices and industrial environments.

For a CISO, the platform decision is not only about throughput, but about how much traffic the organization is prepared to decrypt in order to see it — and who will still understand the rule set a year from now.

How does it work?

The solution has three components: the gateway (a single gateway, a cluster or a group in a scalable platform), which enforces the security policy at the entry point to the network; the management server (Security Management Server), which stores the policy and distributes it to the gateways; and the SmartConsole console, where administrators configure policies, monitor events and install updates.

ThreatCloud AI

According to the vendor’s documentation, ThreatCloud is the threat intelligence center for all Check Point products, updated from a global network of threat sensors. It continuously updates protections on the gateway, including Anti-Bot and Anti-Virus. When Threat Emulation identifies a new malicious file, the information is reported to ThreatCloud and shared with other customers.

Threat prevention on the gateway

The protection modules (Software Blades) work in layers, before and after infection. IPS protects against exploitation of application and server vulnerabilities, Anti-Bot detects infected hosts and blocks their communication with C&C servers, and Anti-Virus stops malicious files at the gateway before they reach the user. Threat Emulation runs suspicious files from downloads and attachments in a virtual sandbox, Threat Extraction delivers a sanitized copy of the file, and Zero Phishing protects against phishing sites. The vendor also offers an Autonomous Threat Prevention mode with an overview: how many files were inspected, sandboxed, sanitized and blocked.

Platforms

According to the vendor, the Check Point Force series has a modular architecture with interchangeable network interfaces. Spark Firewall is the range for SMBs and managed service providers (MSPs). The largest environments are served by scalable platforms — Maestro, Scalable Chassis and ElasticXL Cluster — in which a group of appliances appears to the network as a single firewall. The vendor offers virtual gateways in public, private and hybrid clouds as Cloud Network Security.

Key features

The features below are described in the public administration documentation for Check Point gateways.

Traffic inspection and control

• HTTPS Inspection — the gateway decrypts and inspects HTTPS traffic it cannot see without this feature; the traffic is then checked by IPS, Anti-Virus, Threat Emulation, Application Control and URL Filtering, among others
• Application Control — identifying, allowing and blocking thousands of applications
• URL Filtering — access to websites and applications by category
• Identity Awareness — rules by user, group and computer, not only by IP address, in environments with and without Active Directory
• Content Awareness and DLP — data and file types in the access policy, with the direction of download or upload, and blocking of sensitive information being sent outside the organization

Network and availability

• SD-WAN — dynamic traffic steering between WAN links based on measured link quality
• Site-to-Site VPN — IPsec tunnels between gateways in star or mesh topologies, including third-party gateways
• ClusterXL — clusters in High Availability and Load Sharing modes
• VSX — multiple virtual firewalls on one appliance, each with its own policy
• IoT Security — the gateway discovers IoT devices on the network and enforces policies for them

How does Check Point Next Generation Firewall handle remote access?

Remote access does not require a separate product: the vendor stresses that it is integrated into every Check Point network firewall. On the same gateway that protects the network, you can configure a client-to-site VPN or an SSL VPN portal that users reach from any browser. The general principles are covered in the VPN glossary entry; here — how Check Point does it.

According to the administration documentation, remote access solutions come in three types:

• client-based — an application on a computer or mobile device gives access to most corporate resources according to the user’s privileges, for example Endpoint Security VPN for Windows and macOS, Check Point Mobile for Windows, Capsule Connect on iOS and Capsule VPN on Android,
• clientless — the user connects through a browser to the Mobile Access portal, usually for web applications, file shares and web mail,
• on-demand client — the connection starts in the browser and a client is installed when it is needed.

Traffic between the client and the gateway is encrypted (IPsec or SSL), and after authentication the user sees only the resources permitted in the access policy. The gateway supports digital certificates, one-time passwords and RADIUS, among other methods, with several login options to choose from. The vendor also lists multi-factor authentication and endpoint compliance checks before the connection is made. The clients work through NAT, hotspots and proxy servers, for example in a hotel or at an airport.

When should you choose application access instead of a VPN client? When a contractor or an employee with a personal device needs a few applications rather than the whole network, consider Check Point SASE. It is a cloud-based solution: Private Access provides Zero Trust access to corporate resources and, for selected applications, access without an agent on the device. A VPN on the gateway remains the natural choice when the organization already runs Check Point firewalls and wants one policy for the office and remote work.

Who is it for?

• Organizations that prioritize preventing threats, not only detecting them
• Companies that need to see the content of encrypted HTTPS traffic
• Environments with many sites and branch offices, managed from a single server
• Organizations with IoT devices on the network that have to be discovered and covered by policy
• Teams that want to handle remote work on the same gateway as the office

When does Check Point Next Generation Firewall make sense for your organization?

Replacing a firewall rarely starts with the technology itself. The starting point is usually one of three situations.

Replacing the perimeter firewall and cleaning up the rules

The current firewall is approaching the end of support, and the rule set has grown for years: nobody remembers some of the objects, and some rules duplicate others. Moving everything one to one moves the debt as well. In a migration project we first inventory the rules and their usage, clean them up, and only then build the policy on the Check Point gateway — with rules based on applications (Application Control) and user identity (Identity Awareness) where today there are only addresses and ports. The cutover is planned for an agreed maintenance window, with traffic tests before and after the change.

Encrypted traffic nobody can see

The security team knows that downloads and web mail go over HTTPS, but the firewall passes them without any insight. Enabling HTTPS Inspection lets the IPS, Anti-Virus, Threat Emulation and Application Control modules inspect encrypted traffic too. This is not only a technical decision: the scope of inspection has to be agreed with the legal department and users have to be informed. The second question concerns the sandbox: Threat Emulation can run in ThreatCloud or on a local appliance, and the documentation notes that sending files to the cloud is a privacy consideration — the choice depends on whether files may leave the company network.

Branch offices and remote employees on one policy

The company has a head office, several branches and employees connecting from home, and each site has its own device and its own exceptions. Gateways managed from a single Security Management Server receive a common policy, branches connect to the head office through Site-to-Site VPN tunnels, SD-WAN distributes traffic across links according to their quality, and remote employees use the VPN client or the Mobile Access portal on the same gateway. For smaller sites, the vendor offers Spark Firewall appliances.

Which scenario to start with is decided by an inventory of the current firewalls, rules and links.

Why deploy Check Point Next Generation Firewall with nFlo?

The effectiveness of a firewall depends more on its policy and maintenance than on the appliance itself. In a Check Point Next Generation Firewall project, the nFlo team:

• inventories the current firewalls, rules, links and remote work setup, and determines which gateway services are needed,
• designs the policy: rules based on applications and identity, the scope of HTTPS inspection, threat prevention and remote access,
• deploys the gateways and the management server, migrates the rules and switches traffic over in an agreed maintenance window,
• maintains the configuration, reviews the rules and updates the policy together with the IT team.

The scope of work is described in the Firewall and NGFW Implementation service. Start the conversation about your environment through contact.

FAQ

What drives threat prevention in Check Point Next Generation Firewall? Several layers of protection running on the gateway: IPS, Anti-Bot, Anti-Virus, Threat Emulation, Threat Extraction and Zero Phishing. Some of them are continuously updated from ThreatCloud, the threat intelligence center for Check Point products, and new threats found in the Threat Emulation sandbox are added to ThreatCloud and protect other customers as well.

Does Check Point Next Generation Firewall support remote access VPN? Yes. According to the vendor, remote access is integrated into every Check Point network firewall: you can use a VPN client on a computer or mobile device, or the SSL VPN portal (Mobile Access) in a browser. When access is needed only to selected applications, for example for contractors, consider Check Point SASE — we describe this in the remote access section.

Which devices does Check Point Next Generation Firewall cover? The Check Point Force series, Spark Firewall for SMBs and managed service providers, scalable platforms (including Maestro) and Cloud Network Security in the cloud. We select the specific model after measuring traffic and agreeing which gateway services the organization needs.

How does migration from another firewall work? We start with an inventory of rules and objects on the current device. Unused and duplicated rules do not move to the new gateway, and the remaining ones are rewritten into a Check Point policy — where possible, based on applications and identity instead of addresses alone. The cutover is planned for an agreed maintenance window, with traffic tests before and after the change.

How do you choose the scope of deployment and licensing? The scope depends on which gateway services are needed: threat prevention, HTTPS inspection, application and identity control, SD-WAN or remote access. Licensing terms are set by the vendor; we agree the scope and the appliance models with the customer before the project, after an inventory of the current infrastructure.

What needs to be prepared before deployment? An export of the current firewall’s configuration and rules, a network diagram with links and sites, a list of critical applications and internet-facing services, the source of user identities (for example Active Directory), and a description of remote work: who connects, from which devices and to which resources. This makes it possible to design the policy and plan the cutover window.

Does Check Point Next Generation Firewall protect the use of AI tools? The vendor describes its firewalls as providing embedded protection for AI tools, agents and applications at the network level. In practice, the starting point is visibility: Application Control identifies applications in traffic and lets you allow or block them, and HTTPS Inspection provides insight into encrypted traffic; we agree the scope of such a policy with the security team.