Checkpoint Updated 156-315.81 Exam Questions and Answers by presley

The Endpoint Policy Management License is required for managing the Endpoint Security Suite, which includes blades such as the Remote Access VPN. The IPSec VPN License is installed on the VPN Gateway and is a basic requirement for a Remote Access VPN solution. The MobileAccessLicense is required on the Security Gateway for the following Remote Access solutions.

You can establish a VPN before the user login to the Endpoint Client by enabling Machine Authentication in the Gateway object of the Smart Console1. Machine Authentication is a feature that allows you to authenticate with a machine certificate and establish a VPN tunnel before the Windows Logon2. This feature provides the following benefits2:

• It enhances the security of the VPN connection by verifying the identity of the machine before allowing access to the network.
• It simplifies the user experience by eliminating the need to enter credentials twice (once for the VPN and once for the Windows Logon).
• It enables seamless connectivity to the network resources and domain services, such as Group Policy, login scripts, and mapped drives. Machine Authentication is supported on Check Point Endpoint Security Client for Windows with E80.71 and higher versions2. It requires a hotfix on top of R77.30 jumbo 286 on the Security Gateway2. To configure Machine Authentication, you need to do the following steps2:
• Generate and distribute machine certificates to the Endpoint machines using a trusted Certificate Authority (CA).
• Enable Machine Authentication in the Gateway object of the Smart Console and select the CA that issued the machine certificates.
• Install policy on the Security Gateway and reboot it.
• Enable Machine Authentication in the Endpoint Security Client and select the machine certificate to use.

The vpn tu command and the SmartView Monitor are two components that allow you to reset a VPN tunnel. The vpn tu command is a command-line tool that lets you view and manage the status of VPN tunnels on a Security Gateway or cluster member. The SmartView Monitor is a graphical tool that lets you monitor the network and security performance, view VPN tunnel status, and reset VPN tunnels. Both components can be used to reset a VPN tunnel by selecting the option to delete IKE SA or IPsec SA for a specific peer or all peers. References: R81 VPN Administration Guide, page 29-30; R81 SmartConsole R81 Resolved Issues, sk170114

The command fw unloadlocal removes the current security policy from the local gateway and returns it to its initial state2. This command can be used as a last resort to restore traffic flow through the gateway if the policy is causing problems. The command fw unloadpolicy is not valid, and the commands fwm unload local and fwm unload policy are used to remove policies from remote gateways3. References: 2: Check Point Software, Getting Started, Unloading Security Policies; 3: Check Point Software, Getting Started, Unloading Security Policies from Remote Gateways.