博威---云架构决胜云计算

 找回密码
 注册

QQ登录

只需一步,快速开始

搜索
查看: 2926|回复: 1

CHECKPOINT 发布R80.3版新特性

[复制链接]
发表于 2020-8-13 15:26:39 | 显示全部楼层 |阅读模式
CHECKPOINT 发布R80.3版新特性






Introduction
R80.30, part of the Check Point Infinity architecture, delivers the most innovative and effective security that keeps our customers protected against large scale, fifth generation cyber threats.
R80.30,Check point无限架构的一部分,提供最创新和有效的安全,保护我们的客户免受大规模,第五代网络威胁。
The release contains innovations and significant improvements such as:
该版本包含创新和重大改进,如:
• Practical Prevention against Advanced Threats: The Industry's 1st Threat Extraction for Web. Protect users from malicious web downloads using real-time Threat Extraction technology with a seamless user experience.
• 针对高级威胁的实用预防:业界第一次Web威胁提取。通过无缝用户体验保护用户免受恶意网络下载使用实时威胁提取技术。
• State-of-the-Art HTTPS Inspection: New SSL Inspection Patent Pending Technologies. Delivering the power to inspect SSL-encrypted network traffic with secure SNI verification improvements. Next Generation Bypass: TLS inspection based on Verified Subject Name.
• 最先进的HTTPS检测:新的SSL检测专利技术。通过安全的SNI验证改进,提供了检查ssl加密网络流量的能力。下一代旁路:基于验证主题名称的TLS检查。
Full control over TLS 1.2 traffic with new utility tools to manage cipher suites.
• 完全控制TLS 1.2流量与新的实用工具管理密码套件。
• Superior Management & Visibility: New Performance & Operational Techniques: Central Deployment Tool (CDT) now embedded for simple and automatic deployments of software packages. Enhanced Logging & Monitoring, Cyber Attack Dashboard. Increased productivity using SmartConsole Extensions.
• 卓越的管理和可视性:新的性能和操作技术:中央部署工具(CDT),现在嵌入式用于软件包的简单和自动部署。增强的日志和监控,网络Attack 仪表板。使用SmartConsole扩展提高生产力
R80.30 was released on May 7, 2019. Starting Aug 6th 2019, R80.30 Take 200 with Jumbo Hotfix Accumulator Take_19 (see sk153152) is considered as Check Point's default version (widely recommended for all deployments).
R80.30于2019年5月7日发布。从2019年8月6日开始,R80.30 Take 200和Jumbo Hotfix累加器Take_19(参见sk153152)被认为是check point的默认版本(广泛推荐用于所有部署)。
For R80.30 with Gaia 3.10, a dedicated image is available. For more information, refer to sk152652. 对于带有Gaia 3.10的R80.30,可以使用专用映像。更多信息,请参考sk152652。

What's New in R80.30
Threat Prevention威胁预防
SandBlast Threat Extraction for web-downloaded documents
用于web下载文档的喷砂威胁提取
• Simple to use, easily enabled for an existing Security Gateway, and does not require any changes to your configuration on the network or client side
• 使用简单,易于为现有安全网关启用,不需要对网络或客户端上的配置进行任何更改
• Extends Threat Extraction, Check Point's File Sanitization capabilities, to web-downloaded documents. Supported file types: Microsoft Word, Excel, PowerPoint and PDF formats
• 将威胁提取,check point 的文件清理功能扩展到web下载的文档。支持的文件类型:Microsoft Word、Excel、PowerPoint和PDF格式
• Threat Extraction prevents zero-day and known attacks by proactively removing active malware, embedded content and other potentially-malicious parts from a file. Promptly delivers sanitized content to users, maintaining business flow
• 威胁提取通过主动删除文件中的活动恶意软件、嵌入内容和其他潜在恶意部分,防止零日和已知的Attack 。及时向用户交付经过杀毒的内容,维护业务流程
• Allows access to the original file, if it is determined to be safe
• 如果确定是安全的,允许访问原始文件
Endpoint Security Threat Extraction for web-downloaded documents
对web下载的文档提取端点的安全威胁
• Endpoint and Network compatibility includes a new mechanism that inspects files just once, either by the Security Gateway or the Endpoint client
• 端点和网络兼容性包括一种新的机制,它只通过安全网关或端点客户机检查文件一次
Advanced Threat Prevention先进的威胁预防
• Advanced forensics details for Threat Prevention logs
• 用于威胁预防日志的高级取证细节
• Ability to import Cyber Intelligence Feeds to the Security Gateway using custom CSV and Structured Threat Information Expression (STIX)
• 能够使用自定义CSV和结构化威胁信息表达(STIX)将网络情报提要导入安全网关
• FTP protocol inspection with Anti-Virus and SandBlast Threat Emulation
• ftp协议检查与防毒和喷砂威胁仿真
• Stability and performance improvements for SandBlast Threat Prevention components喷砂威胁预防组件的稳定性和性能改进
• Consolidated Threat Prevention dashboard provides full threat visibility across networks, mobile devices and endpoints
• 统一的威胁预防仪表板提供了跨网络、移动设备和端点的完整的威胁可视性
Enhanced visibility to "Malware DNA" analysis for Threat Emulation
增强对“恶意软件DNA”分析的可见性,用于威胁模拟
Improved understanding for security personnel of how malware analysis is performed and the reasons a file is flagged as malicious. The Threat Detail report now includes the Malware DNA - a deeper exploration into features determined to be similar to those in known malware families. The enhanced analysis of similarities includes:
提高了安全人员对恶意软件分析如何执行以及文件被标记为恶意的原因的理解。《威胁详情报告》现在包括了恶意软件的DNA,这是对已知恶意软件家族的特征的更深入的探索。加强相似性分析包括:
• Behavior
• Code structure代码结构
• File similarities文件相似性
• Patterns of attempted connections to malicious websites and C&C servers
• 尝试连接恶意网站和C&C服务器的模式
Complete facelift for the Threat Emulation Findings Summary Report
完成对威胁仿真结果摘要报告的翻新
• Redesigned Threat Emulation findings report for a more modern look
• 重新设计的威胁模拟结果报告,以更现代的外观
• The report also includes a dynamic map view of malware family appearances around the globe over time
• 该报告还包括一个动态地图视图,显示随着时间的推移,恶意软件家族在全球范围内的表现
• For more details, as well as information about the availability, refer to sk120357更多细节,以及关于可用性的信息,请参考sk120357
Threat Prevention APIs enhancements加强API预防威胁
• Added ability to send files via APIs to be scanned by Anti-Virus on local Check Point appliances. This capability is supported for both Security Gateways and dedicated Threat Emulation appliances
• 增加了通过api发送文件的能力,通过本地check point设备上的反病毒扫描。安全网关和专用的威胁模拟设备都支持此功能
For more information, refer to the Threat Prevention API Reference Guide.
New and Improved Machine-Learning Engines for Threat Emulation
新的和改进的机器学习引擎的威胁仿真
• Added new machine-learning engines focused on malware detection inside document files to achieve an optimum catch rate
• 增加了新的机器学习引擎,专注于文档文件中的恶意软件检测,以达到最佳的捕获率
Enhanced Control of MTA actions and Threat Emulation behavior in case of failure
增强了对MTA操作和失败时的威胁模拟行为的控制
• Added ability for administrators to granularly configure Threat Emulation policy and decide whether to allow a file transfer based on the error type
• 增加了管理员粒度配置威胁模拟策略的能力,并根据错误类型决定是否允许文件传输
• When configuring the MTA gateway to block emails if a scan fails (fail-block), administrators can granularly configure MTA to deliver emails to the users for specific failure types
• 在配置MTA网关以在扫描失败时阻止电子邮件时(故障块),管理员可以详细配置MTA,以便针对特定的故障类型向用户发送电子邮件
• For more details and configuration instructions, refer to sk132492 and sk145552
Enhanced Anti-Virus support加强反病毒的支持
• Anti-Virus protections are now applied by default on files received through the MTA gateway. These protections include signatures, hashes and link reputation checks for attachments, link reputation checks for the email body, and granular enforcement based on the file type
• 在默认情况下,通过MTA网关接收的文件会受到反病毒保护。这些保护包括签名、散列和附件的链接声誉检查、电子邮件主体的链接声誉检查以及基于文件类型的细粒度执行
Enhanced Import of additional IOCs增加了额外的国际石油公司的进口
Gateways configured as MTA can now be enriched with custom Anti-Virus IOCs from external sources.
配置为MTA的网关现在可以使用来自外部源的自定义抗病毒IOCs来丰富。
• IOCs can be manually imported via the User Interface
• IOCs可以通过用户界面手动导入
• Links to external feeds for automatic ongoing IOC importing can be added via a configuration change
• 可以通过配置更改添加指向外部提要的链接,以便自动进行IOC导入
• For more information and setup instructions, refer to sk132193 and R80.30 Threat Prevention Administration Guide
Enhanced support for non-default SMTP ports增强了对非默认SMTP端口的支持
• Added the ability to configure the MTA gateway to send and receive emails on non-default SMTP ports (ports other than 25). For more details and configuration instructions, see sk142932.
• 增加了配置MTA网关的功能,可以在非默认SMTP端口(25个端口之外的端口)上发送和接收电子邮件。有关详细信息和配置说明,请参见sk142932。
Enhanced management of the MTA加强运输署的管理
• Failure to inspect the attachments or links inside an email is now immediately treated as a failure.
• 未能检查电子邮件中的附件或链接现在立即被视为失败。
• Previously, inspection failure resulted in adding the email to the MTA queue and retrying the action. As the majority of inspection retries fail as well, this change reduces the size of the queue and improves MTA performance
• 以前,检查失败导致将电子邮件添加到MTA队列并重试操作。由于大多数检查重试也失败了,所以这个更改减少了队列的大小,并提高了MTA的性能

Security Gateway安全网关
Management Data Plane Separation管理数据平面分离
• Allows a Security Gateway to separate the resources and routing for Management and Data networks. For more information, see sk138672.
• 允许安全网关为管理和数据网络分离资源和路由。
SSL Inspection SSL检查
• Server Name Indications (SNI) 服务器名称指示
o Next Generation Bypass - TLS inspection based on Verified Subject Name下一代旁路检测-基于已验证主题名称的TLS检测
o Improved TLS implementation for TLS Inspection and categorization改进TLS的实施,以进行TLS检查和分类
• TLS 1.2 support for additional cipher suites:
o TLS_RSA_WITH_AES_256_GCM_SHA384
o TLS_RSA_WITH_AES_256_CBC_SHA256
o TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
o TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
o TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
o TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
o TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
o TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
o X25519 Elliptic Curve
o P-521 Elliptic Curve
o Full ECDSA support
o Improved fail open/close mechanism
o Improved logging for validations
o For the complete list of supported cipher suites, see sk104562
IPsec 虚拟专用网
• Redundancy for Multiple Entry Points configuration using Dead Peer Detection (DPD) with third party 虚拟专用网 peers
• 使用第三方虚拟专用网对等点的死对等点检测(DPD)配置多个入口点的冗余
• Improved troubleshooting capabilities allows disabling acceleration only for 虚拟专用网 and per 虚拟专用网 peer. For more information, see sk151114
• 改进的故障排除功能只允许禁用虚拟专用网和每个虚拟专用网对等点的加速。有关更多信息,请参见sk151114
Advanced Routing
• Multihop Ping and Multiple ISPs in Policy-Based Routing
• 基于策略路由中的多跳Ping和多个isp
• Multihop Ping in Static Routes静态路由中的多跳Ping
• BFD in Static Routes静态路由中的bfd
• VSX VSID in Netflow 网络流中的vsx VSID
ClusterXL
• Support for Cluster Control Protocol (CCP) encryption provides better security for cluster synchronization networks.
• 支持集群控制协议(CCP)加密,为集群同步网络提供更好的安全性。

Security Management
Central Deployment Tool (CDT)
• Starting from this release, CDT version 1.6.1 is embedded in Gaia. For more information, see sk111158.
• 从这个版本开始,CDT版本1.6.1就嵌入到了Gaia中。
SmartConsole extensions
• Expand and customize Check Point's SmartConsole for your needs by integrating the tools you work with into SmartConsole or add third-party tools as panels and views inside SmartConsole. For more information, see the SmartConsole Extensions Developer Guide.
• 将您使用的工具集成到SmartConsole中,或者将第三方工具作为面板和视图添加到SmartConsole中,从而根据您的需要扩展和定制Check Point的SmartConsole。
Endpoint Security端点安全
• Endpoint and Network compatibility including a new mechanism that inspects files just once, either by the Security Gateway or by the Endpoint Client, eliminating redundancy.
• 端点和网络兼容性,包括一种新的机制,可以通过安全网关或端点客户端检查文件一次,消除冗余。
• Get email alerts when an Endpoint Policy Server is out of sync.
• 当端点策略服务器不同步时获取电子邮件警报。
• CPUSE upgrade for Endpoint Policy Servers. 端点策略服务器的cpuse升级
Full Disk Encryption
• The number of preboot users using the same client computer increased to 1000.
• 使用同一台客户机计算机的预引导用户数量增加到1000

All R80.20.M2 new features are integrated into this release:
所有R80.20.M2的新功能集成到这个版本中
CloudGuard Controller 云防护控制者
• Support Data Center Objects for VMware vCenter Tags.
• 支持VMware vCenter标签的数据中心对象。
• Support Data Center Objects for VMware NSX Universal Security Groups.
• 支持VMware NSX通用安全组的数据中心对象。
CPView
• CPView support for Multi-Domain Security Management.
• cpview支持多域安全管理。
• Use SNMP for CPView metrics. 使用SNMP作为CPView度量。
SmartConsole
• Operational Efficiency - Add and remove an object from groups within the object editor.
• 操作效率——在对象编辑器中从组中添加和删除对象。
• Logging and Monitoring - Improved, simpler and faster user experience for exporting logs to Splunk.
• 日志和监控-提升了导出日志到Splunk的用户体验,使之更简单,更快速
Advanced Threat Prevention
Consolidated Threat Prevention dashboard provides full threat visibility across networks, mobile and endpoints.
统一的威胁预防仪表板提供了跨网络、移动和端点的完整的威胁可视性。


 楼主| 发表于 2020-8-13 15:27:34 | 显示全部楼层
回复 1# network
Check_Point_R80.30_Gaia_3.10_T273新特性




[url=]版权[/url]



Check_Point_R80.30_Gaia_3.10_T273

Solution
Table of Contents:
• Introduction介绍
• What's New新的改变
• Supported Platforms支持的平台
• Downloads下载
• Known Limitations已知的局限性
• Documentation文档
Introduction
R80.30, part of the Check Point Infinity architecture, delivers the most innovative and effective security that keeps our customers protected against large scale, fifth generation cyber threats.
R80.30,check point 无限架构的一部分,提供最创新和有效的安全,保护我们的客户免受大规模,第五代网络威胁。
This release introduces R80.30 3.10 for Security Gateway and VSX, with major enhancements in firewall resiliency and Clustering mechanism.
这个版本为安全网关和VSX引入了R80.30 3.10,主要增强了防火墙的弹性和集群机制。
This release is considered as a Main Train release, however it is not part of the Check Point R80.30 Release and requires a dedicated image. Note it can be managed by a Check Point R80.30 Security Management Server, which already supports the 3.10 kernel.
这个版本被认为是一个主要的实验版本,但是它不是check point R80.30版本的一部分,并且需要一个专用的映像。注意,它可以由check point R80.30安全管理服务器管理,该服务器已经支持3.10内核。

Starting August 2019 this release will be supported by a Jumbo Hotfix Accumulator release for both R80.30 3.10 and standard R80.30 versions.
从2019年8月开始,R80.30 3.10和标准R80.30版本都将支持大型热修复累加器版本。

R80.30 3.10 can be managed by the following Security Management Server releases:
R80.30 3.10可以通过以下安全管理服务器版本来管理:
• R80.30
• R80.20 with a supported Jumbo Hotfix Accumulator
• R80.10 with a supported Jumbo Hotfix Accumulator (will be available soon)
Contact Check Point Support to obtain a special Hotfix for R80.10 and R80.20 based on your current Jumbo Hotfix Take.

What's New
• Improved firewall resiliency提高防火墙弹性
• Support for IPv6 (resolving R80.20 3.10 limitations)
• Support for Dynamic CLI - Enhancing Gaia Clish with new Expert mode commands.
• 支持动态CLI增强Gaia Clish与新的专家模式命令。
• See sk144112.
• Clustering and VSX capabilities: 集群和VSX功能:
o Unicast support for Cluster Control Protocol eliminating the need for CCP using Broadcast or Multicast modes
o 对集群控制协议的单播支持,消除了使用广播或组播模式的CCP需求
o MAC magic configuration is no longer needed不再需要mac magic配置
o CCP encryption is enables by default缺省情况下启用ccp加密
• New kernel capabilities: 新的内核功能:
o Upgraded Linux kernel升级的Linux内核
o New partitioning system (gpt): 新的分区系统
 Supports more than 2TB physical/logical drives
 支持超过 2 TB 物理/逻辑驱动器
o Faster file system (xfs)更快的文件系统
o Supporting larger system storage (up to 48TB tested) 支持更大的系统存储
o I/O related performance improvements I/O相关的性能改进
o Multi-Queue (see sk153373):
 Full Gaia Clish support for Multi-Queue commands
 Automatic "on by default" configuration
o SMB v2/3 mount support in Mobile Access blade
o Added NFSv4 (client) support (NFS v4.2 is the default NFS version used)
o Support of new system tools for debugging, monitoring and configuring the system: 支持新系统工具,以进行系统的调试、监察及配置:
 iotop (provides I/O runtime stats)
 lshw (provides detailed information about all HW)
 lsusb (provides information about all devices connected to USB)
 lsscsi (provides information about storage)
 ps (new version, more counters)
 psmisc (new version, more counters)
 top (new version, more counters)
 iostat (new version, more counters
• New glibc: glibc-2.17-157
• New ethtool: ethtool-4.8-7
• New Bash: bash-4.2.46-29
• lbzip2 support (free, multi-threaded compression utility)
• xz support
• rsync support

Supported Platforms 支持的平台
• Check Point 16000 and 26000 series
• CloudGuard:
o VMWare
o KVM
o Hyper-V
o AHV
• Open Servers:支持的服务器平台
o HP DL380 Gen10
o HP DL360 Gen10
o HP DL380 Gen9
o HP DL360 Gen9
o Dell PowerEdge R740/R740 XD
o Dell PowerEdge R640
o Dell PowerEdge R330
o Lenovo ThinkSystem SR650


您需要登录后才可以回帖 登录 | 注册

本版积分规则

小黑屋|手机版|Archiver|boway Inc. ( 冀ICP备10011147号 )

GMT+8, 2024-3-28 23:29 , Processed in 0.097717 second(s), 16 queries .

Powered by Discuz! X3.4

Copyright © 2001-2021, Tencent Cloud.

快速回复 返回顶部 返回列表