Secure Check Point with cnspec

Scan your Check Point Security Management servers to find security risks before they become incidents. cnspec connects to the management plane behind SmartConsole through the Check Point Management API and evaluates administrators, permission profiles, trusted clients, API settings, and the security gateways and clusters the server manages.

Check Point is one of the network devices cnspec can assess. For the full list of supported devices, see the network device scanning overview. New to cnspec? Start with the quickstart.

Prerequisites

To scan a Check Point management server with cnspec, you must have:

• cnspec installed on your workstation
• Network access to the Check Point Security Management Server's Management API (default port 443)
• Credentials for the Management API: either an API key or a username and password

Give cnspec access to your management server

cnspec connects to the Check Point Management API over HTTPS. You authenticate with an API key (recommended) or with a username and password. The account needs only read access to the management configuration.

Test your connection

Before running a full scan, verify that cnspec can connect by opening a cnspec shell. For MGMT_HOST, substitute the hostname or IP address of your management server, and for YOUR_API_KEY, substitute your API key:

cnspec shell checkpoint --hostname MGMT_HOST --api-key YOUR_API_KEY

To authenticate with a username and password instead, and prompt for the password:

cnspec shell checkpoint --hostname MGMT_HOST --username admin --ask-pass

To skip TLS certificate verification (for management servers with self-signed certificates):

cnspec shell checkpoint --hostname MGMT_HOST --api-key YOUR_API_KEY --insecure

If cnspec connects successfully and shows a prompt, you're ready to scan.

Connection options

To target a specific domain on a Multi-Domain Security Management server, add the --domain flag:

cnspec shell checkpoint --hostname MGMT_HOST --api-key YOUR_API_KEY --domain Corporate

Scan a Check Point management server

To scan a management server, use the cnspec scan command:

cnspec scan checkpoint --hostname MGMT_HOST --api-key YOUR_API_KEY

When the scan completes, cnspec prints a pass or fail result for each check and an overall risk score. To output results in other formats such as JSON, JUnit, or SARIF, read Report Results.

You can write your own policies to check your Check Point management servers and gateways against the controls that matter to your organization.

Example checks

You can interactively explore and test checks using the cnspec shell. To open a shell connected to your management server:

cnspec shell checkpoint --hostname MGMT_HOST --api-key YOUR_API_KEY

Below are some example queries and checks you can run from the shell.

Retrieve the management server details

cnspec> checkpoint.management.server { name apiVersion domain }
checkpoint.management.server: {
  name: "mgmt"
  apiVersion: "1.9.1"
  domain: "SMC User"
}

Find administrators with no password expiration

cnspec> checkpoint.management.administrators.where(expiration == "") { name authMethod }

Ensure the Management API is not reachable from anywhere

cnspec> checkpoint.management.apiSettings.accessibleFrom != "all"

Ensure the trusted-client allowlist does not contain "Any"

cnspec> checkpoint.management.trustedClients.none(type == "any")

List gateways and their versions

cnspec> checkpoint.gateways { name version osName }

Find gateways without HTTPS inspection enabled

cnspec> checkpoint.gateways.where(blades.httpsInspection == false) { name }

Find interfaces missing anti-spoofing

cnspec> checkpoint.gateways { name interfaces.where(antiSpoofing == false) { name } }

List VPN communities and their member gateways

cnspec> checkpoint.vpn.communities { name type members { name ipv4Address } }

List clusters and their members

cnspec> checkpoint.clusters { name version members { name ipv4Address sicState } }

List enabled NAT rules with their translated objects

cnspec> checkpoint.natRules.where(enabled) { packageName ruleNumber translatedSourceName }

Learn more

• To learn about all the Check Point resources and properties you can query, read the Check Point Resource Pack Reference.

• To learn more about how the MQL query language works, read Write Effective MQL.

• For more information about the Check Point Management API, see the Check Point Management API reference.