Multi-Domain Security Management Reviews

The multi-domain server solution allowed us to logically separate our customers, attesting them on separate domains. Each domain has a dedicated database, which allows us to have unique objects/policies for each domain and therefore for each client, without having to deploy different security management servers.

actually nothing, compared to a security management server there are only advantages

enables the isolation of infrastructures belonging to different customers

multi-user connectivity and configuration allowance

manage all devices via one console

can see the logs from the application, you don't need any other app

one device for all configuration and db.

One of the most remarkable things is creating multiple domains based on regions, departments or areas according to the geographical location. This helps us a lot because having various devices that are more expensive at each site is unnecessary making a money-saving on this type of solution.

At this point, I don't have anything to dislike about these features or solutions; I can say the price, but it is worth it because of this solution's scalability.

The easy way to administer, very easily, centralized and the integration with different legacy environments permits the consolidation under one management system permitting to identify of any issue or troubleshooting it the way it should be

I like this product because we can have several and separate security management in a same server.

in r80 and r81 the logs are not as good as in earlier versions

With this solution, we don't have to deploy a server each time we want to deploy new security gateways.

Checkpoint had initially constructed the infrastructure with security management and security gateways. If you had a single security management (SMS or CMA), several gateways and a few security policy it’s working. However when you have different set of policies with large number of security gateways, single CMA is not sufficient. You can’t handle the logs or monitoring in just on single CMA. MDM overcomes these resource based limitations. MDS enable the virtualization of CMAs with dedicated resources each of their own. MDS has also a global policy which can be assigned to all CMAs and gateways. Global policy is generally used for common security rules allowing DNS, Active directory, management, backup etc. as well as common blocking rules like malicious IP addresses. Global policy can also be used for threat prevention policies like applying common IPS policies to the CMAs. It’s a very powerful in terms of assuring consistent security policies throughout the organization. Another advantage of the MDS is the granular/role based assignment of administrators to the CMAs whereas you control the administrative accounts from one single pane like adding, deleting, assigning administrators. Even you can delegate the CMA to the 3rd party companies to operate. Then comes the MLM and SmartEvent. MLM and SmartEvent and Compliance is also managed through the MDS. Upgrades with the MDS is much easier than upgrading many CMAs. High Availability is also supported by installing another MDS. Synchronization of primary and secondary MDS is automatic. Integration with 3rd party tools through the MDS is another advantage. You can update, add, delete 3rd party tools through the MDS and it’s very easy.

The initial purchase of the security gateway and its management is free of charge. You need to pay money to MDS even you have dedicated Security management licenses. After deploying MDS in case you see performance issues on the MDS site than you need to divide log server which means purchasing additional Hardware. DR/HA implementation is additional cost. MDS Global policy assignment has some limitations; you cannot overwrite the global policy on the CMA. On the TP side, global policy and local policy usage is cumbersome. Unified policy migration on the gateways directly links the global policy type unified vs simplified. Support cases related to MDS generally take time to solve, Checkpoint TAC demands the MDS backup, and it’s huge. Many times we encounter cases where the TAC recommends upgrading the latest version. Migrating to new version needs a dedicated lab environment to test the whole migration process. If you don’t test it with the verifier, it fails. We see many times the verifier gives error and we produce a lab environment to simulate the problems. Migration to MDS needs partner support in big environments. There was a workflow blade working at the MDS level now it’s abandoned. There’s no direct integration with MDS and cloud-based smart center (smart-1 cloud).

You need to pay additional support for MDS environment. For the migration task I recommend to get PS or partner support from the Checkpoint. Buy dedicated high-end newest appliances of Checkpoint for MDS. I won’t recommend MDS running on ESX server. Divide MDS and MLM. MLM needs high-performance I/O, cpu and memory. Install the latest MDS Software version if you start from scratch. Divide the CMAs based on needs and security policies of their own. Backup MDS daily. If you have a problem on the CMA you cannot restore the single CMA; you need to restore the MDS. Avoid using the opsec lea for 3rd party logging systems, log exporter is much better and gives high performance. Use Global policy with caution. Consistently enforce firewall administrators to connect to MDS with the latest smartconsole applications. Apply HFAs regularly. Don’t store too many revisions on the CMAs. Otherwise you’ll get issues in backup and migration. Periodically maintain the rule bases and objects/services.

The main reason, we had switched over Security Management server (SMS) to a Multi Domain Security Management (MDS- old name is Provider-1) is the limitation of multiple admins working on the security policy. Admin is locking the SMS with write policy; other administrators can only work in read only mode to see the logs and status. With R80 it’s much more granular to operate the policy, administrators can now only lock the rules they’re working, and admins cannot lock the entire policy. With the MDS firewall administrators can use a single smartconsole to operate and manage the firewalls. Central smart log on the MDS level assists the firewall administrators in addressing the policy-related issues. The single pane of Smart Event and logging gives full Threat visibility; even the SOC team uses smart console and login to MDS to get more relevant information related to threat hunting and incident management. Integration with 3rd party tools works smoothly through the MDS. Auditors use the MDS to get administrative details.

Three distinct features MDM has 1. Centralized management to have full control of Checkpoint gateway products. 2. Product categorization based on geographical locations, business unit & 3. Scalability - When the business grows, it's so much easier to scale. These are the reason why I would recommend this product to my friends and colleagues.

The initial setup may be a bit complexs.

After combining products based on the geographical locations & business unit, it was a lot easier to identify any issues or troubleshooting that may be needed.

Good Management interface with a scalable solution for managing different environments/clients.

The cost associated with the product and licensing is pretty high

Integrating different legacy environment and consolidating those under one management umbrella.

Check Point Multi Domain Security Management allows us to create multiple domains based on networks/regions/firewalls/departments or which ever reason there might be in order to ease management while not needing multiple devices which needs resources such as time/money/help and space to install.

Provides a feature to provide access to individuals based on their roles and responsibilities rather than each admin getting the access to domains which are not administered by them or their team.

Feature to create domain based backup lacks because of which if something breaks, the whole MDS server is needed to be restored hence affecting every domain.

It lets us create a global policy which prevents us from replicating the same policy again and again for multiple domains hence saving us from duplication and human error.

The Multi-domain security management is a centralized management solution for large-scale distribution environment, the best part of this multi-domain is centralized management, security, scalability etc.

there is no such point to dislike this features

This is very good platform to centralized management.

With the help of

Multi-Domain Security Management eases managing Check Point devices, especially in an enterprise network.

You have to use an additional dashboard for multi-domain security management.

Multi-Domain Security Management helps us to manage our large network more efficiently.