Check Point Security Management Reviews

In recent years, management was to have an additional server in our data center or virtual machine that demanded resources locally. Today we have the possibility to have virtual teams in the cloud or on-premise and do not have the need to create that machine. We take that server to the Check Point cloud as a management cloud where we can have each subscription and be able to manage everything with the same account. It allows you to manage from anywhere and makes it easier for you to manage additional teams.

Check Point management is one of the most complete solutions for managing Check Point Firewall appliances. 

Since it is so powerful, we can manage more than one appliance with this same tool and create policies per appliance, and integrate different branches. 

One of the great benefits is being able to centralize all our branches under a single management server, thus being able to manage each of the created policy layers from a single place.

Among the most valuable features is the ability to manage everything simultaneously. It can integrate with the Check Point Infinity Cloud. 

The costs of acquiring a server for this task is of value. Each of us who are administrators can continuously manage the security of companies. This management manages not only Firewall-type appliances but also Cloudguard IaaS-type appliances.

I would like this solution to be integrated directly into the Cluster XL equipment. We'd like something that is all in one. The implementation becomes quite complex due to the extensive and not very graphic guides that we can find on their portal. 

I've used the solution for two years. 

It is very stable. You can have it in high availability services.

The scalability is fast and easy.

We previously used Fortinet as a firewall and management solution.

The cost of having cloud management lowers the monthly bill. That must be considered when acquiring these solutions.

We deployed the Check Point firewall for protecting our web servers and intranet servers. We used a management server as a centralized device for Check Point Gateway firewalls.

The best aspect about the notion is that we can push policy, IPs, or any other functionality to all or a subset of gateways. Alternatively, creating a distinct tab for each gateway gives a clear idea of the configuration changes and makes them less complicated.

Check Point's solution cuts down on the time it takes to manage multiple firewall devices.

Our organization has faced multiple attackers daily which causes high-impact performance, even though the previous firewall blocks. This leads to an impact on customer satisfaction with our services.

However, after deploying Check Point firewalls in our organization we found drastic changes in the performance of our network   

The management server helps us to reduce the time to manage multiple firewalls.

It's easy to push configuration changes to each of the gateways.

We can track logs of each firewall which is very helpful.

The importance of centralized administration cannot be overstated. As a network security engineer, I must mention that it allows us to manage all of our Check Point devices from a centralized point. 

Although there is certainly room for improvement in the UI, I am pleased that Check Point continues to correct and enhance. 

Furthermore, they provide some new features that will revolutionize security administration.

Initially, I was not a huge fan of Check Point's SmartConsole; I'm not sure why; perhaps it was because I was used to using only the web interface in other vendor firewalls like Palo Alto, Fortigate, and so on.

Now that I've tried it, I have to say that it's the greatest way to handle firewalls. There are some flaws, however, Check Point is working to correct them with each version.

They need to make a Mac version of the SmartConsole, in my opinion.

Aside from that, I'm satisfied with Check Point solutions.

I've used the solution for two years.

Check Point Security Management is primarily used for managing our security gateways that are deployed in multiple offices around the world. We have 20+ gateways in total. 

Security management also has reporting functionality which can be passed off to our internal security team as well as our senior leadership team. 

SmartView is also a handy utility that allows our system admins to have insight into the network traffic which reduces the need to contact the network support team each time something is not functioning.

Check Point Security Management has improved the organization and it assists with easy manageability of all of our globally deployed gateways which if they were not centrally managed, would be very time-consuming to manage. 

The compliance blade provides detailed reports in regards to our policy configuration and global configuration of the gateways which can be easily read to determine if something needs to be actioned. It also contains multiple different other reports that can be utilized by various other departments.

The compliance is great. It verifies the overall compliance of all of the gateways and attached policies against standards. It offers ready-to-use reports that are detailed.

The SmartView monitor is helpful. Having the ability to give read-only access to our system admins where they can look into the firewall logs is a huge plus and reduces the load on the dependency of the network admins. Also, it is very handy in that it is a web console and not an application that needs to be installed on your computer to view the logs. 

It displays very nice dashboards.

Being a security appliance, there should be the ability for the Security Management server to send email alerts via authenticated email. One of our requirements from the organization is to not use unauthenticated email and to only use authenticated email which this does not support.

SmartConsole should be available for MacOS machines. Not every Network/Security administrator utilizes a Windows machine. Being a Mac user, I need to have a VM with SmartConsole installed in order to be able to manage my gateways. I have heard the newer versions allow management through a web version however I have not tested it as of this moment.

I've been using the solution for more than three years.

The solution is very stable.

In terms of scalability, the licensing is restrictive and are cookie-cutter solutions for a number of gateways.

The L1/L2 agents seem inexperienced. Cases often need to be escalated. 

Negative

Yes, we did use something else. We switched as we were looking for something that had a bigger feature set.

We looked into SonicWall and Palo Alto.

We are managing Check Point firewalls worldwide, and establishing VPNs between the main data centers in geographic regions and the other agencies worldwide.

We also establish VPNs between agencies and customers depending on the need. Several different VPN communities are used. We also establish VPNs with customers and partners with different firewall brands (Cisco, Fortinet, Juniper, etc.).

We manage security policies for more than 300 hundred Check Point firewalls by using security policy templates and models.

Check Point Security Management has improved the way to manage several VPN communities depending on the needs.

We now have the ability to centralize the management and administration of about 300 Check Point firewalls all over the world. We are now able to interconnect easily those firewalls by establishing VPN communities.

We are now also able to monitor the different VPN communities in real-time.

We can use a security policies template to apply to our 300 firewalls and this is really time-saving.

The ability to easily mount VPN between firewalls, depending on the needs (star, meshed, or combined architecture) and depending on the type of firewall has been helpful.

We appreciate the fact that we can monitor the version of the managed firewalls in order to plan the firewall upgrades over time.

I like that I have the ability to apply a security policy model and template to many firewalls, depending on the firewall usage and architecture (DMZ firewall, LAN firewall, etc.).

We also like the way we can monitor the firewall traffic and we use this feature very often to troubleshoot user traffic.

We would like to improve the upgrade process in order to do mass upgrades to firewalls and to be able to upgrade target firewalls at the same time.

I would like to be able to use Check Point Security Management in a way where it is hosted on the cloud. I'd like secured Security Management directly reachable from wherever you are with no need to install the Check Point client software on the laptop.

I would also like to have the ability to easily export the Check Point security policies in order to exploit the data in other applications and have more compatibility with other applications.

I've used the solution for 12 years.

The solution is highly stable.

The solution is quite scalable.

They have good support that is reactive.

Positive

I also use Fortinet due to Check Point legal restrictions. Check Point is banned in some countries.

The initial setup was straightforward.

We implemented it through a vendor team with a very good level of expertise.

We have a good ROI.

We also looked into Palo Alto, Fortinet, and Cisco.

As a consultant for a security infrastructure consulting firm, I install and integrate this solution at client premises. There are many types of client domains, such as financials, government, healthcare, etc. 

It's a stable and complete product that is easy to use and capable of managing their next-gen firewall infra around the globe without compromises. 

Once the Check Point infra is up and running, clients really appreciate its capabilities of centrally managing security rules, making traffic flows visible, and quick detection and response capabilities in case of issues.

It allows clients to quickly learn about the product and its capabilities and thus focus quickly on what really matters, security. 

The concepts are easy to understand but powerful. As the management is easy and fast, the workload is less compared to other products. Access can be restricted granularly so different types of profiles can access the management solution without the risk of breaking anything. The helpdesk people can investigate the first line and provide findings to other teams for solution implementation. 

The rulebase management and the shared layers concept are implemented well. It avoids double work and reduces the risk of human errors. It makes the management solution very scalable.

Working with multiple administrators is possible. Changes are visible to others once you publish changes.

Investigating logs is easy and fast. The search results are provided with all details, so an in-depth analysis of problematic flows is easier.

Installation of policies is fast. For R81.10+ releases, it's a matter of seconds (compared to many minutes in the past).

The upgrade procedure already made huge improvements, yet it remains more challenging compared to other products. However, everything is well documented and the Check Point support is very skilled, so risks are rather limited. 

As this is probably the most complete product within its segment, no huge improvements are required from my point of view. Another problematic point, the policy installation duration time is solved since version R8x, so that's good. Clients always tell me: "Check Point is the Rolls Royce within this segment, it is outstanding". 

I've been using the Check Point Management solution for more than 15 years.

It's very stable with no remarks. Fixes are provided on a regular basis and are easy to install. 

Scalability is very good. Hardware appliances are available and virtual instances can be installed. It is possible to install, for huge deployments, the multi-domain Server. Multiple instances can be installed for redundancy purposes. 

They have excellent support which has improved a lot during the last years.

Positive

We implement other solutions, such as the Fortigate (Fortinet), PAN, and Cisco Secure Firewall (Firepower) with FMC.

The initial setup and installation are easy.

Security Management Server is easy to configure. We have more than six security gateways in different locations. It is easy to manage security gateways separately from Security Management Server. 

Also, we use a security management server as a log collector. Security Management Server is easy to configure. 

We can separately manage and install policies for all gateways. It has separated by blades. It is so flexible. Jumping from one blade to another is really simple. R80.x versions are better than R77.x versions. 

The log section is really good to understand and is really fast. 

The layered architecture is really understandable and easy to use. 

Event correlation function is really brilliant. 

Check Point provides one application with all your needs with the management system.

I do not need to log in to another application or website to see inputs and outputs. 

The monitoring is the best.

The solution offers:

• Strong user community
• Product functionality and performance
• Financial/organizational viability
• Strong services expertise

Policy installation time can be reduced. Proof of concept really matters on this subject. Every organization's needs are different and unique. Therefore, before you purchase the product, use proof of concept as much as you can. 

I have been using Check Point Security Management for more than seven years.

The pricing is not bad.

We use the solution for cybersecurity.  

We use a Check Point internet security appliance and have recently purchased their endpoint security solution.  

We have found the systems easy to manage and monitor. These systems are providing critical security to our computing systems. Past systems have required multiple products from multiple vendors. The Check Point solution provides multiple products under a single interface, greatly simplifying my job.  

We have yet to implement all of the blades/features of the Check Point solution, however, we are very happy with those we have used.

The product has done a great job in protecting our business network and SCADA systems.  

The single management interface has simplified our procedures. Training has been easier since there is only one interface to learn, not multiple interfaces from multiple vendors.  

As we implement more features of the security appliance, we find more value in it. Our cybersecurity posture is stronger than it has ever been with the addition of the Check Point appliance. 

We look forward to implementing additional features of the system.

The single interface to manage multiple cybersecurity platforms is great. In the past, we had multiple security appliances from multiple vendors. Each of these had their own interfaces and their own peculiarities. Staff had to learn multiple interfaces to provide our systems with cybersecurity. Additionally, when there was an issue, multiple systems needed to be checked to clarify and remedy the situation. If something was getting blocked incorrectly, we had to search for which systems was blocking it and then determine whether the block was legitimate. With the Check Point appliance, all of the blades are accessible through a single interface. We can easily track the reason for a block.

Some of the configuration elements could be improved. 

More automation of the tasks that now need to be performed at the level of the operating system could be made more streamlined. For example, we've often had issues where the log space has filled up. It would really be nice to have a feature in the GUI that addresses the cleanup of old files/logs. This is very much a manual process now. I have to get a putty or WinSCP session to the device and dig through the directory structure to find old files that are safe to delete. Luckily, I haven't accidentally deleted any critical files (so far).

I've used the solution for more than five years.

We have found the Check Point device to be very stable.  We rarely have to restart the device and have never experienced a hardware issue.  

The scalability is seamless.  

Customer service and support have always been very responsive.

Positive

We previously used a Netscreen firewall.   

The Netscreen firewall was limited and we had to rely on other appliances from other vendors to augment its capabilities.

It was a straightforward implementation. We did have a consultant help us in the initial setup of the systems.

The level of expertise of our vendor team was very high.

Our ROI is the peace of mind that our systems are well protected.

The Check Point solution is pricy, however, for what you get for your money, it is well worth it.  

The setup is pretty easy and licensing is straightforward.

We asked for a recommendation from a security consultant. They indicated that Check Point was the premier vendor of security appliances.

I'm glad we made the decision to use a Check Point appliance and am sure that we will stick with Check Point when we replace our current system.

We primarily use the solution for the management of thousands of rules. partially automated via the well-documented API.

Managing the rules is a day-to-day business that takes a lot of time. It is really good that we can do the management through the dashboard. It is so comfortable, and, in contrast to other manufacturers, is structured much better. The integration of the logs allows a quick jump by mouse click between rules and log entry.

The API reduces the administrative effort so that we can concentrate on the essential things. in addition, it is an enormous advantage for our customers that rules are created automatically and are available immediately.

The transparency of the rules and the integrated logs makes daily troubleshooting easy and saves a lot of time. 

Managing the rules is a day-to-day business that takes a lot of time. The dashboard is great and much better in contrast to other manufacturers. 

The integration of the logs allows for a quick click between rules and log entry. 

The immediately visible audit logs are also a great advantage. This allows changes to a rule to be tracked quickly and any errors to be corrected.

The management API is the best new feature for me. It allows us to further automate our customers' automated server ordering.

The API reduces the administrative effort so that we can concentrate on essential things. It is an enormous advantage for our customers that rules are created automatically and are available immediately. 

For our private cloud, we have to stay competitive with the public clouds and the speed on offer is what counts here. It's good.

The new web management tool allows the management in the browser, which is a great feature.

The management API can be further developed so that all functions offered by the dashboard are also available via the API (for example,  Network Topology).

The new web management tool which allows the management in the browser has to be developed further so that all functions from the dashboard are available. Many of our administrators work with a Mac OS. Until now, the management of rules is only possible on  Windows as the Smart Dashboard is only available for Windows. Now, with the first release of the web interface, it is possible in the browser. All functions from the dashboard must still be possible via the web interface.

I've used the R77.30 version since 2013.

We've upgraded to R80.10 in 2019. The update was a bit complicated, however, with the pre-check and some cleanup, it went without a problem

We upgraded the R80.10 to R 80.30 in 2020. The update management with the migration of export/import was a remote update and was easy.

We upgraded R80.30 to R80.81 in 2021. The management update was very easy and through the wizard, everything was very clear in terms of the individual steps. The update of the gateways took place at night.

We do not have any stability problems.

Check Point Maestro offers the industry a new way to leverage current hardware investments and maximizes appliance capacity. It's in an easy-to-manage hyper-scale network security solution in order to bring our networks and data centers into the world of hybrid clouds.

The case handling is good. If you have experience and know what information the support needs, then the processing time can be minimized.

Neutral

In the past, we have used a Cisco ASA. Our management of the rules was not so good there.  We also use FortiGate. This already offers a nice web interface, however, managing a large set of rules is almost impossible there.

The initial setup was very simple. However, the migration of rules from other vendors was challenging.

For large migrations, we always use a service provider or the manufacturer's team (Check Point Professional Services). Here we can fall back on well-trained SE's with a lot of experience.

No exact ROI has been calculated.

All of our administrators have previously been on CCSA/CCSE training which provides good insights into the products. After various tests, we were able to carry out most of the setup ourselves in a developer environment. We were able to keep the costs for the migration low by using a lot of our own initiative. However, I would recommend the support of a Check Point certified partner.

Together with a Check Point partner (service provider), the requirements should be evaluated. Here, we were able to draw on the experience of our service provider and develop our environment according to our requirements.

We did not evaluate any other options.

I can recommend the Check Point solution.

We work with multiple clients managing their network firewalls. This includes many multi-national networks as well as local systems in the U.S.A. 

We primarily are utilizing these products for managing customer/client environments to modify access rules and other policies for controlling traffic to and from both internal and external networks as well as cloud-based Azure systems. 

Check Point management products are in use in all these networks, including both standard Single Management Servers as well as Multi-Domain Management servers.

Check Point Security Management has always made it simple and easy to manage all our firewall systems and firewall policies. 

Check Point Security Management systems, both standard Single Management Servers as well as Multi-Domain Management servers, have made it very simple and easy to perform daily functions such as adding new user hosts or destination servers to existing firewall policy rules and successfully managing large corporate networks easily from both our office space or from remote worker systems.

We love the ability to monitor performance in real-time, and gather critical information about network flows and traffic. 

The controls for creating, modifying, and editing firewall policies, firewall configurations, and other system operations are very simple and seamless. Accessing and viewing logging from many firewalls worldwide is also made very simple and intuitive with the ability to see both an overall picture of the logging, as well as the ability to filter down to the most specific traffic flows.

Sometimes there are some performance issues that cause certain operations to run slowly, however, that may just be due to the hardware it is running on needing to be stronger. Check Point could possibly lighten up the software code so that it is not as resource-intensive and will run more smoothly on a variety of hardware and cloud or virtual machine platforms. 

More ability for users to generate reports for traffic flows, firewall performance factors like CPU, memory usage, total bandwidth consumption, and tracing heavy traffic (elephant) flows would also be great.

I've used the solution for over seven years.

So far, we have not experienced really serious issues with the stability of the platform.

Check Point Security Management is pretty robust at allowing the management of large numbers of firewalls - especially the Multi-Domain systems.

Though we do not need to utilize the support services often, they have always been prompt and courteous, and definitely knowledgeable.

Positive

Some of our clients have switched from other firewall solutions such as Fortinet or Palo Alto, however, they were not happy with these systems for various reasons.

These systems are pretty straightforward to install and implement.

Check Point seems to be reasonable with its pricing, and competitive in the market.

Sometimes our clients look at other options such as Palo Alto, or even a blend of these and Check Point.

We use Check Point Multi-Domain Management (Provider-1) to manage several customers with their firewalls as well as handle our internal administrators based on their rights.

Each domain (CMA) contains the customer's firewalls that are managed by us. Bigger customers with more than one domain use global objects as well as global rules so that administrators do not have to implement a local object for each domain.

Since this environment is bigger, we also use a dedicated log server for each domain. That way the logs reside in a different virtual log server.

When using global rules and objects it is possible to push changes to several domains at the same time without touching each individually.

Administration of all users within a single environment makes it easy, instead of connecting to management individually. Using templates for rights helps a lot too.

Last but not least, by only using one VM (or 2 if you include the log server), upgrading and patching are easier. You have a bigger maintenance window, but do not have to upgrade several Security Management Servers by themselves.

Using a single GUI with a single management IP makes things easier if you have to administrate several customers. In the Multi-Domain Environment, you are able to see an overview of all the different customers.

Several health checks are shown for the gateways in an overview so you don't always have to use a monitoring system in parallel since you see some states at a glance after logging in.

Having the possibility to use Smart Event to check for threats on a broader scale helps after a security incident and also makes it easier to check - instead of looking through different logs.

Troubleshooting is quite complicated within multi-domain management. If an issue arises, the local administrator has to keep in mind that there are other domains that could be also affected.

For each version, you have to download a new GUI. Sometimes the GUIs have fixes in them. If you need a new one, you have to inform and update all administrators too.

Some features still use the legacy GUI, however, as far as I know, it is planned to include this in newer versions (R81+). 

Unfortunately, there is still not a rule checker in place where you can insert SRC/DST/Port and it shows you which rule it matches.

I've used the solution for over 10 years.

The solution can scale, depending on the VM environment.

The installation process is quite easy.