Check Point Quantum Spark 1570R, Getting Starded Manual

Page 1: ...Models V81R Classification Protected 29 July 2021 QUANTUM SPARK 1570R APPLIANCE R80 20 XX Getting Started Guide ...

Page 2: ...itten authorization of Check Point While every precaution has been taken in the preparation of this book Check Point assumes no responsibility for errors or omissions This publication and features described herein are subject to change without notice RESTRICTED RIGHTS LEGEND Use duplication or disclosure by the government is subject to restrictions as set forth in subparagraph c 1 ii of the Rights...

Page 3: ... the Check Point Certifications page Check Point 1500 Appliances For more about the 1500 Appliance Series see the 1500 Appliance home page Latest Version of this Document in English Open the latest version of this document in a Web browser Download the latest version of this document in PDF format Feedback Check Point is engaged in a continuous effort to improve its documentation Please help us by...

Page 4: ...ce Diagrams and Specifications 23 Front Panel 25 Management LED 29 Network LEDs 30 Back Panel 31 Side Panels 33 SIM Card Installation 36 Using the First Time Configuration Wizard 38 Welcome 39 Zero Touch 39 Authentication Details 41 Appliance Date and Time Settings 43 Appliance Name 44 Security Policy Management 45 Internet Connection 46 Local Network 48 Wireless Network 49 Administrator Access 51...

Page 5: ...Contents Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 5 Zero Touch Cloud Service 61 USB Drive or SD Card 62 Health and Safety Information 63 Information sur la Santé et la Sécurité 71 Support 78 ...

Page 6: ...ppliances include a comprehensive security suite and the latest R80 software for SMB appliances The Quantum Spark 1570R Next Generation Firewall NGFW secures Critical Infrastructure and Industrial Control Systems ICS without impacting operations Over 70 standard and proprietary protocols identify and secure SCADA Supervisory Control and Data Acquisition and ICS equipment This includes the most pop...

Page 7: ...iemens and more 1400 in all See the full list at appwiki checkpoint com n Wi Fi Cryptography supports WPA TKIP 128 bit and WPA2 AES 128 256 bit n 3 4G LTE Cryptography supports NAS AS security procedures and Snow 3G AES ZUC security n Certified to operate in harsh conditions l Industrial IEEE 1613 IEC 61850 3 IEC 60945 EN IEC 60529 heat and immunity to electromagnetic interference l Rugged EN IEC ...

Page 8: ...block connector 1 Terminal block connector for external DC Mains connection customer s power infrastructure Wall mount kit 1 2 2 Includes drilling hole location sticker Screws M4x6 truss screw Screw anchors DIN rail kit 1 DIN rail adapter 4 screws SIM pin WiFi LTE model only 1 SIM slot pin Antenna WiFi LTE model only 3 2 WiFi Antenna RP SMA connector black color LTE Antenna RP SMA connector black ...

Page 9: ...e The LED is red if there is an alert or error 3 Connect the standard network cable to the LAN1 port and to the network adapter on your PC 4 If you use an external modem Connect the Ethernet cable to the WAN port on the appliance back panel and plug it into your external modem or router s PC LAN network port The Internet LED on the appliance front panel lights up when the Ethernet is connected For...

Page 10: ...ear side for the 1570R wired flavor n Wall mount Attached from bottom panel Use the sticker included in the box and the 2 screws and anchors as part of the box accessory kit n Wall mount brackets comply with IEC60068 2 27 severity level 30g 11ms IEC61850 3 Class 2 2 side brackets from the bottom side of the 1570R Wired and WiFi LTE It is sold separately as a FRU Note For Maritime installations use...

Page 11: ...nce R80 20 XX Getting Started Guide 11 To mount the appliance using the DIN rail kit Attach the DIN rail kit with the 4 M3 screws which came in the box Depending on the model the DIN rail mount holes are located on the back panel or bottom panel or both ...

Page 12: ...Setting up the Appliance Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 12 Back panel ...

Page 13: ...Setting up the Appliance Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 13 Bottom of the appliance In the 1570R WiFi LTE model use the DIN rail mount holes located on the bottom panel ...

Page 14: ...e wall 4 Mount the appliance and verify the 2 screws are fastened well to the appliance To mount the appliance to the wall side brackets The side wall mount brackets are not part of the kit and are sold separately as an FRU 1 Attach each bracket to the side of the 1570R appliance Use 2 screws for each bracket 2 on the diagram 2 Use the holes on the bracket 1 on the diagram to mark the screw placem...

Page 15: ...2 side screws of the terminal block connector Before wiring the device make sure that n The terminal block is suitable for 14 AWG 6A Torque value is 0 60 Newton meter 5 Pound inch n The cross sectional area of the earthing conductors should be at least 14AWG n The temperature rating of the input connection cable should be higher than 95 C n The product supports two power inputs l External power ad...

Page 16: ...ply pole to the 1570R pole Power sub station To comply with the power sub station certification IEEE 1613 and IEC 61850 3 you must connect both power inputs for power redundancy To connect DC power to the equipment 1 Turn OFF all power sources and equipment that will be attached to this appliance 2 Connect protective earthing first with at least 14 AWG G Y color PE conductor diameter 4 0mm min scr...

Page 17: ... 14 AWG multi core copper n Strip the wire and leave the bare lead approximately 10mm for terminals connection n Torque the wiring terminal screws to 0 60 Newton meter 5 Pound inch n Wire strip length is 4 4 mm n For supply connections use wires with a minimal temperature rating of 90 C n If the power source requires ring terminals you must use a crimping tool to install the ring terminals to the ...

Page 18: ...cal Code Part I CSA C22 1 CAUTION This equipment has a connection between the earthed conductor of the DC supply circuit and the earthing conductor See installation instructions This equipment has a connection between the earthed conductor of the DC supply circuit and the earthing conductor All of the following installation conditions must be met n This equipment shall be connected directly to the...

Page 19: ...R80 20 XX Getting Started Guide 19 First Time Deployment Options There are different options for first time deployment of your gateways n Using the First Time Configuration Wizard on page 38 n Zero Touch Cloud Service on page 61 n USB Drive or SD Card on page 62 ...

Page 20: ...and EMEA and one for Asia Pacific n Dual SIM functionality is supported to enable automatic fail over between SIMs n 4G LTE supports CAT6 while 3G supports HSPA and UMTS no 2G support n Peak download rate is 300Mbps and uplink of 50Mbps n Two external antennas RP SMA type Main and Diversity to allow the best RF signal and coverage Frequency and bands supported 4G LTE Radio frequency and bands Regi...

Page 21: ...0 13 700 17 1900 25 850 26 700 29 only Receive Canada 1900 2 1700 4 850 5 2600 7 700 13 700 17 700 29 only Receive 3G Radio frequency and bands Region Country Band Transmit Frequency MHz Receive Frequency MHz APAC and Australia 1 1920 1980 2110 2170 5 824 849 869 894 8 880 915 2110 2170 EMEA 1 1920 1980 2110 2170 3 1710 1785 1805 1880 8 880 915 925 960 ...

Page 22: ...ted Guide 22 Region Country Band Transmit Frequency MHz Receive Frequency MHz North America 2 1850 1910 1930 1990 4 1710 1755 2110 2155 5 824 849 869 894 Canada 2 1850 1910 1930 1990 4 1710 1755 2110 2155 5 824 849 869 894 For more information on LTE see sk167276 ...

Page 23: ...Getting Started Guide 23 Appliance Diagrams and Specifications This section describes the different features in the front back and side panels of these 1570R models n Wired n WiFi LTE Note Depending on which model appliance you have some of the specifications below may vary Wired ...

Page 24: ...Appliance Diagrams and Specifications Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 24 WiFi LTE ...

Page 25: ...Front Panel Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 25 Front Panel Wired Note The Tower LEDs reflect the system status The 5 LEDs are bi color blue and red ...

Page 26: ... progress or installing firmware Blinking blue l Error Alert Red 2 12 60V 48VDC input Connects to the power source cable from your power infrastructure 3 Ground screw Protective earthing terminal 4 Power cord socket Plug the power adapter cord in here Use only Check Point power adapters 5 USB port 3 0 USB port 3 0 for software download 6 Serial port Plug in the serial cable here standard D59 7 Con...

Page 27: ...Front Panel Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 27 WiFi LTE Note LEDs and ports are identical on Wired WiFi LTE models ...

Page 28: ...ond LTE antenna Diversity Notes n You must attach all provided WiFi antennas to the appliance n The SMB appliance supports the use of LTE antennas from other vendors If you use an adapter from the RP SMA to the desired connector this can cause additional signal loss and attenuation n Many mobile carriers require a minimum Total Radiated Power TRP which requires an efficient antenna Make sure the p...

Page 29: ...nt script Blinks red rapidly Zero Touch process is completed SMP activation is not needed LED off Activation sleeping time Blinks blue slowly Reactivation Blinks blue rapidly SMP is connected Solid blue SMP mode is off LED off Gateway failed to connect to the SMP and will exit from the retry script Constant red Wait times before retry Failure Waiting Time 1st 2 minutes 2nd 4 minutes 3rd 8 minutes ...

Page 30: ... network LEDs RJ45 WAN and LAN ports and the SFP Each port uses a bi color LED to reflect the link activity and speed from 10M to 1GbE The SFP port supports only 1GbE RJ45 and 1G SFP LED1 Green LED2 Amber No link Off Off 1G link ON Off 1G Act Blink ON 100M link ON Off 100M Act Blink Off 10M link ON Off 10M Act Blink Off ...

Page 31: ...Back Panel Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 31 Back Panel Wired ...

Page 32: ...tum Spark 1570R Appliance R80 20 XX Getting Started Guide 32 WiFi LTE Key Item Description 1 Anti theft slot Insert anti theft cable here Use Kensington and Sunbox TL 623M cable as a reference 2 M3 DIN rail mount hole ...

Page 33: ...Side Panels Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 33 Side Panels Wired ...

Page 34: ...Side Panels Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 34 WiFi LTE ...

Page 35: ...resets the system but does not remove any user parameters 2 SD card slot Insert micro SD card here 3 Factory Default Press the button continuously for 12 seconds to restore the appliance to its factory default All user parameters previously configured are removed 4 SIM card slot Insert SIM card here WiFi LTE model only ...

Page 36: ...IM Card Installation Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 36 SIM Card Installation To install the SIM card 1 Remove the SIM card tray cover 2 Use the pin to pop out the SIM tray ...

Page 37: ...0R Appliance R80 20 XX Getting Started Guide 37 3 Insert the SIM card into the tray Note The SIM card tray can support up to 2 SIM cards n SIM 1 Micro SIM n SIM 2 Nano SIM 4 Insert the SIM tray into the appliance 5 Replace the SIM card cover ...

Page 38: ...ion Wizard Configure the Quantum Spark Appliance with the First Time Configuration Wizard To close the wizard and save configured settings click Quit Note In the First Time Configuration Wizard you may not see all the pages described in this guide The pages that show in the wizard depend on your appliance model and the options you select ...

Page 39: ... allowed as the input language Zero Touch Zero Touch enables a gateway to automatically fetch settings from the cloud when it is connected to the internet for the first time Note You cannot use Zero Touch if you connect to the internet with a proxy server If the gateway connects to the internet through DHCP the gateway will fetch the Zero Touch settings without any additional action If no DHCP ser...

Page 40: ...ing n Zero Touch service already completed n The First Time Configuration Wizard already completed n Zero Touch service is disabled Where applicable click Retry now to connect again 6 After you connect to the server the settings are automatically downloaded and installed The status is shown in the Fetching settings from the cloud window It may take several minutes until the installation is complet...

Page 41: ...n Confirm Password Enter the password again n Country Select a country from the list for wireless network models Note The country code selection is for non US models only and is not available for all US models Per FCC regulation all WiFi products marketed in the US must be fixed to US operation channels only The country where the license is set determines the wireless frequency and parameters as t...

Page 42: ...Authentication Details Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 42 ...

Page 43: ...ct location Daylight Savings Time is automatically enabled by default You can change this in the WebUI application on the Device Date and Time page n Date The date on your computer appears by default If required set a different date n Time The time on your computer appears by default If required set a different time n Time Zone The time zone on your computer appears by default If required select a...

Page 44: ... Name In the Appliance Name page enter a name to identify the appliance and enter a domain name optional When the gateway performs DNS resolving for a specified object s name the domain name is appended to the object name This lets hosts in the network look up hosts by their internal names ...

Page 45: ...in SmartConsole with a network object and security policy n Local management The appliance uses a web application to manage the security policy After you configure the appliance with the First Time Configuration Wizard the default security policy is enforced automatically With the appliance WebUI you can configure the Software Blades you activated and fine tune the security policy This Getting Sta...

Page 46: ...d a GRE tunnel operating to encapsulate PPP packets n L2TP Layer 2 Tunneling Protocol L2TP is a tunneling protocol used to support virtual private networks VPNs It does not provide any encryption or confidentiality It relies on an encryption protocol that it passes within the tunnel to provide privacy n Cellular This is for appliances with an internal LTE modem Both SIM cards are used for the inte...

Page 47: ...Internet Connection Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 47 ...

Page 48: ...ctivity The appliance s original IP is kept as an alias IP to maintain connectivity until the wizard is completed n Subnet mask Enter the subnet mask n DHCP server and range fields DHCP is enabled by default with a default network range Make sure to set the appropriate range and do not include predefined static IPs in your network n Exclusion range Set the exclusion range for IP addresses that are...

Page 49: ...client can connect to the network without authentication To configure the wireless network now 1 Select Configure wireless network now 2 Enter a name in the Network name SSID field This is the name shown to clients that look for access points in the transmission area 3 Select Protected network recommended if the wireless network is protected by password 4 Enter a Password 5 The Hide password optio...

Page 50: ...Wireless Network Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 50 ...

Page 51: ...t the IP address from which the administrator can access the appliance n Any IP address n Specified IP addresses only Select this option to let administrators access the appliance from a specified IP address or network Click New to configure the IP address information n Specified IP addresses from the Internet and any IP address from other sources Select this option to allow administrator access f...

Page 52: ...Administrator Access Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 52 ...

Page 53: ...tivate This message appears Licenses were generated successfully d Click Get Activation File and save the file locally n Register your appliance a Go to https smbregistration checkpoint com b Enter your appliance details and click Activate This message appears Licenses were generated successfully c Click Get Activation File and save the file locally 2 In the Appliance Activation page of the First ...

Page 54: ...tification message is shown 2 Click OK The appliance uses a 30 day trial license for all blades You can register the appliance later in the WebUI from the Device License page If your device is not paired with a User Center account you must create an account or ask your company administrator to create one for you To create a new User Center account for Locally Managed appliances only 1 Click Activa...

Page 55: ...Appliance R80 20 XX Getting Started Guide 55 n First name n Last Name n Email You must enter this a second time to confirm n Company This is the Account Name to which the appliance is paired 4 Click Next The Software Blades Activation page opens ...

Page 56: ...uthenticate communication between the appliance and the Security Management Server securely Enter a one time password and confirm it This password is only used for establishing the initial trust When established trust is based on security certificates Important This password must be identical for the Secure Communication authentication one time password configured for the appliance object in the S...

Page 57: ... behind a 3rd party NAT device select Always use the above address to connect to the Security Management Server Manually enter the IP address or the host name of the appliance should connect to reach the Security Management Server If you enter an IP address it will override the automatic mechanism that determines the routable IP address of the Security Management Server for each appliance If you e...

Page 58: ...Security Management Server Connection Quantum Spark 1570R Appliance R80 20 XX Getting Started Guide 58 ...

Page 59: ...70R Appliance R80 20 XX Getting Started Guide 59 Software Blade Activation Select the Software Blades to activate on this appliance QoS bandwidth control can only be activated from the WebUI after completing the First Time Configuration Wizard ...

Page 60: ...Summary page shows the details of the elements configured with the First Time Configuration Wizard Click Finish to complete the First Time Configuration Wizard The WebUI opens on the Home System page To back up the system configuration in the WebUI Go to Device System Operations Backup ...

Page 61: ... that you want to proceed 3 The Internet connection page of the First Time Configuration Wizard opens Configure your Internet connection and click Connect The settings are automatically downloaded and installed A new window opens and shows the installation status It may take several minutes until the installation is complete When you reconnect to the appliance WebUI or click Refresh you may see on...

Page 62: ...ration file lets you configure more settings and parameters than are available in the First Time Configuration Wizard You can deploy configuration files in these conditions n An appliance with default settings is not configured at all n An appliance that already has an existing configuration The appliance starts automatically mounts the USB drive or SD card and searches the root directory for a co...

Page 63: ...To prevent damage to any system it is important to handle all parts with care These measures are generally sufficient to protect your equipment from static electricity discharge n Restore the communications appliance system board and peripherals back into the antistatic bag when they are not in use or not installed in the chassis Some circuitry on the system board can continue operating when the p...

Page 64: ...mperature up to 75 C The equipment intended use is in a restricted access area This is a Class 1 Laser product Use only IEC 60825 1 certified Optical Transceiver product with minimum operating temperature at 75 C Caution Hot Surface Do not touch the device while it is attached to a power source Caution To reduce the risk of fire use only No 14 AWG or larger for example 12 AWG UL Listed or CSA Cert...

Page 65: ... Point Software Technologies Ltd Manufacturer s Address 5 Shlomo Kaplan Street Tel Aviv 67897 Israel Model Number V 81R V 81WLR Product Options 1570R 1570WLR Appliances Date First Applied August 2020 Declares under our sole responsibility that the products conform to the following Product Specifications RF Wi Fi marked model Cellular marked model ...

Page 66: ...301 489 1 ETSI EN301 489 1 17 EN62311 2008 EN50386 2002 EN50383 2010 AS NZS 4268 2017 FCC Part15C E RSS 247 RSS 102 JP ARIB STD T66 JP ARIB STD T71 AS CS S042 1 4 2018 EN 303 413 EN 308 901 1 FCC Part 22 subp H FCC Part 24 subp E FCC Part 27 subp C H F L FCC Part 27 subp C M FCC part 90 subp I S AS NZS ACMAEMR AS CAS042 1 4 EN301489 1 7 24 52 EN301908 1 2 13 EN50385 2017MPE FCC47CFR Part 15 Subpar...

Page 67: ...based on EN 300 019 2 1 Transportation Conditions Temperature 40 C 85 C Humidity 95 non condensed Vibrations and Shock based on EN 300 019 2 2 Date and Place of Issue August 2020 Tel Aviv Israel Testing lab Address No 9 Harrison Road Harrison Industrial Building 05 01 Issued By Bureau Veritas Consumer Products Services H K Ltd Taoyuan Branch Ling Kou Laboratories Lab Address No 47 2 14th Ling Chia...

Page 68: ... restricted to indoor usage only Radiation Exposure Statement This equipment complies with FCC RF radiation exposure limits set forth for an uncontrolled environment This equipment should be installed and operated with a minimum distance of 29 centimeters between the radiator and your body For Country Code Selection Usage WLAN Devices Note The country code selection is for non US models only and i...

Page 69: ...n section 6 2 2 3 shall be clearly indicated 6 Users should also be advised that high power radars are allocated as primary users i e priority users of the bands 5250 5350 MHz and 5650 5850 MHz and that these radars could cause interference and or damage to LE LAN devices NOTICE This equipment meets the applicable ISED Terminal Equipment Technical Specifications This is confirmed by the registrati...

Page 70: ... by handing it over to a designated collection point for the recycling of waste electrical and electronic equipment The separate collection and recycling of your waste equipment at the time of disposal will help to conserve natural resources and ensure that it is recycled in a manner that protects human health and the environment For more information about where you can drop off your waste equipme...

Page 71: ... ils ne sont pas utilisés ou installés dans le châssis Certains circuits sur la carte système peuvent rester fonctionnels lorsque si l appareil est éteint n Ne jamais court circuiter la pile au lithium qui alimente l horloge temps réel Elle risque de s échauffer et de causer des brûlures Avertissement DANGER D EXPLOSION SI LA PILE EST MAL REMPLACÉE NE REMPLACER QU AVEC UN TYPE IDENTIQUE OU ÉQUIVAL...

Page 72: ...chloraté manipulation spéciale potentiellement requise Voir http www dtsc ca gov hazardouswaste perchlorate L avis suivant est fourni conformément au California Code of Regulations titre 22 division 4 5 chapitre 33 Meilleures pratiques de manipulation des matériaux perchloratés Ce produit cette pièce ou les deux peuvent contenir une pile au dioxyde de lithium manganèse qui contient une substance p...

Page 73: ... ETSI EN301 489 1 ETSI EN301 489 1 17 EN62311 2008 EN50386 2002 EN50383 2010 AS NZS 4268 2017 FCC Part 15C E RSS 247 RSS 102 JP ARIB STD T66 JP ARIB STD T71 AS CSS042 1 4 2018 EN303413 EN308901 1 FCC Part 22 subpH FCC Part 24 subpE FCC Part 27 subp C H F L FCC Part 27 subp C M FCC part 90 subpI S AS NZS ACMAEMR AS CAS042 1 4 EN301489 1 7 24 52 EN301908 1 2 13 EN50385 2017MPE FCC47CFR Part 15 Subpa...

Page 74: ... condensation Vibrations et chocs selon EN 300 019 2 2 Date et lieu d émission Août 2020 Tel Aviv Israël Laboratoire d essais Adresse No 9 Harrison Road Harrison Industrial Building 05 01 Délivré par Bureau Veritas Consumer Products Services H K Ltd Taoyuan Branch Ling Kou Laboratories Adresse du laboratoire No 47 2 14th Ling Chia Pau Vil Lin Kou Dist New Taipei City Taiwan Déclaration à la Federa...

Page 75: ...risé de faire fonctionner cet appareil n Cet émetteur ne doit pas être installé ou utilisé en conjonction avec d autres antennes ou émetteurs n Les opérations dans la bande 5 15 5 25GHz sont limitées à une utilisation en intérieur Déclaration à la FCC sur l exposition aux rayonnements Cet équipement respecte les limites de la FCC en matière d exposition aux rayonnements radio pour un environnement...

Page 76: ...exigence de la p i r e applicable au masque d élévation et énoncée à la section 6 2 2 3 doivent être clairement indiqués Pour 5G B2 avec les périphériques DFS uniquement 5 Lorsqu il y a lieu les types d antennes s il y en a plusieurs les numéros de modèle de l antenne et les pires angles d inclinaison nécessaires pour rester conforme à l exigence de la p i r e applicable au masque d élévation énon...

Page 77: ...produit ou son emballage signifie que le produit ne doit pas être mis au rebut avec les autres déchets ménagers Il est de votre responsabilité de le porter à un centre de collecte désigné pour le recyclage des équipements électriques et électroniques Le fait de séparer vos équipements lors de la mise au rebut et de les recycler contribue à préserver les ressources naturelles et s assure qu ils son...

Page 78: ... a day seven days a week at n 1 972 444 6600 Americas n 972 3 611 5100 International When you contact support you must provide your MAC address For more technical information go to Check Point Support Center To learn more about the Check Point Internet Security Product Suite and other security solutions go to https www checkpoint com ...