Check Point Multi-Domain Security Management - MDS (PAYG)

What do you like best about the product?

The multi-domain server solution allowed us to logically separate our customers, attesting them on separate domains. Each domain has a dedicated database, which allows us to have unique objects/policies for each domain and therefore for each client, without having to deploy different security management servers.

What do you dislike about the product?

actually nothing, compared to a security management server there are only advantages

What problems is the product solving and how is that benefiting you?

enables the isolation of infrastructures belonging to different customers

What do you like best about the product?

multi-user connectivity and configuration allowance manage all devices via one console can see the logs from the application, you don't need any other app one device for all configuration and db.

What do you dislike about the product?

sometimes responds very slowly, especially for big environments it requires a lot of resources some occasions. It can be difficult to get used to the working logic for some users.

What problems is the product solving and how is that benefiting you?

if you want to separate databases for different gw's or domains, you can't do this before MDS. If you are a MSSP all your customers can see other's devices and configurations. You can eliminate this.

What do you like best about the product?

One of the most remarkable things is creating multiple domains based on regions, departments or areas according to the geographical location. This helps us a lot because having various devices that are more expensive at each site is unnecessary making a money-saving on this type of solution.

What do you dislike about the product?

At this point, I don't have anything to dislike about these features or solutions; I can say the price, but it is worth it because of this solution's scalability.

What problems is the product solving and how is that benefiting you?

The easy way to administer, very easily, centralized and the integration with different legacy environments permits the consolidation under one management system permitting to identify of any issue or troubleshooting it the way it should be

What do you like best about the product?

I like this product because we can have several and separate security management in a same server.

What do you dislike about the product?

in r80 and r81 the logs are not as good as in earlier versions

What problems is the product solving and how is that benefiting you?

With this solution, we don't have to deploy a server each time we want to deploy new security gateways.

What do you like best about the product?

Multi-Domain Security Management eases managing Check Point devices, especially in an enterprise network.

What do you dislike about the product?

You have to use an additional dashboard for multi-domain security management.

What problems is the product solving and how is that benefiting you?

Multi-Domain Security Management helps us to manage our large network more efficiently.

What do you like best about the product?

As MDS management is a centralized solution, it has several advantages, such as unification, categorization, and scalability. It can help large businesses in their expansion.

What do you dislike about the product?

There is nothing much to be disliked on our side, except maybe the price that can be high with licensing. Some specific issues can be encountered, depending on the features in action.

What problems is the product solving and how is that benefiting you?

We are solving time-based problems as security-related tasks are taking less time to be implemented. It also helped us to centralized all administrative actions, which facilitates our administration.

What do you like best about the product?

Checkpoint had initially constructed the infrastructure with security management and security gateways. If you had a single security management (SMS or CMA), several gateways and a few security policy it’s working. However when you have different set of policies with large number of security gateways, single CMA is not sufficient. You can’t handle the logs or monitoring in just on single CMA. MDM overcomes these resource based limitations. MDS enable the virtualization of CMAs with dedicated resources each of their own. MDS has also a global policy which can be assigned to all CMAs and gateways. Global policy is generally used for common security rules allowing DNS, Active directory, management, backup etc. as well as common blocking rules like malicious IP addresses. Global policy can also be used for threat prevention policies like applying common IPS policies to the CMAs. It’s a very powerful in terms of assuring consistent security policies throughout the organization. Another advantage of the MDS is the granular/role based assignment of administrators to the CMAs whereas you control the administrative accounts from one single pane like adding, deleting, assigning administrators. Even you can delegate the CMA to the 3rd party companies to operate. Then comes the MLM and SmartEvent. MLM and SmartEvent and Compliance is also managed through the MDS. Upgrades with the MDS is much easier than upgrading many CMAs. High Availability is also supported by installing another MDS. Synchronization of primary and secondary MDS is automatic. Integration with 3rd party tools through the MDS is another advantage. You can update, add, delete 3rd party tools through the MDS and it’s very easy.

What do you dislike about the product?

The initial purchase of the security gateway and its management is free of charge. You need to pay money to MDS even you have dedicated Security management licenses. After deploying MDS in case you see performance issues on the MDS site than you need to divide log server which means purchasing additional Hardware. DR/HA implementation is additional cost. MDS Global policy assignment has some limitations; you cannot overwrite the global policy on the CMA. On the TP side, global policy and local policy usage is cumbersome. Unified policy migration on the gateways directly links the global policy type unified vs simplified. Support cases related to MDS generally take time to solve, Checkpoint TAC demands the MDS backup, and it’s huge. Many times we encounter cases where the TAC recommends upgrading the latest version. Migrating to new version needs a dedicated lab environment to test the whole migration process. If you don’t test it with the verifier, it fails. We see many times the verifier gives error and we produce a lab environment to simulate the problems. Migration to MDS needs partner support in big environments. There was a workflow blade working at the MDS level now it’s abandoned. There’s no direct integration with MDS and cloud-based smart center (smart-1 cloud).

What problems is the product solving and how is that benefiting you?

The main reason, we had switched over Security Management server (SMS) to a Multi Domain Security Management (MDS- old name is Provider-1) is the limitation of multiple admins working on the security policy. Admin is locking the SMS with write policy; other administrators can only work in read only mode to see the logs and status. With R80 it’s much more granular to operate the policy, administrators can now only lock the rules they’re working, and admins cannot lock the entire policy. With the MDS firewall administrators can use a single smartconsole to operate and manage the firewalls. Central smart log on the MDS level assists the firewall administrators in addressing the policy-related issues. The single pane of Smart Event and logging gives full Threat visibility; even the SOC team uses smart console and login to MDS to get more relevant information related to threat hunting and incident management. Integration with 3rd party tools works smoothly through the MDS. Auditors use the MDS to get administrative details.

Recommendations to others considering the product:

You need to pay additional support for MDS environment. For the migration task I recommend to get PS or partner support from the Checkpoint. Buy dedicated high-end newest appliances of Checkpoint for MDS. I won’t recommend MDS running on ESX server. Divide MDS and MLM. MLM needs high-performance I/O, cpu and memory. Install the latest MDS Software version if you start from scratch. Divide the CMAs based on needs and security policies of their own. Backup MDS daily. If you have a problem on the CMA you cannot restore the single CMA; you need to restore the MDS. Avoid using the opsec lea for 3rd party logging systems, log exporter is much better and gives high performance. Use Global policy with caution. Consistently enforce firewall administrators to connect to MDS with the latest smartconsole applications. Apply HFAs regularly. Don’t store too many revisions on the CMAs. Otherwise you’ll get issues in backup and migration. Periodically maintain the rule bases and objects/services.

What do you like best about the product?

Three distinct features MDM has 1. Centralized management to have full control of Checkpoint gateway products. 2. Product categorization based on geographical locations, business unit & 3. Scalability - When the business grows, it's so much easier to scale. These are the reason why I would recommend this product to my friends and colleagues.

What do you dislike about the product?

The initial setup may be a bit complex.

What problems is the product solving and how is that benefiting you?

After combining products based on the geographical locations & business unit, it was a lot easier to identify any issues or troubleshooting that may be needed.

What do you like best about the product?

Good Management interface with a scalable solution for managing different environments/clients.

What do you dislike about the product?

The cost associated with the product and licensing is pretty high

What problems is the product solving and how is that benefiting you?

Integrating different legacy environment and consolidating those under one management umbrella.

What do you like best about the product?

Check Point Multi Domain Security Management allows us to create multiple domains based on networks/regions/firewalls/departments or whichever reason there might be in order to ease management while not needing multiple devices which need resources such as time/money/help and space to install. Provides a feature to provide access to individuals based on their roles and responsibilities rather than each admin getting the access to domains which are not administered by them or their team.

What do you dislike about the product?

Feature to create domain-based backup lacks because of which if something breaks, the whole MDS server is needed to be restored hence affecting every domain.

What problems is the product solving and how is that benefiting you?

It lets us create a global policy which prevents us from replicating the same policy again and again for multiple domains hence saving us from duplication and human error. Provides 1 view of all the machines in the system to monitor health/status rather than needing to login to multiple Management Smart Consoles.