Sometimes it's necessary to have zones defined that include "new" or "unknown" networks.

Traditional Approach

The traditional approach in Tufin SecureTrack is to have devices monitored. These devices deliver information about Networks and Routes to SecureTrack. This information is used to build the Topology.
The next step would be to define Zones manually. These zones include networks included in the Topology. So finally, only "known networks" are defined in zones which can be used to define the Unified Security Policy (USP).

Another Approach

Some administrators have a tool for IPAM (IP Address Management) that includes all IP-Adresses and Networks, even if they are not registered in SecureTrack Topology. This information at all shall be used for compliance rules ini the USP. Since an import of zones is possible and no check is done if the networks exist in SecureTrack, exporting these data from IPAM helps, e.g.

Known: Zone a (Network, Zone b (Network

in IPAM: Network which should be imported into a new zone

File for import into SecureTrack Zones:

"#Zone Properties"
"zone name","description"
"Internet","Internet zone is all public addresses, excluding the addresses defined in all other zones"
"Users Networks","Users Networks zone should include the address space from which users can come within your organization"
"c","new zone"

"#Zone Hierarchy"

"#Zone Subnets"
"zone name","subnet","description"

"#Zone Security Groups"
"zone name","security group name","description"

Even if the new zone isn't known in SecureTrack before and the network isn't in the Topology the import works.
After having imported the zones including the new zone c, the USP can be adapted and imported, too. Even if the following example isn't really a USP, it can be shown that it works.

"from zone","to zone","severity","access type","services","rule properties","flows"

"a","a","high","allow all","","",""
"a","b","critical","allow all","","",""
"b","a","low","allow all","","",""
"b","b","high","allow all","","",""
"c","c","high","allow all","","",""
"a","c","critical","allow all","","",""
"c","a","low","allow all","","",""
"b","c","critical","allow all","","",""
"c","b","low","allow all","","",""

After import, the new zone c is shown in the USP, even if the network isn't included in the SecureTrack Topology.


Lesson learnt: If an IPAM hosts all information about the networks, exporting relevant information in the correct format allows to define a USP with networks not even included in the Topology.





How to connect a "traditional" Check Management Server R77.x to SecureTrack has been described before:
Now let's see how a R80.x Check Point Management Server (SMS) can be connected to SecureTrack.


Prepare the Check Point SMS

First of all, a Permission Profile needs to be defined. Since R80, a profile needs to allow write access to SMS due to the new Management API.
To do so, in SmartConsole navigate at top left to Manage & Settings > Permissions & Administrators > Permission Profiles.

You will need an Administrator for Tufin SecureTrack using the Management API. So it's necessary to navigate to Manage & Settings > Permissions & Administrators > Administrators to define it.

Next, an object of the type Host Node is needed representing the System Tufin SecureTrack is running on. This is necessary because the IP address is needed when the OPSEC Application is defined in a later step. To define it, navigate to the top right in SmartConsole and select Object Catetories > Network Objects > New > Host.

To initiate the Secure Internal Communication (SIC), defining an OPSEC Application is necessary. To do so, navigate to Object Categories > Servers > OPSEC Applications > Applications and define a new one. Necessary protocols are LEA (Log Export API) to have access to logs as well as CPMI (Check Point Management Interface) to have access to the objects and rules.

It's necessary to configure the permissions of Tufin SecureTrack within Check Point. For CPMI as well as for LEA a Read-Only Permission Profile should be sufficient. You are free to allow further access, but it's not necessary if the use of only SecureTrack is planned.

After these steps, the SIC should be initiated by setting an Activation Key. This is a One-Time Password for authenticating Tufin SecureTrack at the SMS. When this authentication is successful, a newly generated certificate is transferred to SecureTrack. From then on, authentication is based on this certificate. The communication is encrypted as it is between the Check Point components like e.g. SMS and Firewall Module.


When the password is typed twice, the button Initialize finishes this part of the configuration.

 Please don't forget to make this newly generated certificate available by installing the Database. This is done by Menu > Install Database. If you forget to install the database on the SMS, the connection to SecureTrack won't work.


Prepare the Check Point Rulebase

If there is a Firewall between Tufin SecureTrack and Check Point SMS, a rule must allow the necessary access. Besides the access using LEA and CPMI furhter connections are needed, e.g. for Certificate Management:

  • 443/tpc
    Connection from SecureTrack Server to SMS when using the Management API
  • 18184/tcp
    Connection from SecureTrack to SMS / Logserver to retrieve log data (statistics) and Audit log data (recognition of actions done by administrators)
  • 18190/tcp
    Connection from SecureTrack to SMS with a CPMI client to retrieve the latest revision
  • 18210/tcp
    Connection to SMS for authenticating using the one-time password and for retrieving the certificate
  • 18264/tcp
    Connnection needed to access the CRL running on the SMS to check if the certificate presented by SMS is valid

So a rule needs to be configured. This is necessary if any firewall is between SecureTrack and SMS. When a Check Point Firewall is in between, the rule could look like this:


 Configure Check Point SMS in Tufin SecureTrack

The Check Point SMS needs to be defined in SecureTrack so the configuration can be monitored. To do so, some steps are necessary. First of all, connect with administrative rights to Tufin SecureTrack using a web browser using HTTPS (443/tcp). In the default configuration doesn't redirect a HTTP request from port 80/tcp to the correct port.


In the Menu go to Settings > Monitoring > Manage Devices. On the left pane all monitored devices are listed. On the right side a new device can be definded. Here, select Check Point SmartCenter.

After this selection a wizard starts, asking for several configuration options in six steps.

The Device Type can't be changed here since this option has been selected before. The other options are:

  • Name for Display
    Name shown in SecureTrack for this device
  • Domain
    If SecureTrack is configured to use Domains, the corresponding Domain can be selected there. Please be aware that using this option clearly separates all data.
  • Get revisions from <IP> or <Offline File>
    If the SMS is monitored live, the IP Address of the SMS is provided here. If there is no direct access, configuration data can be imported. Please be aware that this option requires a license also - even if there is no monitoring of the changes.
  • Usage Analysis
    Here it's selected which data are collected. Esp. when "Rule and Object Usage" reports are required, the first two options need to be selected.
  • Topology
    It's recommended to select the enablement of the Topology because in this case, all information that require Topology is available (e.g. Policy Analysis, Zones, Compliance Rules...).
  • Version of Check Point SMS
    If you are using R80, be sure to select R80 here since the connection differs from the "traditional one".

The next step is to authenticate using the One-Time Password and to retrieve the certificate used from then on to authenticate.

It's necessary to provide the name of the OPSEC Application configured in Check Point SmartDashboard. The Activation Key is the One-Time Password provided during configuration in Check Point SMS.


In many cases the next windows can be kept using "default" for the OPSEC settings.

If there were changes configured in $CPDIR/conf/sic_policy.conf they can be considered here. It's all about authentication used for LEA and CPMI. All relevant Check Point options can be selected, so a successful authenticated connection from Tufin SecureTrack to Check Point SMS is possible.

The next step has been introduced with R80. For use of the Management API it's necessary to have an administrative user defined at the SMS (see above). Tufin SecureTrack uses this administrator to connect to the SMS via HTTPS.

In some cases the configuration for the timing of monitoring needs to be adjusted.

As in many cases, the default setting is useful when the global configured timing is sufficient.

Finally, the configured connection should be tested. If this is ok, the buttons Save and Done finalize the configuration.


Monitoring the Check Point R80 SMS

The status of monitoring the SMS can be checked using Menu > Settings > Administration > Status. Depending on the connection and the load on the Check Point SMS the status will remain some time in "Starting" and "Yellow". When it has changed to "Green" the SMS is shown under Menu > Compare also in green and after a short time the first revision will show up.





Tufin SecureTrack offers some possibilities if a device can't be monitored directly. One of them is to define a Generic Device. Just a short explanation of this kind device and how to configure it.

Generic Device

This kind of device is defined for SecureTrack Topology only. No Monitoring, no security configuration and no logs are imported into SecureTrack. Such a device is necessary if a non monitored device is needed to correct / enhance the Network Topolgy SecureTrack is working with. As you know, that's the base for enhanced features of SecureChange and SecureApp. So it's important to let the Topology of SecureTrack show the reality regarding Networks and Routing.

Since no data is used for reports, analysis of rule bases etc. no license for such a device is necessary.

Why and how to define it? Let's assume you have a topology which isn't according with the reality. Mostly the reason is a missing device, connecting two or more networks. The topology shows like e.g.

So defining a Generic Device might help to improve the topology to show the reality.

Just create a plain ASCII file with all relevant data. Referring to the User Guide might be useful...  ;)
If you want to define a Generic Device to connect the device "firstvs" managed by "SMC-Rio" with the net the plain ASCII file might look like this example:

Name, Ip, Mask, Vrf

Destination, Mask, Interface, Next-Hop, Vrf,, interface1,

Now it's time to import the file to SecureTrack. This is done in the menu option "Network > Topology > Add Generic Device".

The next step is to save the file and to wait for a moment. SecureTrack is calculating the new Topology. After finishing it, the Generic Device is shown in the SecureTrack Topology. For sure, this change will also be known in SecureChange.

So from now on, this device is known in Tufin SecureTrack Topology and also considered by the other components of the Tufin Orchestration Suite.
If there is a "big Core Device" by Cisco, no definition of all Interfaces and routes is necessary. Just an import of exported configuration data does the job. Redirect the output of

# show ip route
# show ip interface

to a file and import it as shown above. We have proved this also for very big configuration files - and it works if it's a Cisco device...  


By default, Tufin TOS runs with Apache configured to listen on port 443/tcp to accept HTTPS only. In some installations users are used to type http:// only - so a redirect might be useful. Since on machines running Tufin TOS (mostly) only this applilcation is active, the change of the apache configuration can be done globally and doesn't require things like VirtualHosts etc.

To make Tufin listen on Port 80/tcp for HTTP in cleartext and to redirect this request to Port 443/tcp to use HTTPS these steps are necessary:

- Backup your original configuration file /etc/httpd/conf/httpd.conf and keep in a safe place

- Edit the file /etc/httpd/conf/httpd.conf :

  • After the line
    add a new line with
       Listen <IP Address of the Tufin Server>:80
    to make the system listening on the network IP address and not on the internal IP address only
  • Add the line
         RewriteEngine On
    to enable rewriting (somewhere at the end of the file)
  • Add the line
         RewriteCond %{HTTPS} off
    to check if HTTPS is turned on (it should be). If so, the next line will be executed (Add this line below the rewrite line)
  • Add the line
         RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
    to redirect to HTTPS on Port 443/tcp, and give a 301 Message to the browser (permanent redirect)
    (Add this line below the other two)
  • Save the file

- Now it's time to restart the web server running on the system. You can do it by executing
     service httpd restart
  or by executing the command
     /etc/init.d/httpd restart

- You will need to check if there are any error messages, for sure. And - please test the configuration to be sure it works as you want



When using one or more TOP Plugin other devices than fully supported devices can be monitored. Even if the documentation is very basic, some use cases are there.

Uninstalling a TOP Plugin using the "Red X" in Menu > Settings > Monitoring > TOP Plugins might not be possible in some versions.
If you run into this problem, do an upgrade to TOS R16.1 HF3. This version allows to uninstall a TOP Plugin (again).



How to connect a Check Point Security Management Server (SMS, aka SmartCenter) R77.x to SecureTrack:

Prepare the Check Point SMS

It's recommended to define a Permission Profile for Tufin's access to the SMS and the logs. If there is only SecureTrack and no provisioning by SecureChange is wanted, a Read-Only Profile is sufficient. To define it, go in the SmartDashboard Menu to Manage > Permission Profiles and define a Read-Only profile.