How to configure checkpoint (Gaia) firewall as a proxy server?

In 2015, ends support for MS TMG, so many are looking for a replacement. One of these can be Checkpoint. This article demonstrates step by step deployment Checkpoint as a proxy server with basic settings to begin further testing.
Also immediately tried to take into account some mistakes deployment:
Not ping/not telnet 8080 the cluster IP - disable anti-spoofing
Find mac-address for cluster IP
Rules "URL filtering" are not working  - replace Destination from Internet to Any

1. Download "Check_Point_Install_and_Upgrade_R77.Gaia.iso" (http://supportcontent.checkpoint.com/file_download?id=41337)

2. Think of your topology, eg 2 gateways, 2 managment, 2 ISP

3. Choose IP addresses, eg
2 checkpoint gateways
nic1 (DMZ1) 1.1.1.2, 1.1.1.3 and cluster 1.1.1.4
nic2 (DMZ2) 2.1.1.2, 2.1.1.3 and cluster 2.1.1.4
nic3 (Internal) 10.0.0.2, 10.0.0.3 and cluster 10.0.0.4
nic4 (Managment and Sync) 10.0.1.2, 10.0.1.3
2 checkpoint managment
nic1 (Managment) 10.0.1.4, 10.0.1.5

4. Install Gaia on 2 gateways:
for system partition more or equal 15 Gb
assign IP for nic4 (Managment and Sync) 10.0.1.2, 10.0.1.3, managment default gateway 10.0.1.1

5. Install Gaia on 2 managment:
for system partition more or equal 15 Gb
assign IP for nic1 (Managment) 10.0.1.4, 10.0.1.5, managment default gateway 10.0.1.1

6. Login to 2 checkpoint gateways with https://10.0.1.2, https://10.0.1.2
enter name, domain, dns servers
choose "Secure Gateway", "ClusterXL"

generate and remember "Activation Key" - then the password will be used for communication between nodes

assign all IPs for NICs

change static route:
add route for Internal: 10.0.0.0 mask 255.255.0.0 gateway 10.0.0.1
change route for External: 0.0.0.0 mask 0.0.0.0 gateway 1.1.1.1

if you lost connection to GUI, you can do it from console (suffix on - add command, off - delete command)

show configuration static-route
show route
set static-route default nexthop gateway address 1.1.1.1 on
set static-route 10.0.0.0/16 nexthop gateway address 10.0.0.1 on

7. Login to 2 checkpoint managment with https://10.0.1.4, https://10.0.1.5
enter name, domain, dns servers
choose "Primary Managment", "Secondary Managment"

8. Install updates:

 login to Checkpoint with browser, open policy, choose "Automatic" in "Download Hotfix"

install updates

9. Download and install "Smart Console" on managment pc

10. Open "Smart Console" connect to primary managment server

11. Create Cluster: Network Objects - Check Point - Security Cluster - Check Point Appliance/Open Server

ClusterXL, Load Sharing

add members, enter Activation Key

choose network type, eg 

nic1, nic2, nic3 - representing a cluster interface (enter cluster ip)

nic4 - cluster synchronization

12. Change Cluster Properties

open "Topology", click Edit

check IPs, change type External/Internal, rename interface name (one name for one ISP - for ISP Redundancy). 

Next find mac-address for internal cluster IP/disable anti-spoofing: click on internal cluster IP, click edit

click Advanced

copy mac-address

goto "Topology" tab, unmark "Perform Anti-Spoofing based on interface topology"

Close Interface Properties, goto "HTTPS/HTTPS Proxy": mark "Use this gateway as an HTTP/HTTPS Proxy"

Click "Advanced": mark "X-Forward-For header (original client source IP address)"

Goto "Identity Awareness": mark "Detect users located behind http proxy using X Forward-For header"

Goto "General Properties" - mark/unmark Blades

Open "ISP Redundancy" - mark "Support ISP Redundancy" (It works only when a Checkpoint Default Gateway)

Next click Add in "ISP Links", enter name (such as interface name) and choose interface

Close "Cluster Properties"

13. Create "Test" Firewall policy

14. Create Application & URL Filtering policy. You must change Destination to Any.

15. "Save Settings" and "Install Policy"

16. Open router configuration and add cluster virtual IP, mac, eg cisco

arp 10.0.0.4 0100.0100.0100 ARPA

mac-address-table static 0100.0100.0100 vlan 2 interface Port-channel1 Port-channel2 Port-channel3

17. Add DNS A record: 

cp.blogspot.com A 10.0.0.4

18. Configure browser for new proxy and try go to Internet

Very slow work of a mailbox in Exchange 2010

      Faced with an unexpected problem: a single mailbox in the vault is very slow and the Outlook and OWA. After a long diagnostic wake up the user creates a tasks for subordinates from Outlook. The solution was to reset the incorrect synchronize tasks. This can be done manually:
1. Click on the task with an exclamation point in a condition
2. Selected from single copies of tasks
3. click "save this copy"

or by running the Outlook with a parameter /resettodobar

Powershell: create workstation and delegate permissions to join in domain

In this article I show you an example of the script create a computer in the Active Directory and delegating the permissions to add a domain for support team. This script uses the module "Quest ActiveRoles Management Shell for Active Directory". This current module can be downloaded from Dell or old this link(x64)
Please note that the name of the computer a simple and with SamAccountName the symbol "$". This is important, since it is possible to obtain unexpected errors when adding a computer to a domain which is not obvious solution :) eg:

"The computer cannot be joined to the domain because there is not enough disk space"
"You have exceeded the maximum number of computer accounts you are allowed to create in this domain"
"Duplicate computer account in Active Directory"

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue

$pc_name = "PC001"

$OU = "blogspot.com/workstations"

$add_domain_gr = Get-qadgroup "blogspot\suppot_team1" -service dc1.blogspot.com

$pc_name2 = $pc_name + "$"

new-QADComputer -name $pc_name -SamAccountName $pc_name2 -ParentContainer $OU

Start-Sleep -s 30

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Extendedright 'User-Force-Change-Password' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'ReadProperty, WriteProperty' -PropertySet 'User-Account-Restrictions' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights Self -ValidatedWrite 'Validated-DNS-Host-Name' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights Self -ValidatedWrite 'Validated-SPN' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'ReadProperty, WriteProperty' -Property 'SAMAccountName' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'ReadProperty, WriteProperty' -Property 'DisplayName' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'ReadProperty, WriteProperty' -Property 'Description' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'ReadProperty, WriteProperty' -PropertySet 'User-Logon' -ApplyTo ThisObjectOnly

Get-QADComputer -name $pc_name | Add-QADPermission -Account $add_domain_gr -Rights 'DeleteTree, ExtendedRight, Delete, GenericRead'  -ApplyTo ThisObjectOnly

Problems with enable automatic logon in windows

In an enterprise environment with multiple Group Policy, you can face the fact that autologon for Windows not working. It is necessary to make an exception in the following GPO:
1. User: Options screen saver (User Configuration - Policies - Administrative Templates - Control Panel/Personalization - Enable screen saver, Password protect the screen saver, Screen saver timeout)
2. Computer: Options wired policy (Computer Configuration - Policies - Windows Settings - Security Settings - Wired Network (802.3) Policies)

Exceptions can be made by adding a user or computer (or group) in the Group Policy tab Delegation to the deny on the apply of the GPO.

Exchange 2013 "0x80070005-00000000-00000000"

Unexpected error "0x80070005-00000000-00000000" can be obtained in an environment of coexistence of Exchange 2010 and Exchange 2013. This error occurs when you send as of another mailbox. For example,

"user 1" mailbox in Exchange Server 2010

"user 2" mailbox in Exchange Server 2013

"user 2" has "full access" to a "user 1" mailbox, but does not have the right to "send as"

"user 2" tries to forward a letter from the "user 1" mailbox, and the "user 2" receives an error "0x80070005-00000000-00000000"

For the granting of the right to "send as" of the need to execute a command in the Exchange Managment Shell:

Add-ADPermission "User 1" -User "User 2" -Extendedrights "Send As"

Exchange 2010 Managment Console - Queue Viewer. High CPU load.

If the Exchange server console is performed for a long time "Exchange Managment Console - Queue Viewer" it begins to consume large amounts of CPU time, which leads to periodically disable the Outlook. Such situations occur frequently in the management Exchange server administrators group. To avoid such situations, you need to configure limits on a remote RDP sessions. This can be done in person at the relevant servers or Group Policy:

the first method
Administrative Tools - Remote Desktop Services - Remote Desktop Session Host Configuration - RDP-Tcp Properties - Sessions

second method
Computer Configuration - Administrative Templates - Windows Components - Remote Desktop Services - Remote Desktop Session Host - Session Time Limits - Set time limit for disconnected sessions - End a disconnected Session e.g. 10 min

Two ways to add a recipient to exclude spam filter Microsoft Exchange 2010/2013 Edge

In this article I want to write about two ways to add a recipient to the list of exceptions antispam check Microsoft Exchange 2010/2013. The first method is certainly in which the entire outer pouch assigned rating (SCL) of "-1", and usually such mail falls into "Inbox" the recipient's mailbox. The second method allows you to deliver the external mail with a score (SCL) on the basis of which it is possible to move the mail to the "Junk Email" folder.

Method one:
run on Exchange 2010/2013 Edge

$list = (Get-ContentFilterConfig).BypassedRecipients
$list.add("i-evgeny@contoso.com")
Set-ContentFilterConfig -BypassedRecipients $list

Method two:
run on Exchange 2010/2013 FE/backend

Set-Mailbox i-evgeny@contoso.com -AntispamBypassEnabled $true -SCLJunkEnabled $true -SCLJunkThreshold 4

To avoid conflicts must be used for the recipient only one method.