Check Point VSX-1 11060 manual

20 Februar y 2012 Administr ation Guide Check Point VSX NGX R67 Classification: [Protected][...]

© 2012 Check Point Software Technologies Ltd. All rights reserved. T his product and related d ocumentation are protec ted by copyright and distributed under licensing restricting their use, cop ying, distribution, and decom pilation. No part of this product or related documentation m ay be reproduced in an y form or b y an y means without prior w[...]

Important Informat ion Latest Software W e recommend that you install the mos t recent software releas e to stay up - to -dat e with the latest functi onal improvem ents, stability fixes, security enhance m ents and protection against ne w and evolving attack s. Latest Documentation The latest version of this document is at: http://supp ortconte nt[...]

Contents Important Infor mation ............................................................................................. 3 Introduction to VSX ................................................................................................ 9 Product Names .........................................................................................[...]

Working wi th VSX Gatew ays .............................................................................. 32 Creating a New VSX Gatew ay ....................................................................... 32 Modifying VS X Gatew ay Definitions ............................................................... 37 Deleting a VSX Gateway ...........[...]

VSX High Avai lability .......................................................................................... 85 VSX Gateway High Avai lability ...................................................................... 85 Per Virtual Sy stem High Av ailability ............................................................... 85 Virtual System Load Sh[...]

Link Aggregation Overview ............................................................................... 130 Link Aggregation Terminology ..................................................................... 130 How Li nk Aggregation Works ....................................................................... 131 Hig h Availability Overview .....[...]

Migrating from an Open Server to a VS X-1 Appliance ...................................... 177 VSX Diagnostics and T roubleshooting ............................................................. 179 Introduction ...................................................................................................... 179 General Troubleshoo ting Steps .[...]

Check Point VSX Administration Guide NGX R67 | 9 Chapter 1 Introduction to VSX In This Chapter Product Nam es 9 VSX Glossar y 10 VSX Overview 10 How VSX W orks 11 Key Features and Benefits 12 T y pical VSX Deployments 13 Product Names Explanations and proc edures included in this A dministration Guide ca n apply to several brand nam es representing[...]

Introduction to VSX Check Point VSX Administration Guide NGX R67 | 10 VSX Glossary Term Definition VSX V irtual S y stem E x tension - Check Point virtual network ing solution, hosted on a single com puter or cluster contai ning virtual abstractions of Check Point Security Gatewa ys and o ther network devices. These virtual d evices provide the sam[...]

Introduction to VSX Check Point VSX Administration Guide NGX R67 | 11 How VSX Works Each "virtual" Securit y Gateway (kno wn as a Virtual System in VSX terminolog y) functions as an independent fire wall, protecting a specif ic network. Once pack ets arrive at the VSX gateway, it directs traf fic to the Virtual System protecting the desti[...]

Introduction to VSX Check Point VSX Administration Guide NGX R67 | 12 VSX Virtual Net work Topology The exam ple shows how a single VSX g ateway, in this case conta ining four Virtual S ystems, protects all four network s. Figure 1-2 A VSX gateway replaces multiple physical gateways Each Virtual S y stem in a VSX environm ent works as an i ndividua[...]

Introduction to VSX Check Point VSX Administration Guide NGX R67 | 13 VSX QoS Enforcement provides t he ability to control net work quality of service in the VSX network environment b y supporting the Differentiated S ervices (Dif fServe) protocol and ass igning different transmiss ion characteristics to different classes of service. Non-Stop Secur[...]

Introduction to VSX Check Point VSX Administration Guide NGX R67 | 14  College cam puses with many discrete net works for s tudents, faculty and administration  Any other large organ ization requiring m ultiple firewalls In each case, VSX pro vides access c ontrol, NAT, VPN, rem ote access, logging, and IP S services.[...]

Check Point VSX Administration Guide NGX R67 | 15 Chapter 2 VSX Architect ure and Concepts In This Chapter Overview 15 The VSX Gatewa y 15 Virtual Devices 18 VSX Managem ent Overview 22 VSX Traffic Flo w 25 VSX Routing Conce pts 27 VSX Clusters 30 Overvie w This chapter prese nts an overview of c ore VSX concepts and describes the archit ecture and[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 16 Local Managemen t Conn ection W hen using a local m anagement server (Securi ty Management Serv er or Multi -Dom ain Security Management), all m anagem ent traffic is handled by a dedicated managem ent interface (DMI) that connects the managem ent server with the VSX ga[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 17 Check Point recom mends that remote m anagement connections use a d edicated m anagement interface (DMI) that connects directly to a router or switch t hat leads to the externa l network or the Inter net. The following diagram illustrates this scenario. Figure 2-4 Typic[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 18  Provisioning and loggi ng may degrade user perform ance  Does not support se veral new VSX features  Non-DMI is irreversi ble - yo u cannot change a non -DMI gatewa y to DMI Virtual Devices This section desc ribes virtual network com ponents and their characte[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 19 A typical bridge m ode scenario incorpor ates an 802.1q compatible VLAN s witch on either side of the VSX gateway. The Virtua l System interf aces do not require IP addresses an d it remains transparent to t he existing IP network . Figure 2-5 Virtual System in the Brid[...]

VSX Architecture a nd Concepts Check Point VSX Administration Guide NGX R67 | 20 Virtual Switches By providing layer- 2 connectivit y, a Virtual Switch connects Virtual S ystems and fac ilitates sharing a common physical interf ace w ithout segmenting the ex isting IP network . As with a physical switch, eac h Virtual Switch m aintains a forwarding[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 21  A Physical Interface c onnects the Virtual Switch to an ex ternal router le ading to the Int ernet.  VLAN Interfaces connect the Virtual S ystems to the VLAN Switch, via A VLAN trunk .  The VLAN switch co nnects to the protected networks . Physical Interf aces[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 22 Unnumb ered Interfaces VSX allows you reduce t he number of IP addresses required for a V SX network deplo y ment when using on e or more Virtual Ro uters. A W arp link connected to a Virtual Rout er can "borrow" a n existing IP address f rom another interface[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 23 Note - According t o the Check Point EULA (End User License Agreement), a Securi ty Gatewa y can only manage s ecurity policies for Virtual System s belonging to a single legal e ntity. In order to m anage Virtual System s belonging to m ultiple legal entities, you need[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 24 Description 1 SmartDom ain Manager 2 Multi-Domain Serv er 3 SmartDashboard 4 Domain Managem ent Server 5 Main Domain Man agement Ser ver 6 VSX Gatewa y 7 VSX Virtual S y stem in Domain Managem ent Servers Using the SmartDo main Manager , you provision a nd configure Dom[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 25 VSX Traffic Flo w Overview A VSX gatewa y processes traff ic according to the following steps:  Context determ ination  Security enforc ement  Forwarding to destina tion Context Determ ination VSX incorporates VRF (Virtual Routing an d Forwarding) technolo gy t[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 26 Connectio n via a Virtual Switch Traffic arriving via a Virt ual Switch passes to the appropriate V irtual System based on the destination MAC address, as defined in the Virtual Switch f orwarding table. T raffic arrives at the Vir t ual S y stem via the W arp Link asso[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 27 Connectio n via a Virtual Router Traffic arriving via a Virtual Router pass es to the appropriate V irtual System based on entries in the Virtua l Router routing table. R outing ma y be destination -base d, source-base d or both. Traff ic arrives to the designated Virtu[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 28 The figure below pr esents an exam ple of how Virtual S ystems connected to a Virtual S witch and a ph ysical VLAN switch com municate with each other. In this exam ple, a host in VLAN 100 sends d ata to a server located in VLAN 200. Figure 2- 12 Routing of virtual traf[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 29 Overlapping I P A ddress Space VSX facilitates conn ectivity when m ultiple network segments share the sam e IP address range ( IP add ress space ). This scenar io occurs when a single VSX gateway protects se veral independent n etworks that assign IP addresses to endpo[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 30 Limitations  Source-based routi ng does not support overlapping IP address es.  Anti-spoofing protec tion is not effectiv e for pack ets origination form a shared internal interf ace because there is no ph y sical or log ical segregation of traf fic. In this case,[...]

VSX Architecture and Concepts Check Point VSX Administration Guide NGX R67 | 31 High Availability VSX provides for hi gh system availabilit y by ensuring transparent f ailover for VSX gateways and/or for individual Virtual S ystems. If the active VSX g ateway mem ber fails, all sessions continue t o run, securel y and without interrupt ion, on a st[...]

Check Point VSX Administration Guide NGX R67 | 32 Chapter 3 Configuring VSX In This Chapter Overview 32 W orking with VSX Gateways 32 W orking with Virtual Systems 42 W orking with Virtual Switches 51 W orking with Virtual Routers 53 W orking with Interface Definitions 60 W orking with Authentication 63 Client/Session Auth entication 66 W orking wi[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 33 To use the VSX Gateway wizard : 1. Open SmartDas hboard. If you are using Multi -Domain Securit y Management, o pen SmartDashboard fr om the Dom ain Management Server of the VSX gate way. 2. In the Network Objects tab in the Objects Tree , rig ht-click Check Point and select New Chec[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 34  Shared Interface : Virtual systems share one external interface, but m aintain separate intern al interfaces.  Separate Interfac es : Virtual s ystems use their own separat e internal and extern al interfaces. This template creates a De dicated Managem ent Interface (DMI) b y [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 35 Defining Phy si cal Interfaces In the VSX Gatew ay Interfaces window, define ph ysical interfaces as VLAN tr unk s. The table shows the interfaces currentl y defined on the gate way machine. To define an interf ace as a VLAN trunk , select VL AN Trunk . Virtual Net w ork Dev ice Conf[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 36 Important - T his setting cannot be ch anged after you complete the VSX Gate way Wizard. If you define a non -DMI gatewa y, you cannot change it to a DMI gatewa y later. 4. Define the IP add ress and Net M ask for a Virtual Rout er. These options are not available for a V irtual Swit[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 37 Completing the VSX Wiza rd Click Next to conti nue and then click Finish to com plete the VSX Gate way wizard. This m ay take several minutes to com plete. A message sho ws successful or unsucces sf ul completion of the process. If the process ends unsuc cessfully, click View Report [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 38  Color - Color of the object icon as it ap pears in the Obj ect Tree.  Secure Internal Com munication - Check and re- establish SIC trust.  Check Point Products - Select C heck Point products f or this gatewa y. Secure Interna l Communicat ion (SIC) Test and reset SIC trust [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 39 VSX Gate way - Creation Temp lates The Creation T emplates page displays the creation te mplate used to create the virtual systems for this Security Gatewa y. You can change from the current creation tem plate to the Cust om Configuration template and change the shared ph y sical int[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 40 VSX Gate way - Topology The T opology page contains definitions for interfaces and routes b etween interf aces and virtual devices. Interfaces The Interfaces s ection defines interfaces and links to devices. You ca n add new interf aces as well as delete and modif y existing interfac[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 41 Note - If you wish to enab le anti-s poofing protection when there are no routes pointing to interna l networks, disable th e Cal culating topology option and modif y the appropriate interfac e definitions to enable anti - spoofing. VSX Gate way - NAT This page contains v arious NAT [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 42 VSX Gateway R ecovery In the event of a catastro phic VSX gatewa y failure, you can use the vsx_util co mmand to restore the VSX gateway conf iguration as we ll as its virtual de vice configuration. 1. Reinstall the gate way and configure IP, net m ask and default gate way. 2. Verify[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 43 2. In the Network Objects tab, located in the Objects T ree , right-click Check Point and se lect New Check Point > VPN -1 Power VSX > Virtual System . T he VSX Gateway Wizard opens, displa ying the General Properties page. Defining Gene ral Propert ies The General Propertie s [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 44 Shared Interface or Separate Interfaces The Virtual System Netw ork Configuration page f or the Shared Interf ace and Separate Interfaces templates appears as shown. To configure the ex ternal and in ternal interfac es: 1. Select the desired int erfaces fr om the appropriate list. 2.[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 45 To configure the ex ternal and internal interfaces: 1. Select the desired int erfaces for the interna l and exter nal network s from the appropriate list. If the selected Interf ace is a VLAN interface, e nter the same VLAN ta g in both the external an d internal VLAN Tag f ields. Th[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 46 To configure the ex ternal and internal interfaces: 1. In the interface table, define interfac es. You can add ne w interfaces as well as delete and m odify existing interfaces. To add an interf ace, click Add . The Interface Prop erties windo w opens. Select an interf ace from the l[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 47 Completing the D efinition Click Next and th en Finish to create the Virtual System . Please note that this m ay take s everal minutes to complete. A m essage appears indicating suc cessful or uns ucc essful com pletion of the process. If the process ends unsuc cessfully, click View [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 48 Virtual Sy stem - Topology The T opology page contains definitions for Virtual S ystem interfaces, routes and W arp li nks. Based on these interface settings, VSX autom atically creates routes to Virtu al Devices and the VSX ga teway. Note - If you modif y the topology for a specif i[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 49  VPN Domain : The VPN Dom ain defines the set of hosts locate d behind a given Vir tual System that communicate via a VPN tunnel with peer Virtual S ystems. These options ar e only available if you selected VPN in t he Check Point Produ cts section on the General P roperties page.[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 50 Virtual Sy stem - Remote A ccess The Rem ote Access page contains prop erties that govern estab lishing VPN connections w ith Remote Access clients. This window is onl y available if the Check Point VPN product is enabled on t he Genera l Properties page. Please refer to the online h[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 51 Virtual Sy stem - Advanced These pages contain a variety of conf iguration options for SNMP, connection persist ence and perm issions to install policies. For furthe r information regard ing these options, please ref er to the online h elp and the R 75 IPS Administration Gui de ( htt[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 52 Defining the General P roperties The General Propertie s page conta ins properties that ident ify the Virtual Switch and the VSX gatewa y or cluster to which it connects . This window cont ains the following propert ies:  Name : Unique nam e containing onl y alphanumeric cha racte[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 53 Virtual S witch - General P roperties The General Propertie s page al lows you to add com ments and change the ico n color as displa yed in SmartDashboard. Virtual S witch - Topology The T opology page defines Virtual Switch interf aces. You c an only m odify the single defined inter[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 54 You can define Virtual Routers f or both external and int ernal communications. A Virtual Router that c onnects to external network s, including a DMZ an d the Internet, are r eferred to as an exter nal Virtual Router. A Virtual Router that con nects to internal, pr otected network s[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 55 Creating a New Vir tual Router You use the Virtual Router Wizard to create a new V irtual Router. You can m odify the initial def inition and configure advanced opt ions after com pleting the wizard. T he definition procedure consists of two steps, each represented b y a wizard windo[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 56 To add an interf ace, click Add . The Interface Prop erties windo w opens. Select an interf ace from the list and define the IP address , net mask and other properties. Ref er to Modif yi ng an Interf ace Definition or the online help for de tails regarding the various properties and[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 57 Virtual Rou ter - Topology The Virtual Router Netw ork Configuration page defi nes the network topology for the Virtual Router. F or an external interf ace, you define one or m ore shared external interf aces and a default gate way. The topolog y definition consists of the followin g[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 58 Deleting a Virtual Rou ter You cannot delete a V irtual Router if it is s till connected to a Virtual System. Remove all Virtua l Router connections before de leting. To delete a Virtual Rout er , right-click the appropri ate Virtual Router object on the Object T ree and select Delet[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 59 2. Click A dd to define a new rule or Edit t o modif y an existing rule. T he Add/Edit Route Rule window appears. Define the following prop erties as required:  Source IP Address and N et Mask  Destination IP Address a nd Net Mask (opt ional)  Next Hop Gateway : Select a Vir[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 60 Working w ith Interfac e Definiti ons All VSX gatewa ys and Virtual Routers and Virt ual Switches contain at l east one interf ace definition. T y pically, you define the interfaces during the proc ess of configuring the top ology for a given objec t. Warp interfaces, however, are cr[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 61 Configuring Connection s Leading t o Virtual R outers The General tab for i nterface connections leading to Virtual Routers c ontains connection pro perties specific to Virtual Routers.  Leads to : Select a Virtual Router from the list.  Numbered Interfac e : Select this to ass[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 62  External : The interf ace leads to external net works or to the Internet.  Internal : The interfac e leads to internal net works and/or a DMZ and includes t he following properties:  Not Defined : IP routing is not def ined for this device.  Network : Routing is def ined[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 63 6. Close the window and save the definition. 7. Add a rule to the Ru le Base that allows traff ic for the specified m ulticast groups and instal l the policy. Modifying an Interface De finition This sections presents procedures for m odifying existing interface def initi ons and rela[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 64 SecurID SecurID requires users to possess a tok en authenticator and to suppl y a password. T oken auth enticat ors generate one-tim e passwords that are s ynchronized to an RSA ACE/server. Har dware tok ens are key -ring or credit card-size d devices, while soft ware tokens reside o[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 65  Private : Servers are accessible fr om Virtual Systems In both instances, the SecurID ACE/Server se nds a shared ke y (called a "node secret") to its peer ACE/Clients. T his key is unique per IP address , and is s ent once for each IP addr ess. Note - Users c annot auth[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 66 CLIENT_IP=<Virtual System cluster IP> 3. Perform cpstop/cpstar t .  Perform the following procedure o n all cluster m embers: 4. Open the /etc/services f ile for editing. 5. Add the following lin es: securid 5500/udp securidprop 5510/tcp The Effect of Up grading on Au thenti[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 67 2. Open $FWDIR/conf/c pauthd.conf , on the VSX Gate way machine using a t ext editor. 3. Add or modif y the following attributes accord ing to the table: Attribute Default Value Explanation clauth_port 259 The TCP port on which c lient authentication o ver TELNET is done. 0 = Client [...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 68 Co nfiguring A uthentication fo r Specific V irtual Sy ste ms To configure c lient/ses sion authent ication for the VSX Gate way: 1. Backup $FW DIR/CTX/CTX#/conf/cpauthd.c onf , where CTX# ref ers to the specific Virtual S y stem directory. 2. Delete the original $FW DIR/CTX/CT X#/co[...]

Configuring VSX Check Point VSX Administration Guide NGX R67 | 69 Configuring NAT You configure NAT using the N A T page in the Virtual System window. H ide or Static NAT addresses configured in this m anner are automaticall y forwarded to the Virtua l Router to whic h the Virtual System is connected. Alternat ively, you can manuall y add NAT route[...]

Check Point VSX Administration Guide NGX R67 | 70 Chapter 4 Using VSX with Multi-Doma in Security Manage ment You can manage a V SX deployment using Mu lti-Dom ain Securit y Management. T his chapter assum es that you are fam iliar with the Multi-Dom ain Security Manag ement product. Onl y procedures specific to V SX deployments are discus sed. See[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 71 Description 1 SmartDom ain Manager 2 Multi-Domain Serv er 3 SmartDashboard 4 Domain Managem ent Server 5 Main Domain Man agement Ser ver 6 VSX Gatewa y 7 VSX Virtual S y stem in Domain Managem ent Servers The Multi -Domain Server is a central managem e[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 72 Multi-Domain Log Server licenses are a vailable in packs of 10, 25, 50, 100 and 250. T his license is bound to the Multi -Domain Log Ser ver IP address.  Domain Log Server License: T his license is intended for a single Dom ain with log files hosted[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 73 Limitations of VSX/Domain Managemen t Server Bun dle Licenses  Bundle licenses onl y cover Virtual S y stem s. If you wish to mix ph ysical devices (Security Gate ways, etc.) and Virtual S ystems on one Dom ain Managem ent Server, you must also add [...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 74 For More Informatio n For more inf ormation regarding licensing, ref er to the Check Point User Cen ter ( http ://userc enter.checkpoint.com ). VSX Provisioning The procedures f or provisioning and configurin g VSX gatewa ys, clusters and virtual devic[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 75 Note - You m ust always define the firs t Multi-Dom ain Server as the primar y Multi-Dom ain Server. Each addit ional Multi-Dom ain Serverm ust be defined as a secondar y Multi-Dom ain Server. To define a Multi-Dom ain Server as a secondar y station, r[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 76  Status Checking Interval : Interval in sec onds between Multi -Dom ain Server/Dom ain Management Server status check s (Default = 300).  Secure Internal Communi cation T rust : Click Comm unication to open the 3. On the Licenses tab, ad d Multi-[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 77 Domain Prop erties Page Enter the Dom ain or business entity name, c ontact person nam e and contact person em ail in the appropriate fields on t he Dom ain Properties page: Global Policy Pag e The Global Policy p age defines how glo bal policies are a[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 78 Global Objects W hen assigning a global polic y to a Domain Managem ent Ser ver, you can choo se to assign all global objects or to assign only those objects req uired by the global po licy Rule Base. Select the appropriate option for this new Dom ain.[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 79 To assign perm issions: 1. Select an administrat or in the Not Assigned co lumn and click Add or select an a dministrator in the Assigned windo w and click Permissions . The Edit Administrator's Domain -Lev el Permissions window opens. 2. Select t[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 80  To assign an predefin ed GUI client to this Dom ain, select one or m ore GUI clients or gr oups from the Not Assigned co lumn and click Add . The GUI client m oves to the Assigned colum n.  To remove an GUI c lient, select one or m or e GUI clie[...]

Using VSX with Multi-Domain Security Management Check Point VSX Administration Guide NGX R67 | 81 Modifying Existing D omains and Servers To modif y existing Dom ains and Dom ain Managem ent Servers, double -click the objec t in the SmartDom ain Manager General - Domain Content s view. The pag es and properties are i dentical to those for creating [...]

Check Point VSX Administration Guide NGX R67 | 82 Chapter 5 Introduction to VSX Clust ers This chapter prese nts a conceptual overv iew of VSX cluster deplo yments, with em phasis on clustering features and their ap plication. This discuss ion assumes that the re ader is fam iliar with network cluster applications and enviro nments, particular ly C[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 83 Internal network s send traffic destined for the I nternet or externa l networks, to the cluster I P address. T his traffic is proces sed by the designated cluster m ember, inspected, and for warded to its external des tinatio n. Each member interf ace has a unique, ph y[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 84 VSX Cluster Arc hitecture VSX IP address allocat ion is similar to ph y sical net works. Both real and virtual IP addresses are r equired for network connectiv ity (internal and externa l), management, and st ate synchronizati on. VSX simplifies the IP ad dress m anageme[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 85 VSX High Availability This section desc ribes VSX high availabilit y features. In a VSX environm ent, you can work with one of two high availabilit y scenarios: VSX Gatewa y High Availability: Each cluster m ember functions as a VSX gatewa y and is synchronized with the [...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 86 Note - The f ollowing virtual devices are not supported wh en the Per Virtual System state is enabled:  Virtual Routers  Virtual Switches with out physical or VLAN i nterfaces Virtual System Load Sharing (VSLS) VSX clusters can ef ficiently balance your network tra[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 87 VSLS allows the adm inistrator to either m anually plac e specific Virtual S ystems on specific c luster mem bers, or allow the system to determ ine the dispersal configurati on automatically. Ref er to (" Configuring Virtual System Load Sharing " on p age 113 [...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 88 Virtual Sy stem States VSLS adds a back up state to the existing acti ve and standby sta tes. T he backup state contains th e latest configuration settings f or each Virtual System , but does not receive state table synchroni zation. The relationship between V irtual Sys[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 89 Systems, which are f ully synchronized with the ir active pe ers, change imm ediately to the act ive state and preserve active connect ions. At the sam e time, the backup Virtual S ystems switch to standb y, and synchronize full y with the newly active Virtua l Systems. [...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 90 Failure Recover y W hen the failed cluster mem ber or Virtual System com es back online, the s ystem returns to its original load sharing configuration. Bridge Mode By implem enting native layer-2 brid ging instead of IP r outing, you can add Virtua l System s without ad[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 91 Deploy ment Scenarios This section presents illustrative Active/Standb y Bridge m ode deploy ments , which cannot funct ion using a standard STP Bridg e mode configuration. VLAN Shared In terface Dep loyment In this deployment, each individual m ember connects to pair of[...]

Introduction to VSX Clusters Check Point VSX Administration Guide NGX R67 | 92 VSX, using the Active /Standby Bridge m ode, is incorporated int o the distribution l ayer, enforcing the secur ity policy. This is illustrated in the following figure: Figure 5- 27 Active/Standby bridge mode - core network The routers direct ex ternal, "dirty"[...]

Check Point VSX Administration Guide NGX R67 | 93 Chapter 6 Managing VSX Cluste rs Th is chapter presents the procedures f or configuring VSX in various cluster deplo y me nt scenarios. In addition to the bas ic scenarios, conceptua l material and illustrati ve examples are presented for several advanced features, including the Bridge m ode and dyn[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 94 Defining Cluste r General Properties The Cluster General Properties pa ge contains basic identificat ion properties for VSX gatewa ys. This window contains t he following properties:  VSX Cluster Name : Unique, alphanum eric for the cluster. T he name cannot cont ain spaces [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 95 You alwa y s have the opt ion of overriding the def ault creation tem plate when creating or m odifying a Virtual System The available creation templates are as f ollows:  Shared Interface : All virtual system s share a single external interf ace, but m aintain separate inte[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 96 To add a ne w member: 1. In the VSX Cluster Mem bers window, click A dd . T he Member Properties window opens. 2. Enter the a unique m ember nam e and its IP addres s in the appropriate f ields. 3. Enter and confirm the activation ke y to initialize SIC tr ust between the m emb[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 97 Configuring Cluster Members If you selected the cus tom configuration option, th e V SX Cluster M embers window appears. I n this window, you define th e synchron ization IP address for each member. . To configure the c luster members : 1. Select the synchroniza tion interface [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 98  TCP : https (secure ht tp) traffic Configuring the Clu ster Security Policy 1. Allow : Enable a rul e to allow traff ic for those services for which you wish to allow t raffic. Clear a rule to block traffic. By default, all services are bl ocked. For exam ple, you may wish [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 99 General Prop erties Use the General Prop erties pa ge to view general pro perties and to activate Che ck Point products f or use with this cluster and its members . You can modif y the following properties:  Comment : Free t ext comment that appears in the Object List and el[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 100 Cluster Members The Cluster M embers page enables you to view and/or m odify several properti es for individual clust er mem bers, including IP addresses for m embers and the internal com munication network . You can also view where cluster and m ember objects in the object da[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 101 Where Used Click Where used t o display inform ation relating to the selecte d member in the obj ects database. The following data appe ars in the window:  Name : C luster nam e.  Table : Nam e of the table in the database under which the se lected object is listed.  [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 102 Creation Temp lates The Creation T emplates page displays the creation te mplate used to create Virtu al Systems. You can change from the curr ent creation template to th e Cust om Configuration template and c hange the shared physical interfac e if the Shared Interfac e templ[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 103 Topology The T opology page contains interf ace and routing definitions. Interfaces The Interfaces s ection defines interfac es and links to devices. You can add new i nterfaces as well as del ete and modif y existing interfaces. To add an interface : 1. Click A dd . 2. In In [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 104 2. In the Route Configuratio n windo w, modify the IP ad dress, net mask and next hop param eters as necessary. 3. Enable or clear the Propagate route to adj acent Virtual Dev ices o ption as neces sary. Click Help for deta ils regarding the various prop erties and options. Ca[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 105 In the Set VPN Dom ain window, select a VPN domain from the list or click New to define a ne w domain. Click OK in both windo ws to continue. NAT The Advanced page allows you to configure NAT f or Virtual Systems c onnected to a Virtual Route r. To enable and con figur e NAT :[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 106 Please refer to the online help and the R75 VPN Adm inistration Guide ( http://su pportconten t.chec kpoint.com /docum entation_do wnload?ID= 11675 ) for further detai ls regarding VPN concepts and co nfiguration. Remote A ccess The Rem ote Access page contains prop erties tha[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 107 Changin g the Internal C ommunicat ion Net work IP You can change the in ternal comm unication network IP address b y using the vsx_uti l change_private_net (" change_mgmt_private_ net " on page 198 ) comm and. Working w ith Cluster Members This section presents proc[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 108 8. Reboot the ne w member. If the cluster is running in the VSLS m ode, run vsx_ut il vsls to red istribute Virtual S y stem s to the n ewly added mem ber. Deleting a Member Important - Ver ify that no other adm inistrators are connected to the managem ent server before procee[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 109 section of the R75 SecurePlatform A dministration Guide ( http://su pportconten t.chec kpoint.com /docum entation_do wnload?ID= 11666 ). Upgrading a Member to the C urrent Vers ion Important - Ver ify that no other adm inistrators are connected to the managem ent server before[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 110 Notes to the Upg rade Process  You only need to run t he vsx_uti l upgrade c ommand once for each V SX cluster. You must, however, run the vsx_ util reco nfigure com mand for each cluster m ember. For exam ple, for a deployment with two clusters , each cluster ha ving three[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 111 2. Re -initialize the m embers using the cpstop and cpstart commands. Converting the C luster To conv ert the cluster to HA : 1. Execute the vsx_util convert_cluster c ommand . 2. Enter the Secur ity Managem ent Server or Multi-D omain Securit y Management Dom ain Management S[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 112 vsx_util convert_cluster ************************************************* Note: the operation you are about to perform changes the information in the management database. Back up the database before continuing. ************************************************* Enter Security [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 113 Configuring Ne w Cluster Members To configure membe rs for VSX ga te way high av ailability: 1. During the initial conf iguration phase ( configsys ), enter ' y ' in response to the " Would you like to install a Check Point clustering product? " question to[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 114 Enabling the Per Virtual System State Mode The Per Virtual System State m ode enable active V irtual System s to be placed on diff erent cluster mem bers, and for Virtual System -specific failover. This s etting is mandator y for VSLS. On each cluster mem ber, do the following[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 115 6. Export VSLS conf igurations to comm a separated value (CSV) text f iles 7. Exporting and Im port VSLS configurations f rom/to comm a separated value (CSV) text f iles To work with the vsx_util v sls command : 1. Run vsx_util vsls f rom the Expert m ode on the m anagem ent s[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 116  Automaticall y assign weights onl y to Virtual S ystems. This m ethod prompts you for a weight for each Virtual System and then autom atically updates the settings.  Manuall y assign both priorities and weights to individual Virtual S ystems. To Automatica lly assig n w[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 117 Virtual Sy stem Priority Virtual System priority refers to a preference regarding which m em ber hosts a Virtual System's active, standby, and back up states. T his preference is express ed as an integer value, as shown in the following table. Priority Definition 0 Highes[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 118 VSLS Configu ration File The VSLS configurat ion file is a com ma separated va lue (CSV) text file that cont ains configuration settings for all Virtual S y stem s controlled by a managem ent server. All lines preced ed by the # s y mbol are comments and are not imported into [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 119 command enables the action and the next oc currence disables it. T hese options his a llow you to efficientl y debug very long conf iguration files by displa ying or logging onl y suspicious sections of the data. Command Action !comments Sequentially displa ys comm ent lines ([...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 120 Enabling STP Bridge Mode when Creating Member W hen creating a new VSX gateway for use as a cluster mem ber, configure the following cluster opt ions during the initial config uration process ( sysconfig or cp config ): 1. Enter ' y ' in response to the " Would [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 121 Configuring a Cluster f or PVST+ Load Shar ing To configure a VSX c luster for PVST+ load s haring, perform the procedures described in the ST P Bridge Mode section (" ST P Bridge Mode " on pag e 119 ). Active/Standby Br idge Mode This section presents the procedures[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 122 Configuring V irtual Systems for Active/S tandby Bridge Mode To configure a Virtual System to use the Bridge m ode, you m ust define it as a Virtual S y stem in the Bridge mode when initiall y creating it. You cannot reconf igure an existing, non - Bridge m ode Virtual System [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 123 Source Cluster MAC A ddresses Cluster mem bers use CCP to comm unicate with each other. I n order to distinguis h CCP packets f rom ordinary network traffic, CCP pack ets are given a unique source MAC address.  Th e first four bytes of the source MAC addres s are all zero: [...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 124 To enable m onitoring of all VLANs, enab le the fw ha_m onitor_all_vlans propert y in $FWDIR/boot/modules/fwkern.conf . Note - Monitoring all VLANS is enable d automaticall y when the Per VLAN state option is enabled. Enabling Dynamic R outing Protocols ClusterXL supports D yn[...]

Managing VSX Clusters Check Point VSX Administration Guide NGX R67 | 125 --------- Launch the Dynamic Routing Module vsx1:0]# router ER0 999 Unable to connect to host 'localhost'! ER0 999 Dynamic Routing is not supported on VSX gateway/cluster Use 'vrf - connect' to enter specific Virtual System (disconnected)>vrf - connect 1[...]

Check Point VSX Administration Guide NGX R67 | 126 Chapter 7 Working with URL Filte ring In This Chapter Introduction 126 Configuring URL F iltering 127 Introduction Access to the Internet ca n expose your organizat ion to a variety of sec urity threats and neg atively affect employee producti vity as a result of non -work -related surfing and d ow[...]

Working with URL Filtering Check Point VSX Administration Guide NGX R67 | 127 Following categor y assignm ent, the W eb Filterin g engine then block s or allows the traff ic according to one or more of the following rule types:  Network Exception s : Override W eb Filtering rules based on pre defined com binations of source and destination locat[...]

Working with URL Filtering Check Point VSX Administration Guide NGX R67 | 128 Note - T he URL database also includes I P addresses. B y Default, all IP addresses are al lowed, even if include d in the Allow or Block lists. To enable the Allo w and Block lists to work with IP addresses, use the GuiDBedit utility and change the catego rize_http_reque[...]

Working with URL Filtering Check Point VSX Administration Guide NGX R67 | 129 Performing Manu al Updates To perform a manual database update: 1. On the Database Updat es page in the SmartDashboar d Content Inspection tab, click Update databases now . The Update Databa ses wizard ope ns. 2. In the first windo w, enter your Check Point User Center em[...]

Check Point VSX Administration Guide NGX R67 | 130 Chapter 8 Working with Link Aggre gation In This Chapter Link Aggregation Over view 130 Configuring Link Aggregation for High Availab ility 134 Link Aggregation - Load Sharing Mo de 137 Changing the Bond Int erface Mode 145 Enslaving Interf aces to a Bond 145 Detaching Interfaces from a Bond 146 De[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 131 How Link Aggre gation Wor ks A bond contains a m inimum of one and may contain up to eight s lave interfaces. All slave interfaces contained in a bond s hare a comm on IP and MAC address. W e recommend that each cluster m ember contain the sam e quantity of identical s[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 132 In this scenario:  Member-1 and Member-2 are cluster m embers in the High A vailability mode  S-1 and S-2 are s witches  C- 1, C - 2, C -3 and C-4 are network connections Load Sharing O verview Load sharing provides t he ability to s pread traffic over multipl[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 133 2. The bond initiates f ailover to a standb y interface. Since this is a fai lover within the bond, th e status of the other cluster m ember is un affected. 3. If the standby interf ace continues to detect a link failure, and th e initial interface is s till down, fail[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 134  Up to eight interf aces can be defined in a Link Aggregation deployment. Configuring Link A ggregation fo r High Av ailability This section exp lains how to create a ne w High Availabilit y Link Aggregation deplo y ment. A new deployment contains no VSX gat eways, [...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 135 pimreg eth5 eth6 3. Repeat this process f or each mem ber. Verify ing that the Bon d is Functionin g Properly After installation or fai lover, it is recomm ended to verify that the bon d is up, by displa ying bond information. 1. Run: cphaprob - a if Make sure that the[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 136 Defining the Interface Bo nd W hen the sl ave interf aces are without IP addres ses, define the bond: 1. Start the SecurePlatf orm configurat ion utility: sysconfig 2. Select Network Connections . 3. Select Add new connection . 4. Select Bond . 5. For each interface to[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 137 Reconfiguring the Bond using SmartDas hboard To configure the ne w ly created bond: 1. In the SmartDashbo ard navigation tree, do uble-click the VSX gatewa y or cluster object. 2. In the Properties window, select the Ph ysical Interfa ces branch. 3. Click A dd to add t[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 138  802.3ad - includes LACP and is the recomm ended mode, but som e switches m ay not support this mode.  XOR. In Load Sharing m ode, all the interfaces of a bond must be con nected to the sam e switch. The switch itself must support and be conf igured for Link Aggr[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 139 b) Enter 2 and configure t he following set tings as required:  MII Monitoring Interval : Specif ies the MII link m onitoring frequency in m illiseconds. This determines how of ten the link s tate of each slave is inspected for l ink failures. A value of zero disabl[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 140 bond1 3 In this case bond0 would be considered do wn when three of its i nterfaces have failed. bo nd1 would be considered down when four of its interfac es have failed. Setting A ffinities If you are running Perf ormance Pack in a multi-core s ystem , after you define[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 141 Creating the C luster. Define the cluster object (" Creating a New Cluster " on page 93 ) using SmartDas hboard. During the cl uster definition process, Sm artDashboard autom atically fetches the top ology from the cluster m embers, including the newly define[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 142 2) [x]eth1 4) [_]eth3 6) [_]eth5 ----------------------------- ---- --------------------------------- (Note: configuration ch anges are autom atically saved) Your choice: 6. T y pe n to continue. 7. Select Load Sharing . 8. Choose the Load Sharing mode: 802.3ad or XOR.[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 143 If a smaller num ber of interfaces will be able to handle the expected traffic, y ou can increase redu ndancy by explicitly defining the number of cr itical interfaces. Divide your ma xim al expected traffic speed by the speed of your interfaces and r ound up to a whol[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 144 Verify ing that the Bon d is Functionin g Properly After installation or fai lover, it is recomm ended to verify that the bon d is up, by displa ying bond information. 1. Run: cphaprob - a if Make sure that the bond status is reported as UP . 2. Run: cphaconf show_bond[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 145 5. Install the polic y. Configuring Cisco Swi tches for Loa d Sharing These are sam ple configuration comm ands for Cisc o switches. For 802.3ad: Switch#conf t Switch(config)#port - channel load - balance src - dst - ip Switch(config)#interface FastEthernet <all the[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 146 To enslave ne w interfaces to an existing bond : 1. At the VSX Gatewa y or cluster m ember, run sysconfig . 2. Select Network Connections . 3. Select Configure Connection . 4. Select the bond interf ace. 5. Select Enslave interface to bond . 6. Select the interface to [...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 147 Removing a Bo nd Interface fro m Virtual devices You must rem ove the bond fr om all virtual devices that connect t o it (Virtual S ystems, Virtual Routers, Virt ual Switches). You can use vsx_util sho w_interfaces (" show_interfaces " on pag e 202 ) to d isp[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 148 Changing an Existing Interface to a Bond The following sam ple scenario dem onstrates the procedure for c onfiguring an exis ting VSX cluster to a use a Link Aggregation bond. The VSX cluster m em bers currently uses interfac e eth1 to connect t o s everal Virtual Mach[...]

Working with Link Aggregation Check Point VSX Administration Guide NGX R67 | 149 connections m ay cause physical loops where packets are continuousl y forwarded (or ev en multipl y ) in such a way that network will ultim ately crash. Sample Con figuration o f PortFast on a Cisco S w itch The following are th e commands neces sary to enable PortFast[...]

Check Point VSX Administration Guide NGX R67 | 150 Chapter 9 Optimizing VSX In This Chapter VSX Resource Co ntrol 150 QoS Enforcem ent 153 VSX Resource Control Overview VSX Resource Co ntrol allows adm inistrators to ensure that critical traf fic receives a greater s hare of the available VSX gate way or cluster m ember processing po wer by assigni[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 151 Virtual System Priorities VSX Resource Co ntrol uses a w eight f actor to assign priorities to Virtual Systems. T he weight factor is expressed as an integ er between one and 1 00, that indicates a part icular Virtual System 's priority in relati on to other Virtual S ystems. Vi[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 152 A ssigning Priorities to V irtual Sy ste ms Assigning Virtual S ystem priorities requires editing the Re source Co ntrol configuration file $FWDIR/conf/resctrl on the VSX gat eway or on each cluster m ember. T he foll owing inf ormation appears in the conf iguration file:  Resourc[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 153 [Expert@rescon:0]# fw vsx resctrl stat Virtual Systems CPU Usage Statistics ==================================== Number of CPUs/Hyper - threading: 4 Monitoring active time: 14s ID Name |Weight| 1sec 10sec 1min 1hr 24hr* ========================+======+================================[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 154 W ithout QoS Enforc ement, all these different traf fic types are given equ al pri ority on the VSX gate way and are handled in a sim ple FIFO (f irst in-first out) m anner. W hen the VSX gateway is congested, a ll traffic t ype s suffer the sam e degree of latenc y and drops. Also, [...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 155 QoS Features Two main features of QoS are:  Resource allocation  Latency control Resource A l location System resources are a llocated by assigning d ifferent weights to dif ferent classes of service. A weight is the relative portion of the available resources al located to a c[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 156  One or more DSC P values. T he Differentiated Service s code po int Priority and LLQs If there are m ultiple LLQ classes, pack ets are handled in a strict pri ority -based manner. Pack ets from a class with a higher pri ority are handled bef ore pack ets with a lower priority cla[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 157 Argument Value weight This value is used onl y for classes of type "reg". It determ ines the relative portion of the r esources that the class wil l receive in relation to other weighted classes . Valid values ar e between 0 and 10 00. dscp The Diff Serv code-points ass ign[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 158  Statistics values are rese t after each quer y.  Statistics should be pres ented periodicall y with intervals less than 1 m inute.  It is recomm ended to use the watch com mand to periodicall y present the statistic s. QoS Policy File The QoS polic y file is qos_policy .C ,[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 159 cpqos class add Platinum type llq prio 2 dscp 32 cpqos class add Gold type reg prio 3 weight 100 dscp 26 cpqos class add Silver type reg prio 4 weight 100 dscp 28 cpqos class add Bronze type reg prio 5 weight 200 dscp defaul t cpqos class add Copper type reg prio 15 weight 50 dscp 10[...]

Optimizing VSX Check Point VSX Administration Guide NGX R67 | 160 3. Statistics exam ple. The follo wing command lists statistics f or the previousl y de fined c lasses: class priority type weight rx tx drops Diamond 1 llq 0 2775 2650 0 Platinum 2 llq 0 1024 1020 105 Gold 3 reg 100 1775015 17738 05 205 Silver 4 reg 100 1862437 18623 36 550 Bronze 5[...]

Check Point VSX Administration Guide NGX R67 | 161 Chapter 10 Hardware He alth Monitoring SecurePlatform enables a number of hardware health m onitoring capabilities for Check Point appliances and for open ser vers. In This Chapter Introduction to Hard ware Health Monitori ng 161 RAID Monitoring with SNMP 162 Sensors Monitoring with SNMP on VSX -1 [...]

Hardware Health Monitoring Check Point VSX Administration Guide NGX R67 | 162 RAID Monitoring with SNMP The health of disk s’ RAID arra y can be monitored using the SecurePlatform SNMP monitoring daem on. SNMP traps can b e set to fire once an OID value is in breach of a co nfigurable thr eshold. The raidInfo MIB branc h is 1.3.6.1.4.1.2 620.1.6.[...]

Hardware Health Monitoring Check Point VSX Administration Guide NGX R67 | 163 Physical Disks inform ation OID Comment Revision .7 Size .8 Maximum s upported LBA (Logical Block Addressi ng) State .9 One of the follo wing:  ONLINE  MISSING  NOT_COMPAT IBLE  FAILED  INITIALIZING  OFFLINE_REQUEST ED  FAILED_REQUEST ED  OTHER_OFF[...]

Hardware Health Monitoring Check Point VSX Administration Guide NGX R67 | 164 VSX -1 3070 cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.1.0 > 80 20 "M/B Temp is too high" cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.2.0 > 100 20 "CPU Temp is too high" cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.2.1.3.1.0 < 4220 20 "Case Fan speed[...]

Hardware Health Monitoring Check Point VSX Administration Guide NGX R67 | 165 UTM-1 130 cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.1.0 > 80 20 "M/B Temp is too high" cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.2.0 > 90 20 "CPU Temp is too high" UTM-1 270 cp_monitor 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.1.0 > 80 20 "M/B Temp [...]

Check Point VSX Administration Guide NGX R67 | 166 Chapter 11 Deploying VSX In This Chapter Introduction 166 Internal Network Deployment Strategies 166 Organizational Deplo yment Strategies 172 Migrating from an Open Server to a VSX -1 App liance 177 Introduction This chapter prese nts deployment concepts and strate gies for exploiting VSX virtuali[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 167 VSX Virtual System D eployment Strate gies In a VSX environm ent, Virtual System s protect internal net works, m uch in the sam e manner as Security Gateways and other C heck Point products in a physical network . This section pres ents several sam ple VSX deployments using Virtual Sy[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 168 This deployment optio n is appropriate for e nvironments where m any Virtual S ystems protect m any internal networks with a sing le VSX gatewa y or cluster. The use of VLANs provides scala bility as well as granu larity, allowing adm inistrators to provision addition al Virtual Syste[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 169 No te to this scenario:  Each Virtual S y stem uses a public IP address to co nnect to the Virtual S witch  Each local net work connected to a Virtu al Router uses private I P addresses  This deployment do es not support overlapp ing IP addresses  Anti-spoofing protec tion[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 170 VLAN Shared In terface Dep loyment - Active S tandby Bridge Mode In this scenario, each i ndividual m ember connects to pair of r edu ndant switches via a VLAN trunk. All Virtual Systems in a given m ember share the sam e VLAN trunk . The following figure illustrates an example of suc[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 171 VSX, using the Active /Standby Bri dge mode, can be in corporated into the d istribution layer, enforc ing the security policy. T his is illustrated in the following figure: Figure 11 - 37 Active/Standby bridge mode - core network The routers direct ex ternal, "dirty" traff [...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 172 The figure below illustrat es a deployment scenari o with three cluster m embers, each containing t hree Virtual Systems. In this conf iguration, an equalize d load sharing deplo y ment m ight have one acti ve Virtual System on each cluster m ember. Figure 11 - 39 Normalized VSLS depl[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 173 Core Net work Security Many Enterprise e nvironments are based on core networks . Situated adjacent to core networ k back bone switches, VSX protec ts the internal network by providing securit y at la yer-2, la yer-3 or both. VSX communicates with the core network using the existing i[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 174 Perimeter Secu rity In the figure below, sec urity is enforced o n a per-VLAN basis. The OSPF and BGP Dynam ic routing protocols provide con nectivity to multiple sec urity zones along the p erimeter. Figure 11 - 42 Perimeter security Notes to this scena rio:  Partners access netwo[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 175 VSX and Multi-Dom ain Securit y Management provide a centralized, granu lar prov isioning s ystem for a number of Dom ains. Applications and s ervices are sep arated by discrete Virtua l Systems . Access to these services and applicat ions is based on need. Figure 11 - 43 Multi-Domain[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 176 Data Centers Data center providers s upply external host ing services for Dom ain servers and databases. T he service typically includes inf rastructure, connectivit y, and security for multiple Dom ains. For exam ple, you can have a scenario such as:  Multiple Dom ain networks sha[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 177 Migrating from an Open Server to a VSX-1 A pp liance Check Point VSX -1 appliances use different interface nam es than Open Server platforms (SecurePlatform , Linux). When m igrating an Open Server V SX gateway or cluster to a VSX -1 appliance, you must use the vsx_util change_interfa[...]

Deploying VSX Check Point VSX Administration Guide NGX R67 | 178 Please select one of the following interfaces to be replaced: 1) lan0 2) lan1 Enter your choice:2 Please select one of the following interfaces to replace eth1: 1) A new interface name Enter your choice:1 WARNING! Interface name must exist on VSX gateway/cluster members or the operati[...]

Check Point VSX Administration Guide NGX R67 | 179 Chapter 12 VSX Diagnostics a nd Troubleshooting In This Chapter Introduction 179 General Troubleshoot ing Steps 179 Troubleshooting Specif ic Problem s 180 Introduction This chapter prese nts basic diagnostic an d troubleshooting procedures that should be follo wed in the event you encountering a p[...]

VSX Diagnostics and Troubleshooting Check Point VSX Administration Guide NGX R67 | 180 c) Examine connectivit y status using standar d operating s y stem commands and tools such as: ping, traceroute, tcpdump, ip route, ftp , etc. Som e of these run accordin g to context (i.e. routing, source and dest ination IP addresses ). . For SecurePlatform and[...]

VSX Diagnostics and Troubleshooting Check Point VSX Administration Guide NGX R67 | 181 Possible Causes How to Resolv e Time or time zone mism atch betw een the management and the gatew ay. For proper SIC opera tion, the tim e, date and time zone m ust be synchronized between the m anagement server and gateways/ cluster m embers. Execute the /bin/da[...]

VSX Diagnostics and Troubleshooting Check Point VSX Administration Guide NGX R67 | 182 Possible Causes How to Resolv e Missing or invalid VSX gateway/cluster li censes. Run fw v sx st at on all gateways, and m ake sure that the output says Number of Vi rtual Systems allow ed by license: is great er than 0 . Obtain a VSX and insta ll a valid license[...]

Check Point VSX Administration Guide NGX R67 | 183 Chapter 13 Command Line Ref erence In This Chapter Firewall Comm ands 183 VSX Comm and 187 Link Aggregation CLI Commands 191 VSX Resource Co ntrol Comm ands 192 The vsx_util Comm and 19 5 The cphaprob Comm and 206 Fire w all Commands This section prese nts the usage of stand ard firewall (fw) comm [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 184 fw monitor Description Captures network packets at m ultiple points wit hin the VSX environment. You can o nly run one instance of this comm and at a time on VSX gatewa y. This section onl y presents the syntax rele vant for VSX gatewa ys or clusters. Syntax fw monitor [ - v [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 185 Description Displays state tables f or a specific Virtual S ystem. State tables are used to store state inf ormation that Virtua l Systems use to correc tly inspect pack ets. Parameters Parameter Description [- vs vsid | vsname] Specify a Virtual S ystem by name or by ID. If [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 186 Argument Description -c Cluster mode, get p olicy from one of the cluster memb ers, fr om the Check Point Hi gh Availabilit y (CPHA) kernel list. -i Ignore SIC inform ation (for exam ple, SIC name) in the data base and use the inform ation in conf/masters . T his option is us[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 187 VSX Command This section desc ribes the vsx comm ands. Note - fw6 vsx comm ands are not supported. Beca use all IPv6 com mands require a corresponding IPv 4 connection, fw6 vsx c ommands are not necessary. vsx fetch Description Fetches the most current configuration files fro[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 188 Description Fetches the most current configuration files from the Main Domain Management Server, and applies it to the VSX gateway. Output fw vsx fetch Fetching VSX Configuration From: 10.18.99.101 Local VSX Configuration is Up - To - Date. Cleaning un - used Virtual Systems [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 189 Description Sets current context to th e specified Virtual S ystem by name or ID. Parameters Parameter Description VSname or vsid Virtual System name or ID. If no value is entered, the context is set to the VSX gateway. Return Value 0 (zero) indicates that t he comm and execu[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 190 Description Displays VSX status inf ormation. VSX Gateway Status ================== Name: MyGateway Security Policy: MyGateway_VSX Installed at: 10Dec2007 10:31:25 SIC Status: Trust Number of Virtual Systems allowed by license:100 Virtual Systems [active/configured]: 2/2 Virt[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 191 vsx sic reset Description Resets SIC for the spec ified Virtual S ystem Syntax vsx sic reset {vsname|vsid} Parameters Parameter Description vsname|vsid Specify the Virtual S ystem nam e or ID. Output [Expert@gateway:0]# [Expert@gateway:0]# fw vsx sic reset 1 resetting SIC for[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 192 Report Results  Required slave interfaces as explained in | (" Setting Critical Re quired Interf aces " on page 139 ).  The Status colum n can contain the following val ues:  Down (Load Sharing mode only) - the ph ysical link is do wn.  Active - currentl[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 193 vsx resctrl enfo rce Description Configures the Resourc e Control Enforc er and shows its curr ent status. This comm and overrides the settings in the Reso urce Control configuration file, but does not survive reboot. Syntax vsx resctrl enforce {enable | disable | show} Param[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 194 vsx resctrl start Description Initializes Resource Co ntrol. Use th is comm and after changing the weights of the Virtua l Systems in the configurat ion file. Syntax vsx resctrl [ - v] start Parameters Parameter Description -v Verbose m ode displays the configuration of the R[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 195 Virtual Systems CPU Usage Statistics ==================================== Number of CPUs/Hyper - threading: 2 Monitoring active time: 14s ID Name | Weight | CPU | 1sec 10sec 1min 1hr 24hr ===========+========+=======+================================= 0 rescon | N/A | CPU 0 | [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 196 Description Performs various VSX maintenance t asks. You run this command from the expert mode on the m anagement server (Secur ity Management Serv er or a Main Domain Managem ent Server in a Multi -Domain Securi ty Management environment). Comments Note - You m ust close Sma[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 197 add_member_recon f Description Restores VSX conf iguration after adding a c luster mem ber Syntax vsx_util add_member_reconf Input  VSX mem ber object name: VSX cluster m ember name  Activation Ke y: SIC activation ke y assigned to the Security Management Server or main[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 198 7. W hen prompted, select the interface to be re placed. 8. W hen prompted, select the replacem ent interface. a) You can optionall y add a new interface b y selecting " Enter new int erface name ". This interface must physicall y exist on the VSX Gatew ay or cluste[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 199 Description Changes the cluster internal comm unication network IP address Comments  W e recommend that you back up the management da tabase before using this comm and.  The private network IP address m ust be unique and not used anywhere behind th e VSX gateway, cluste[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 200 Syntax vsx_util change_interfaces Comments  This comm and is interactive. Follow the instruc tions on the screen.  This comm and supports the resum e feature.  You can use this c ommand to m igrate a VSX deplo y ment (" Migrating from an Open Server to a VSX -1 [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 201 issue and then run the vsx_util reconf igure (" reconfigur e " on page 201 ) comm and to complete the process.  If you select the Apply changes to manage ment Only option, you can select another interfac e from list (if any are available) or select the option to [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 202 Description Restores a VSX config uration to a ne wly installed gateway or cluster mem ber Comments  This comm and is also useful for restorin g a gatewa y or cluster mem ber after a system failure.  Execute the comm and and follow the instructions on the scr een.  A[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 203 Description Displays selected interf ace inform ation in a VSX deployment. Pro vides information regard ing interface t ypes, connections to virtual devices , and IP addresses. T he output appears on the screen and is also sa ved to the interfacesconfig.csv file. Which interf[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 204 Interfaces configuration table: + ------------------------- + -------------- + ----------------------------- + |Interfaces |Mgmt |VSX GW | | + ---------- + -------------- + -------------- + --------- + --------- + --------- + |Name |Address |Mask | Member1 | Member2 | Member3[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 20 5 + ------------------------------------------------------- + ----- + -------- -+ |Routes |Mgmt |VSX GW(s)| + --------------- + -------------- + ------------- + ---------- + ----- + -------- -+ |Destination |Mask |Gateway |Interface | |Member3 | + --------------- + -----------[...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 206 Description Displays the Virtual S ystem Load Sharing Men u, which allows you to perform a variet y of configuration task s for Load Sharing deplo y ments. You perform configuration tasks (" Configuring Virtual Syste m Load Sharing " on page 113 ) interactivel y by [...]

Command Line Reference Check Point VSX Administration Guide NGX R67 | 207 cphaprob state cphaprob [ - a] [ - vs vsid] if The following commands are NOT applicable for 3rd party: cphaprob - d <device> - t <timeout(sec)> - s <ok|init|problem> [- p] register cphaprob - f <file> register c phaprob - d <device> [ - p] unreg[...]

[...]

Index A Active/Standb y Bridge Mode • 13, 90, 121, 169 add_mem ber • 197 add_mem ber_reconf • 198 Adding a Dom ain Managem ent Server • 80 Adding a New Interf ace • 60 Adding a New Mem ber • 107 Adding Members • 95 Adding Virtual Routers a nd Switches to a Domain Managem ent Server • 81 Adding Virtual S witches • 51 Adding Virtual[...]

Page 210 cpqos class del • 157 cpqos class show • 15 7 cpqos install • 157 cpqos stats • 157 cpqos uninstall • 157 Creating a Bond in a N ew Deployment • 138 Creating a New Clus ter • 93 Creating a New Dep loyment • 134 Creating a New Dom ain Object • 76 Creating a New Virtua l Router • 55 Creating a New Virtua l System • 42 C[...]

Page 211 H Hardware Health Mo nitoring • 13, 161 High Availabilit y • 31 High Av ailabilit y Licenses • 73 High Availabilit y Overview • 131 High Perform ance Security • 12 How Link Aggregat ion W orks • 131 How VSX W orks • 11 I Important Inform ation • 3 Importing a VSLS co nfiguration • 119 Inbound Prioriti zation • 154 Initi[...]

Page 212 R Radius • 64 RAID Monitoring with SNMP • 162 reconfigure • 202 Reconf iguring Interf ace Connections • 147 Reconfiguring the Bo nd using SmartDas hboard • 137, 144 Reconfiguring Topo logy • 136, 144 Reconfiguring Topo logy using vsx_util change_interfaces • 13 7, 144 Redistributing Active V irtual System s to One Member • [...]

Page 213 Virtual Devices • 18 Virtual IP Address es • 84 Virtual IP Integration • 124 Virtual Network Device Configuration • 35 Virtual Router - A dvanced • 57 Virtual Router - G eneral Properties • 5 6 Virtual Router - IP S • 57 Virtual Router - Lo gs and Masters • 57 Virtual Router - T opology • 57 Virtual Routers • 19 Virtual[...]