topic Re: Datacenter objects on gateway, management down in Cloud Firewall

Datacenter objects on gateway, management down

vinceneil666 — Mon, 27 Jan 2020 11:43:15 GMT

Hi,

If my management goes down - is there a chace timeout for the objects used by the gateway ? I do understand that object not will be updated.. but is there a time it will stop woring on the gateway ?

Will it just keep working with the info provided my management, until other notice given ?

Re: Datacenter objects on gateway, management down

Gil_Sudai — Mon, 27 Jan 2020 11:45:16 GMT

hello. the TTL of the data center objects on the GW is 3 days unless there is a different update on them.

Re: Datacenter objects on gateway, management down

vinceneil666 — Mon, 27 Jan 2020 11:52:38 GMT

Ah, ok thank you.

So, after three days - if management is still down - the service will stopp working ?

Re: Datacenter objects on gateway, management down

Gil_Sudai — Mon, 27 Jan 2020 13:23:37 GMT

Yes IMO unless there is a way on the GW side using IDA blade commands to extend the objects expiration ttl.

Re: Datacenter objects on gateway, management down

Gil_Sudai — Mon, 27 Jan 2020 16:30:16 GMT

You can edit this 3days TTL in vsec.conf and increase the value. Then you need to run vsec stop and vsec start.

Re: Datacenter objects on gateway, management down

Wolfgang — Mon, 27 Jan 2020 17:22:13 GMT

Gil,

to my understanding.

If we use datacenter-object ( as an example maybe from VMware vcenter ), these objects does expire after 3 days with no contact with Check Point management ( SMS ) ?

How about the rules with datacenter-objects , they are deleted, the datacenter-objects will be removed ?

How about if the SMS has a problem with vcenter connection, same TTL occurs ?

Looks like we should monitor these connections.

Wolfgang

Re: Datacenter objects on gateway, management down

Gil_Sudai — Mon, 27 Jan 2020 17:53:49 GMT

The important process is the CloudGuard Controller, not the cpm or fwm processes.
And yes, if the Controller will not push updates to the GW for 3 days the objects will expire. The rules won't be deleted but on the GW they will not enforce.
For Monitoring, there are logs in SmartConsole. And starting with R80.40 you can also get alerts from SmartEvent.

Re: Datacenter objects on gateway, management down

Wolfgang — Mon, 27 Jan 2020 18:32:08 GMT

Thanks Gil, this is good to know. I‘m not aware of these TTL.

Wolfgang