topic Re: ESXi vSec aka CouldGuard recommendations for a small site in Cloud Firewall

ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Mon, 05 Mar 2018 17:43:12 GMT

Just wondering if anyone running gateway and management in ESXi has any recommendations. We are planning to deploy sort of simple remote site with management and gateway (not in hypervisor mode, just plain gw in VM) in ESX. Same ESX will host few servers. What would be the best approach - standalone gw & Mgmt in one VM or create two separate VMs - one for GW and one for Mgmt. No need for cluster. I don't expect too much traffic new connections wise. Throughput could get high-ish but purely for file transfer. Don't need any advanced blades, just firewall as IP filter. Any suggestions for number of cores / RAM? Either in one or split VM case. Never really run vSec gateway in production especially standalone solution so need someone with practical experience. Deploying as R80.10.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Vladimir — Mon, 05 Mar 2018 20:08:31 GMT

Kaspars,

I only run the management in VM in production, but am running both: management and a gateway in the lab environment.

Strongly suggest not to have it as all in one, if it is possible and another good idea is to configure a boot loader delay parameters to allow for invocation of repair functions.

Somewhere on CheckMates it was mentioned before, that in case of corruption of the filesystem, vSECs were not properly configured by default for user input.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Mon, 05 Mar 2018 20:43:02 GMT

Thanks Vladimir! We do the same - MDS/MLM environment is all in VM. This new project is on the smaller scale. Wondering if https://community.checkpoint.com/people/dhart87070b18-7c75-33a5-b483-3fdda90dcf92‌ has anything to say - you had a standalone setup?

Re: ESXi vSec aka CouldGuard recommendations for a small site

Vladimir — Mon, 05 Mar 2018 21:50:03 GMT

At the risk of being run out of town: if all you need is a simple IP filter, why not use PFsense?

Re: ESXi vSec aka CouldGuard recommendations for a small site

Duane_Hartman — Mon, 05 Mar 2018 23:56:38 GMT

Kaspars,

we are on our 3rd VSEC for VMWare installation. Our smallest install runs with 4 other VM’s and the largest has 9. In all cases we utilize standalone installations. I would make the following recommendations based on your environment:

1 - vCore (if 2 GHz or above - otherwise 2 vCores)

16 Gigabytes of RAM

Min. 250 GB for like Log Partition

75 GB for System Partition

100 GB for backup and update Partition

Hope this is useful.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Tue, 06 Mar 2018 05:11:19 GMT

It's a long story. Can't disclose details. Plus checkpoint has nice logs haha..

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Tue, 06 Mar 2018 05:14:32 GMT

Thanks heaps Duane! That's exactly what I need to hear! So you recon for 9 VM solution 2 cores over 2GHz should be enough? Sounds very little but I have zero experience..

Is there single Mgmt+gw vSec license too or you get them separately? Probably our SE question but you may know

Re: ESXi vSec aka CouldGuard recommendations for a small site

Duane_Hartman — Tue, 06 Mar 2018 13:33:32 GMT

You are welcome! To be clear, the 2 vCore solution is just dedicated to the VSec server when using FW, AB, AV and IPS blades. The ESXi hosts that we utilize with a VSec FW and other VM’s have a min. of 20 vCores.

Licensing can be done for a stand-alone GW/Mgmt installation, but only with purchasing one or more core licenses of VSec.

Cheers,

Duane Hartman

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Tue, 06 Mar 2018 14:00:34 GMT

Great! Thanks again - then we'll start small and grow if needed!

Re: ESXi vSec aka CouldGuard recommendations for a small site

Pablo_Barriga — Wed, 07 Mar 2018 02:38:28 GMT

Hello Duane how was the performance with a single vcpu?, I wanted to used for small implementations.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Duane_Hartman — Wed, 07 Mar 2018 03:23:21 GMT

For a small deployment just running the firewall and Mobile Access (endpoint connect only) modules, it is was not bad. However, as a qualifier, I only ran it for a week with 14 users. More curiosity than anything else.

Cheers,

Duane Hartman

Re: ESXi vSec aka CouldGuard recommendations for a small site

PhoneBoy — Wed, 07 Mar 2018 06:02:41 GMT

Worth noting that while a single core does work, I believe we only officially support 2 or more cores in a CloudGuard IaaS instance.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Wed, 07 Mar 2018 06:14:16 GMT

Dameon, do you happen to know if there are a "dimension" guidelines for standalone solution case (in ESX). Any official recommendations regarding number of cores based on connections/VMs/Throughput or something like that?

Re: ESXi vSec aka CouldGuard recommendations for a small site

PhoneBoy — Wed, 07 Mar 2018 18:05:09 GMT

Most of the sizing I've seen has been for an externally managed gateway/VM, not a standalone (gateway + management on same VM).

We do have some numbers that can be shared privately through your Check Point SE.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Pablo_Barriga — Thu, 08 Mar 2018 02:35:17 GMT

I'm looking for this table with R80.10

Re: ESXi vSec aka CouldGuard recommendations for a small site

PhoneBoy — Thu, 08 Mar 2018 03:13:34 GMT

The numbers should be similar for R80.10.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Thu, 08 Mar 2018 05:08:21 GMT

Bingo! That's what I wanted to see, thanks heaps

Re: ESXi vSec aka CouldGuard recommendations for a small site

vaibhav_Parleka — Thu, 31 May 2018 07:17:36 GMT

Would be great if the table also included the information with 8 vCPU as well. currently only provides information on 2,4 & 6 vCPU options.

Vaibhav

Re: ESXi vSec aka CouldGuard recommendations for a small site

Duane_Hartman — Fri, 08 Jun 2018 16:24:02 GMT

Kaspars,

I now have 4 standalone VSec installations running at different customers. In each case I am running Firewall + Anti-Virus + Anti-Bot + IPS. I have found the following configuration works well:

2 - vCore (avg. CPU being 2.8Ghz)

30 Gigabytes of RAM

Min. 400 GB for like Log Partition

150 GB for System Partition

150 GB for backup and update Partition

Additional Note: I use dedicated Gigabit NIC's for each FW Interface.

Re: ESXi vSec aka CouldGuard recommendations for a small site

Kaspars_Zibarts — Fri, 08 Jun 2018 18:03:59 GMT

Thanks for the update!