topic Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when in SD-WAN

Nano Agent / Nano Services in Quantum SD-WAN: the Control Plane

WiliRGasparetto — Fri, 06 Feb 2026 09:11:04 GMT

If you use Quantum SD-WAN in the Infinity Portal, the Nano Agent is the component that turns your gateway into a cloud-managed enforcement point: it receives policy, applies Nano services, and sends telemetry back to the portal. Without it, SD-WAN becomes “local config + hope.” (And that’s usually where troubleshooting starts.)

1) What is the Nano Agent?

The Nano Agent is a lightweight agent installed on the Security Gateway / Cluster Member that “hosts” and manages Nano Services. In SD-WAN, it is the mechanism for:

installing/updating SD-WAN policy on the gateway,
orchestrating the services required for SD-WAN,
sending events and metrics to the Infinity Portal.

In practice: you install it using a command/script generated in the portal, and from that point on the gateway has a control channel for SD-WAN.
The SD-WAN guide itself lists the Nano Agent as a required workflow item (“on the gateway… SD-WAN interfaces and the Nano Agent”). (sc1.checkpoint.com)

2) Fog + iNext: separating control plane vs data plane (Slide 2)

A mental model that avoids 80% of errors:

Data plane

User traffic (Internet/Overlay/Backhaul) flows over WAN links, VPN, etc.

Control plane (Nano)

The Nano Agent communicates with the cloud (Fog/iNext), downloads policy, reports state/events, and receives updates.

Your slide captures it well: Fog acts as a mediator between iNext and the agent, transporting policy and collecting gateway information.

Text diagram (flow):
Infinity Portal (SD-WAN app) → iNext/Fog (cloud control) → Nano Agent (GW) → Nano Services (SD-WAN, Logger, Metric Provider)
GW → (events/metrics/status) → Nano Agent → Fog/iNext → Infinity Portal

3) “The first command of your life”: cpnano -s

When something “disappears” in the portal or a policy does not install, the first t-shoot step is:

cpnano -s → shows detailed status of the Nano Agent and Nano Services (versions, last update, registration, etc.)

This becomes your baseline: before hunting for an “SD-WAN bug,” validate connectivity, registration, and service health.

4) Which Nano Services are involved in SD-WAN

In SD-WAN, you typically see:

Orchestration Nano Service (baseline, not SD-WAN exclusive)
SD-WAN Nano Service
SD-WAN Logger Nano Service
Cpview Metric Provider

The logic is simple: the orchestrator ensures the other services are present, updated, and running with the correct policy.

5) Orchestration Nano Service: the “systemd” of the Nano world

Think of it as the orchestrator that:

polls cloud control for updates/policy,
downloads policy and distributes it to the relevant Nano services,
reports status, versions, and health back to Fog/iNext.

In SD-WAN, when there is applicable policy for a gateway, the orchestrator triggers the flow to download/update services and their artifacts (SD-WAN/Logger/Metric Provider).

6) Orchestration t-shoot: logs and communication debugging

If the gateway does not “update” or the portal does not reflect status, focus on the control plane.

Logs

/var/log/nano_agent/cp-nano-orchestration.log
/var/log/nano_agent/cp-nano-orchestration.dbg

The main Nano Agent orchestration log is referenced in official documentation (in other Nano contexts, but the file and pattern are consistent). (sc1.checkpoint.com)

Debug/trace (for communication and HTTP)

cpnano -d --add --flags D_COMMUNICATION=Trace
cpnano -d --add --flags D_HTTP_REQUEST=Trace
rollback: cpnano -d -default

What I look for in the .dbg (time-saving order)

DNS resolution / outbound route / proxy (if any)
TLS/handshake errors, HTTP codes, timeouts
Token/registration state (agent “registered” vs “pending”/“disconnected”)
“policy fetched” vs “policy applied” (these are different states!)

7) SD-WAN Nano Service: where SD-WAN becomes “real” on the gateway

Gateway Sharing and local policy updates:

collects/updates VPN peer data and local SD-WAN configuration (next hop, ISP, etc.)
sends updates to the cloud backend (Fog) when something changes
applies local SD-WAN policy when a relevant change occurs (peers / topology / link attributes)

Practical point: when gateway sharing does not converge, you get “policy in the portal” but inconsistent state across sites.

8) Where to validate policy “for real”: sdwan_steering_policy.json

This file is one of the best local validation points:

$FWDIR/state/local/SDWAN/sdwan_steering_policy.json

The Quantum SD-WAN guide explicitly references this file for inspecting parameters such as Circuit ID and peer/link details. (sc1.checkpoint.com)

Useful sections (from your slide)

sdwan_steering_vpn_peers
sdwan_steering_vpn_local

Objective t-shoot
“What the portal thinks I am” vs “what the installed policy says I am.”
If they diverge, it’s not a “link problem”: it’s policy propagation / install / parsing.

9) SD-WAN t-shoot: logs and policy-focused debug

When the pain is “policy does not install” / “steering does not happen”:

Logs

/var/log/nano_agent/cp-nano-sdwan.log
/var/log/nano_agent/cp-nano-sdwan.dbg

SD-WAN policy trace

cpnano -d --add --flags D_SDWAN_POLICY=Trace
rollback (as in the slide): cpnano -d --add --flags D_SDWAN_POLICY=Error

Practical checklist (my sequence)

cpnano -s → is the SD-WAN service Running? Which version/policy?
Check whether sdwan_steering_policy.json changed after publish/install.
Validate whether traffic matches the correct SD-WAN rule (breakout/overlay/backhaul). There are scenarios where traffic matches breakout and disables overlay encryption (documented in troubleshooting). (sc1.checkpoint.com)
Validate health-checks/probing (latency/jitter/loss) and whether links are eligible per thresholds (SD-WAN decisions are based on this). (sc1.checkpoint.com)

10) SD-WAN Logger Nano Service: why the portal “doesn’t show events”

The SD-WAN Logger is the event pipeline:

receives events from SD-WAN steering (link swap, ISP status, etc.)
receives events from the CPSDWAN process (enablement, policy installation events, …)
sends them to Fog → iNext → and finally the Infinity Portal displays them

Classic symptom: steering works locally, but the portal looks “blind.”
Primary suspects: logger stopped, delivery backlog, or control-plane issues (orchestration/HTTP).

Troubleshooting Blueprint in 7 layers (save this)

Portal/Profile: is the gateway in the right profile? is policy published? (Infinity Portal) (sc1.checkpoint.com)
Nano health: cpnano -s (registered? last update? services running?)
Cloud connectivity: route/DNS/proxy/SSL inspection on the outbound path (top “silent” root cause)
Orchestration logs: cp-nano-orchestration.log/.dbg (HTTP/TLS/timeouts) (sc1.checkpoint.com)
SD-WAN policy install: SD-WAN logs + sdwan_steering_policy.json (sc1.checkpoint.com)
Rule/behavior match: breakout vs overlay vs backhaul (avoids wrong diagnosis) (sc1.checkpoint.com)
Telemetry/events: logger + portal (if “it works but doesn’t show,” the issue is observability/pipeline)

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Thu, 05 Feb 2026 03:12:07 GMT

Amazing...thanks for that @WiliRGasparetto

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

WiliRGasparetto — Thu, 05 Feb 2026 15:26:49 GMT

Thank you so much Andy, coming from someone I admire very much, it means a lot.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Thu, 05 Feb 2026 15:28:14 GMT

Thanks brother, truly appreciate that! I dont think anyone ever said that for me, and if they did, they must have been drunk OR high...or both 😂😂

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

PhoneBoy — Fri, 06 Feb 2026 00:14:35 GMT

Pretty comprehensive write-up.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

WiliRGasparetto — Fri, 06 Feb 2026 02:30:43 GMT

Not at all, Andy is an example for all of us.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Fri, 06 Feb 2026 02:37:16 GMT

Thanks man, really, really appreciate all your comments. I always try to do my best to help, thats all. Hey, FWIW, here is what MS copilot AI gave about this sibjects. Thoughts? : -)

*********************************

Nano Agent & Nano Services in Check Point Quantum SD‑WAN (Infinity Portal)

In Quantum SD‑WAN, the Nano Agent is essentially the cloud control-plane component that turns a Security Gateway (or cluster member) into a cloud-managed enforcement point: it receives SD‑WAN policy, runs/hosts the Nano Services that implement SD‑WAN functions, and sends telemetry/events back to the Infinity Portal. [community….kpoint.com]

1) What is the Nano Agent?

Think of the Nano Agent as a lightweight runtime on the gateway that:

Registers the gateway to the Infinity Portal using a token (so the portal can manage it). [sc1.checkpoint.com]
Downloads and applies SD‑WAN policy (steering behaviors, link mapping, etc.) pushed from the portal. [community….kpoint.com]
Hosts and supervises “Nano Services”—modular services that implement SD‑WAN and observability functions (logging, metrics, etc.). [community….kpoint.com], [sc1.checkpoint.com]
Reports health/telemetry/events (link swaps, status, policy versions) back to Infinity Portal dashboards. [community….kpoint.com]

A useful mental model is:

Data plane: actual user traffic flowing over WAN links/VPN/overlays
Control plane (Nano): Nano Agent ↔ cloud backend to fetch policy, report state, update services [community….kpoint.com]

2) What are Nano Services (in SD‑WAN context)?

Nano Services are the modular processes that run under the Nano Agent. The SD‑WAN admin documentation explicitly calls out the core set you should see in a healthy deployment (Status: Running) when you check Nano status. [sc1.checkpoint.com]

Common Nano Services you’ll encounter for Quantum SD‑WAN

From the SD‑WAN admin guide (and typical deployments), expect these services: [sc1.checkpoint.com]

Check Point Orchestration Nano Service – service lifecycle / orchestration (updates, policy distribution, health reporting). [community….kpoint.com], [sc1.checkpoint.com]
Check Point Messaging Proxy Nano Service – messaging/control communication support used by the Nano framework. [sc1.checkpoint.com]
Check Point SDWan Nano Service – the SD‑WAN “engine” that turns portal policy into local SD‑WAN behavior on the gateway. [community….kpoint.com], [sc1.checkpoint.com]
Check Point Cpview Metric Provider Nano Service – feeds metrics/telemetry used for monitoring and dashboards. [community….kpoint.com], [sc1.checkpoint.com]
Check Point SD‑WAN Logger Nano Service – collects SD‑WAN events/logs and ships them to the cloud so the portal can display them. [community….kpoint.com], [sc1.checkpoint.com]

Broader context: Check Point describes “Nano‑Agents” as a platform concept where Nano Services and attachments are the building blocks that can be used across environments. [github.com]

3) Where Nano fits in the Quantum SD‑WAN architecture

A simplified flow (conceptually consistent with Check Point’s SD‑WAN control plane explanation): [community….kpoint.com]

Infinity Portal (SD‑WAN app)
→ Cloud backend (iNext/Fog)
→ Nano Agent on Gateway
→ Nano Services (SDWan, Logger, Metrics, Orchestration, …)
→ (telemetry/events/status) back through Nano Agent to cloud/portal [community….kpoint.com]

Why this matters: If your SD‑WAN “looks configured” in the portal but doesn’t behave on the wire, the issue is often control-plane propagation (agent registration, service health, connectivity, policy install) rather than raw routing. [community….kpoint.com]

4) Installation & onboarding (what you actually do)

Install Nano Agent (token-based)

The SD‑WAN admin guide shows Nano Agent installation via nano-egg using the authentication token from your Quantum Profile in Infinity Portal. [sc1.checkpoint.com]

Example shown in the guide (Maestro/SG context):

nano-egg --install --token <Authentication Token> ... [sc1.checkpoint.com]

5) Day‑2 operations: health checks & troubleshooting

The “first command” to check: `cpnano -s`

A recurring best practice in Quantum SD‑WAN troubleshooting is to run:

cpnano -s to see Nano Agent/Nano Service status, versions, registration, and update state. [community….kpoint.com], [sc1.checkpoint.com]

The SD‑WAN admin guide explicitly says you should verify required Nano Services are Status: Running in the cpnano -s output. [sc1.checkpoint.com]

Common log locations & debug flags

Operational troubleshooting often centers on the Nano control-plane logs and (when needed) enabling targeted debug flags. Example log locations and debug approach are described in the Check Point community post: [community….kpoint.com]

Orchestration logs under /var/log/nano_agent/ (e.g., orchestration log/dbg) [community….kpoint.com]
SD‑WAN Nano service logs under /var/log/nano_agent/ (e.g., sdwan log/dbg) [community….kpoint.com]
Debug flags for communication/HTTP/policy tracing using cpnano -d ... [community….kpoint.com]

When the portal is “blind” (no events/metrics)

A classic symptom described is: steering works locally, but the Infinity Portal shows no SD‑WAN events. In that case, focus on the SD‑WAN Logger Nano Service and upstream control-plane connectivity (orchestration/HTTP). [community….kpoint.com]

6) Practical checklist (fast triage)

If SD‑WAN isn’t behaving as expected, a pragmatic sequence is:

Agent registration & service health: cpnano -s (all required services Running). [community….kpoint.com], [sc1.checkpoint.com]
Control-plane connectivity (DNS/route/proxy/TLS issues between gateway and cloud) because policy/telemetry depends on it. [community….kpoint.com]
Orchestration logs to see fetch/apply cycles and failures. [community….kpoint.com]
SD‑WAN service logs for steering/policy-related issues. [community….kpoint.com]
Portal alignment: correct profile, published policy, gateway appears under Agents. [community….kpoint.com], [sc1.checkpoint.com]

Quick “plain English” summary

Nano Agent = “the SD‑WAN cloud management/control-plane endpoint on the gateway.” [community….kpoint.com]
Nano Services = “the modular processes the agent runs (SD‑WAN engine, logging, metrics, orchestration, messaging proxy).” [sc1.checkpoint.com], [community….kpoint.com]
cpnano -s = the first place you look when things don’t install/show up. [community….kpoint.com], [sc1.checkpoint.com]

A couple of questions so I can tailor this to your environment

Are you running standalone gateways, a cluster, or Maestro with Security Group members? (Nano behavior differs a bit operationally.) [sc1.checkpoint.com]
Are you troubleshooting policy not installing, steering not occurring, or portal dashboards/events missing? [community….kpoint.com]

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

WiliRGasparetto — Sun, 08 Feb 2026 00:28:38 GMT

I found Copilot’s comments very interesting.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Sun, 08 Feb 2026 01:09:38 GMT

I feel it compiles everything it can find from smartest people out there and breaks it down in sections, so it looks presentable. O well, it is AI at the end of the day lol

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

WiliRGasparetto — Mon, 09 Feb 2026 12:42:12 GMT

Yes, I definitely need to start summarizing my materials with AI, but I don't really like putting too much information in them because I don't know how the data presented there is actually handled.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Mon, 09 Feb 2026 13:13:49 GMT

I feel it would be literally impossible these days to keep all that data fully protected...just my 2 cents.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

WiliRGasparetto — Mon, 09 Feb 2026 13:22:17 GMT

I completely agree with you; nowadays we no longer have a choice of whether or not to use our data and whether or not to be exposed to AI.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Mon, 09 Feb 2026 13:24:23 GMT

100%...thats what data brokers do.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the Control Plane

Dom_Galvao — Wed, 11 Feb 2026 07:25:38 GMT

Thank you Very mucho for the content

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Amit_Navon — Sun, 15 Feb 2026 14:08:40 GMT

@WiliRGasparetto @the_rock Guys, get ready in R82.20 we re-design SD-WAN management.

We will merge it into Smart-1, the nano agent will not be used.

BR,

Amit

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Sun, 15 Feb 2026 14:09:33 GMT

Looking forward to it!

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Amit_Navon — Sun, 15 Feb 2026 14:11:25 GMT

@the_rock We will soon start with EA invitations.

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Sun, 15 Feb 2026 14:12:51 GMT

Good news. Will there be free demo customers can get access to?

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Amit_Navon — Sun, 15 Feb 2026 14:40:02 GMT

Will check the feasibility with the training team and update as part of the EA

Amit

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

the_rock — Sun, 15 Feb 2026 15:43:22 GMT

Thanks a lot!

topic Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when in SD-WAN

Nano Agent / Nano Services in Quantum SD-WAN: the Control Plane

1) What is the Nano Agent?

2) Fog + iNext: separating control plane vs data plane (Slide 2)

3) “The first command of your life”: cpnano -s

4) Which Nano Services are involved in SD-WAN

5) Orchestration Nano Service: the “systemd” of the Nano world

6) Orchestration t-shoot: logs and communication debugging

7) SD-WAN Nano Service: where SD-WAN becomes “real” on the gateway

8) Where to validate policy “for real”: sdwan_steering_policy.json

9) SD-WAN t-shoot: logs and policy-focused debug

10) SD-WAN Logger Nano Service: why the portal “doesn’t show events”

Troubleshooting Blueprint in 7 layers (save this)

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Nano Agent & Nano Services in Check Point Quantum SD‑WAN (Infinity Portal)

1) What is the Nano Agent?

2) What are Nano Services (in SD‑WAN context)?

Common Nano Services you’ll encounter for Quantum SD‑WAN

3) Where Nano fits in the Quantum SD‑WAN architecture

4) Installation & onboarding (what you actually do)

Install Nano Agent (token-based)

5) Day‑2 operations: health checks & troubleshooting

The “first command” to check: cpnano -s

Common log locations & debug flags

When the portal is “blind” (no events/metrics)

6) Practical checklist (fast triage)

Quick “plain English” summary

A couple of questions so I can tailor this to your environment

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the Control Plane

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

Re: Nano Agent / Nano Services in Quantum SD-WAN: the “control plane” many people only remember when

The “first command” to check: `cpnano -s`