topic Re: vSEC on ESXI interface problem. in Firewall and Security Management

vSEC on ESXI interface problem.

Evgeniy_Andreev — Mon, 16 Oct 2017 07:17:22 GMT

Hello, all!
I have a stange issue with interfaces on virtual appliance. I have deployed R80.10 on ESXI host, and registered it on SMS (also virtual).
After installation, i added some interfaces to SG host, and enabled it using Web interface. In smart console, in Device properties-Network management i used get interfaces command, but it shows only one interface (should be 2)

What can be the root of this issue?

Thanks!

Re: vSEC on ESXI interface problem.

PhoneBoy — Mon, 16 Oct 2017 18:52:01 GMT

Did you reboot the SMS after adding the interfaces in the ESXi Web Interface?

If not, that may be the reason.

Re: vSEC on ESXI interface problem.

Evgeniy_Andreev — Tue, 17 Oct 2017 02:36:10 GMT

Hi!

Yeah, i have rebooted both SG and SMS.

Re: vSEC on ESXI interface problem.

PhoneBoy — Wed, 18 Oct 2017 01:49:37 GMT

What Adapter Type did you add?

On my system, they are added as Adapter Type e1000.

I believe (but haven't personally tried) vmxnet3 should work also.

Re: vSEC on ESXI interface problem.

Evgeniy_Andreev — Wed, 18 Oct 2017 04:09:35 GMT

Hi!

I used VMXNET 3, interface with same type already present in the system and works fine.

Re: vSEC on ESXI interface problem.

PhoneBoy — Wed, 18 Oct 2017 05:01:46 GMT

I recommend opening a ticket with the TAC to assist as it may be an issue with the driver: Contact Support | Check Point Software

You can try using e1000 as a workaround, though.

Re: vSEC on ESXI interface problem.

Evgeniy_Andreev — Wed, 18 Oct 2017 07:41:58 GMT

I can't open a ticket in TAC, since i have no support contract.
As for your advice - i removed NIC with VMXNET3 and added E1000 adapter instead.
And now even web interface does not recognize this NIC.

Re: vSEC on ESXI interface problem.

PhoneBoy — Wed, 18 Oct 2017 12:44:51 GMT

What version of ESXi are you using?

I am personally using 6.5.

I did not try and add interfaces after the fact, but rather provisioned the VM with multiple interfaces from the get go.

If you happen to be using 5, this is not supported with R80.10 per: Compatible Hardware List -- Virtual Machines (though 5.5 is supported)

Just as a test, I took a R80.10 VM I had set up and added an interface to it with the VM powered down.

When I booted it up, the second interface was recognized.

Make sure the Guest OS is set to RHEL 5 (64-bit) and compatibility is set to the latest hardware version supported.

Re: vSEC on ESXI interface problem.

Evgeniy_Andreev — Thu, 19 Oct 2017 02:39:51 GMT

Hi
I solved this.
It is really strange logic in checkpoint, from my point of view.
It is not enough just enable interface, you have to set ip address on it. When i set ip address statically, smart console discover it.

Is it expected behavior?

Thanks you for all replies!

Re: vSEC on ESXI interface problem.

PhoneBoy — Thu, 19 Oct 2017 03:20:05 GMT

For SmartConsole to "see" the interface, the interface must be enabled in Gaia OS.

Since it's possible to configure an interface as a mirror port, an IP isn't strictly required.

See: Monitor Mode on Gaia OS and SecurePlatform OS

It's best practice to configure the interface in Gaia first before attempting to configure the firewall object with the interface (either manually or using Get Topology).

Re: vSEC on ESXI interface problem.

Evgeniy_Andreev — Thu, 19 Oct 2017 04:03:04 GMT

Well, probably Checkpoint will fix it later.

But i checked it twice on two different VMs with latest updates - if there is no IP on interface, Smart Console doesn't see it.

Re: vSEC on ESXI interface problem.

PhoneBoy — Thu, 19 Oct 2017 04:17:45 GMT

An interface is not relevant to the firewall unless it has been configured as a mirror port or has an IP address.

As such, my personal take is that what you're seeing is expected behavior.

Re: vSEC on ESXI interface problem.

Vladimir — Mon, 23 Oct 2017 15:21:51 GMT

How about Bridge Mode?

Re: vSEC on ESXI interface problem.

PhoneBoy — Mon, 23 Oct 2017 15:44:41 GMT

Also bridge mode