topic Re: Sandblast and Intel Virtualization Technology (VT) in Firewall and Security Management

Sandblast and Intel Virtualization Technology (VT)

Carlos_Machado1 — Mon, 08 Apr 2019 14:22:03 GMT

Hello, community.

I'm currently trying to deploy a few pods for a Sandblast Network workshop at my company, but I'm getting the following error about Intel Virtualization Technology not being supported.

I read in the associated SK that local emulation is only supported on certain Check Point appliances, but according to the lab deployment guide these should be all VMs.

Thoughts?

Re: Sandblast and Intel Virtualization Technology (VT)

PhoneBoy — Mon, 08 Apr 2019 19:56:52 GMT

If you're using VMs like this, you need to use Cloud Emulation.
If you want Local Emulation, you MUST use specific Threat Emulation appliances (no getting around this).

Re: Sandblast and Intel Virtualization Technology (VT)

Carlos_Machado1 — Mon, 08 Apr 2019 20:16:53 GMT

Hmm.. Interesting.

The lab setup guide says I have to create a virtual machine and the lab guide instruct students to select local emulation when activating the blade. Maybe it's an error?

I can't upload a screenshot of the lab guide since it's a protected document, but will try to do the lab exercises using cloud emulation only.

Thanks.

Re: Sandblast and Intel Virtualization Technology (VT)

PhoneBoy — Mon, 08 Apr 2019 20:23:05 GMT

Pretty sure it's an error.
Which lab booklet is it?

Re: Sandblast and Intel Virtualization Technology (VT)

Carlos_Machado1 — Mon, 08 Apr 2019 20:28:37 GMT

sandblast-instructor-guide.pdf

Lab 2.1, page 49+

But I just checked and there two separate chapters, one for local emulation with its associated lab (page 49+), and one of ThreatCloud emulation with its respective lab (page 115+), so it's no mistake that local emulation should be activated on this VM.

Thoughts?

Re: Sandblast and Intel Virtualization Technology (VT)

PhoneBoy — Mon, 08 Apr 2019 21:03:10 GMT

Not familiar with the doc you're referring to, but given they are referring to both Local and Cloud Emulation as separate labs, I have to assume this is correct.
Note that such a configuration is definitely NOT supported in production, but for lab/training purposes, you can certainly do it.

Just based on the error message, it suggests that Intel VT is not enabled of the BIOS of the hardware you're running this on.
I know I had to enable this when running VMware ESXi inside VMware Workstation on a Windows PC.
Also note that servers with older Intel CPUs (pre-Haswell) can't be used for local emulation as they do not have the necessary CPU debug/profiling hooks.

Re: Sandblast and Intel Virtualization Technology (VT)

Carlos_Machado1 — Mon, 08 Apr 2019 21:08:57 GMT

Ohh ok! Now we're talking.

And yes, this is my case, I'm running a few virtual pods on a vCenter and an ESXi inside each of them. I'll look into it, then. Thank you!