topic Re: Experiences in Gateway on VMware in Firewall and Security Management

Experiences in Gateway on VMware

Helpdesk_Borken — Tue, 23 Feb 2021 15:15:06 GMT

Hi,

I wasn't able to find a matching board entry, so I'm creating one here. I'm in need for your experience.

My company has everything virtualized. Only the Checkpoint Security Gateway is not. Now we are discussing the possible virtualization of this machine.

Has anybody experience with this solution? I'm currently torn. Does this method have enouth performance?

Currently we're using an OpenServer with multible VLANs on a Bond and 2 Core licensing.

Hopefully somebody out there has some experience since our reseller has none.

Thank you,

Stephan Kögler

Re: Experiences in Gateway on VMware

Vincent_Bacher — Tue, 23 Feb 2021 15:33:12 GMT

Security Gateway on VMWare works, We run dozens that way.

Re: Experiences in Gateway on VMware

Timothy_Hall — Tue, 23 Feb 2021 17:16:30 GMT

For your gateway VMs, I'd suggest creating the interfaces with interface type vxmnet3 (which supports Multi-Queue) instead of the standard e1000.

Re: Experiences in Gateway on VMware

Kim_Moberg — Tue, 23 Feb 2021 17:47:59 GMT

Tim, doesnt Cloudguard Vsec for vmware running R81 preinstalled with vmxnet3? Those that I spinned up in vCenter already had this config. Though I am wondering why it detects a 10G network adapter and not just unlimited link speed.

Do you have any recommend performance ideas? With 4 cores vsec I can with ngfw get almost 3.6gbps when testing with iperf with 1 mb data package over 1 hour.

Re: Experiences in Gateway on VMware

Bob_Zimmerman — Tue, 23 Feb 2021 19:02:16 GMT

Throughput is fine. Latency is maybe 10x higher, but that's going from tens of microseconds to hundreds of microseconds. Not really a noticeable difference in most situations. With VT-D, you can hand a whole PCIe card directly to a VM. In that case, latency is still higher than on dedicated hardware, but less so. Virtualization costs a lot of I/O latency.

The larger concern is the failure domain. If your VM environment goes down (e.g., your datacenter loses power and all hosts need to come up from scratch), do you need that firewall working to be able to get tech support and/or recover? With virtualization, it's entirely possible to set up your environment in such a way that it's impossible to recover from a full outage.

Re: Experiences in Gateway on VMware

Timothy_Hall — Wed, 24 Feb 2021 12:40:38 GMT

Yes it should use vmxnet3, but I have seen some VMWare implementations that still default to e1000 for some reason. Just something to check.

Re: Experiences in Gateway on VMware

PhoneBoy — Sun, 28 Feb 2021 18:40:43 GMT

We have sold Check Point gateways in VMware and public clouds for years.
In the past, the solution went by such names a VE (Virtual Edition), vSEC, and CloudGuard IaaS.
Currently, it is called CloudGuard Network Security.
We even have spaces for it on CheckMates 🙂

Your existing Open Server licenses should work with virtualized gateways, though we sell specific licenses for it now.

Re: Experiences in Gateway on VMware

Helpdesk_Borken — Wed, 03 Mar 2021 06:45:53 GMT

Thank you all for your insights.

I'll follow this solution further.