topic Re: VSX and VS in different domains ? in Firewall and Security Management

VSX and VS in different domains ?

Bruno_Petronio — Tue, 09 Mar 2021 14:30:41 GMT

Hello All,

I've read somewhere, that would be possible to have a VSX Gateway inside a specific Domain (MDM environment) and create VS from that VSX Gateway in different Domains.

Is this something feasible ?

Inside the domain where i want to create the VS, i can see the VSX Gateways that reside in different domains, so i would guess its possible.

Is this something that someone already tried ?

Pros/Cons would be grateful.

Thanks in advance !

Bruno Petrónio

Re: VSX and VS in different domains ?

genisis__ — Tue, 09 Mar 2021 16:09:20 GMT

If the VSX is managed from a MDS setup then far as I'm aware the VSX appliances should be managed via the main domain, in this way this can then be seen by customer domains.

Re: VSX and VS in different domains ?

Bob_Zimmerman — Tue, 09 Mar 2021 19:08:20 GMT

The short explanation is this is how VSX and Provider-1 are meant to be used together in a managed service provider context. You, the service provider, own the MDS and the VSX chassis. You then provision a Customer Management Add-on for the customer, and a VS (or several) to go with it.

Re: VSX and VS in different domains ?

Norbert_Bohusch — Tue, 09 Mar 2021 19:13:26 GMT

As stated already one reason was separation in provider/customer scenario.

But this was also a best practice to have a separate domain for the VSX gateways, as changes to a VS also locked the domain of VSX gateway (before R80) and so you separated it.

Re: VSX and VS in different domains ?

Vincent_Bacher — Tue, 09 Mar 2021 19:46:36 GMT

We have many VSX and their vs separated in different CMA. I don't really see a disadvantage of doing that if there is a need to do so.

Re: VSX and VS in different domains ?

Bruno_Petronio — Tue, 09 Mar 2021 23:03:52 GMT

You mean, many VSX in one domain (called main domain), and their VS inside the several other domains ?

Re: VSX and VS in different domains ?

Bruno_Petronio — Tue, 09 Mar 2021 23:12:40 GMT

Main Domain, implies that only one Domain could have the VSX Gateway ?

If i need 2 VSX Gateway (not cluster), is it possible/make sense to have it in different domains ?

Re: VSX and VS in different domains ?

Bruno_Petronio — Tue, 09 Mar 2021 23:18:58 GMT

Thanks for clarifying that.

We are not running different customers, but have business related needs and we are running VSX for the virtualization fun/benefits 🙂

Saying that, make sense to have VSXs together in one domain and all VSs spread by different Domains, right ?

No Pros having VSX and VSs per Domain, i would say.

Re: VSX and VS in different domains ?

Vladimir — Wed, 10 Mar 2021 01:15:23 GMT

I've written something on this subject some time ago for R77.30

https://community.checkpoint.com/t5/General-Topics/MDSM-with-VSX-Configuration-Guide-and-Architecture/m-p/40520

Perhaps you'd find it useful.

Re: VSX and VS in different domains ?

Vincent_Bacher — Wed, 10 Mar 2021 14:46:40 GMT

Yes, we have several VSX one domain and their VS inside several other domains. We really have some vsx in a domain called main but several others in different domains.

Re: VSX and VS in different domains ?

genisis__ — Wed, 10 Mar 2021 14:54:17 GMT

I believe VSX clusters in the main domain can be shared with other CMAs. VSX Clusters controlled by a customer CMA, are only usable within that domain and not visible to other customer domains.

If you decided to implement a global level VPN then having a mixed installation may not work (Never done this but thought its worth considering if you ever intended to use this feature in MDS).

Re: VSX and VS in different domains ?

Cristian_F_CCSM — Fri, 23 Jun 2023 08:40:49 GMT

Hello, how we can verify that a domain is the "main"?

Also the "virtual switch" can be shared with two or more CMA?

Thanks

Re: VSX and VS in different domains ?

genisis__ — Fri, 23 Jun 2023 08:56:09 GMT

I'm not sure what you mean by "main". I would translate that to "the DMS that should have the VSX appliances and the virtual switches". However all depends on your setup.

In general I would say the first DMS created is where the VSX appliance should be managed. The virtual switches would be created here and would then be available for other DMS's to use.

Now keep in mind the DMS that controls the _VSX policy would generally be where you manage you VSX platform from.

HOST POLICY DATE
localhost POLICY_VSX 1Apr2023 22:39:44 : [>bond1] [<bond1] [>bond2] [<bond2]

Additionally you could have other VSX appliances controlled from Customer DMS, but they would be totally isolated to that customer.

Re: VSX and VS in different domains ?

Cristian_F_CCSM — Fri, 23 Jun 2023 09:12:33 GMT

Hello, OK, thanks a lot. Your explanation is clear.