topic Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware in Firewall and Security Management

Running Dynamic Dispatch / Dynamic Split / Dynamic Balancing on VSEC/IaaS in Vmware

Kim_Moberg — Sat, 13 Nov 2021 10:58:19 GMT

I have been running Dynamic Dispatch since it was in EA and GA on two cluster members on a physical 5800 appliances.

I am building infrastructure firewalls to protect my active directory security domains.

Today I upgraded my VSEC/IaaS cluster from 4 cores (1 snd and 3 fw cores) to be running 8 cores in total (2 snd and 6 fw) and it raised a reminder maybe I can too run Dynamic Dispatch on my VSEC/IaaS om my vmware VSAN datacenter environment.

Is that even possible or does it have to be physical hardware and not virtuel?

VSEC/IaaS are from the Cloud Guard VE iso / ova packages downloaded from Check Point support center and not installed as traditional iso with Gaia setup.

Dynamic Dispatch just works and ir splits the load between SND and FW walker. I was thinking maybe this will provide even better performance.

Looking for hearing your take on this..

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Chris_Atkinson — Sat, 13 Nov 2021 10:54:30 GMT

Hi Kim,

For normal gateways dynamic dispatcher has been around since R77.30 and not to be confused with dynamic balancing/split which is a different but complimentary feature.

Regards,

Chris

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Kim_Moberg — Sat, 13 Nov 2021 10:51:28 GMT

Hi @Chris_Atkinson

I mean Dynamic Split and you would enable it CLI with the command "dynamic_split -o enable”

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Kim_Moberg — Sat, 13 Nov 2021 10:57:12 GMT

@Chris_Atkinson

I found this article too here at Check Point and I see questions been raised too about openservers and iaas.

Dynamic Workloads in R80.40+ TechTalk: Video, Slid... - Check Point CheckMates

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Chris_Atkinson — Sat, 13 Nov 2021 10:59:39 GMT

Currently sk164155 states only appliances are supported.

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

PhoneBoy — Mon, 15 Nov 2021 05:00:12 GMT

And that's generally the case.
It may work on VMs but I don't think it's been QAed as of yet.

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Kim_Moberg — Thu, 25 Nov 2021 09:07:56 GMT

Hi Dameon,

How then can we get RnD / QA to work on this and test it if no one requests it?

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

Chris_Atkinson — Thu, 25 Nov 2021 10:59:02 GMT

Taking a step back would we rather these things scale like they do in public cloud?

Point being there are different ways to potentially address something like this.

Re: Running Dynamic Dispatch on VSEC/IaaS in Vmware

PhoneBoy — Mon, 29 Nov 2021 20:32:26 GMT

It is something being worked on last I heard, but don't know exactly what the timelines are.