topic Re: Check Point sizing solution for VMware. in Firewall and Security Management

Check Point sizing solution for VMware.

Oleg_Khomutinin — Sun, 02 Dec 2018 19:23:11 GMT

Hello Check Point community,

I really interest sizing concept, especially for virtual infrastructure environment based on VMware. Unfortunately I haven't access to the sizing tool for analyze suitable HW models then grab from them technical characteristics and prepare the same one on VMware. For me It need to calculate adequate costs for licensing and subscription NGTP packet, cause as I understand more cores->more money :-). And I need to find out better balance between them.

interest it firewall requirements, we will use:

1.blades: Firewall, Identity Awareness, Application Control, URL Filtering, Anti-Virus, Anti-Bot.

2.Distributed deployment model

3.VMware infrastructure.

4.No clustering

For this solution we are really interest parameters (CPU, Memory, Disk Space) which better to put (for firewall only, SMS is centralize and already installed):

Option 1: Less that 50 users

Option 2: Less that 100 users

Option 3: Less that 200 users

Option 4: less than 400 users.

Check point gateways we are use only as access this users to Internet and nothing more.

Really appreciated if you share some recommendations/ideas for all four options.

I already investigated CP documentation with minimum parameters as well: TAGS ARE REQUIRED --> Check Point Software Technologies: Download Center

Re: Check Point sizing solution for VMware.

PhoneBoy — Mon, 03 Dec 2018 02:15:33 GMT

The requirements for memory and disk space are listed in the Release Notes for the version you wish to run.

Those don't really change much.

For a couple hundred users or less, two cores may be sufficient (minimum allowed, I believe).

You'll probably want four cores for 400 users.

However, the above are just rough guesstimates and don't take into account your Internet throughput, which might suggest you need more cores.

I recommend you have a more detailed conversation with your local office to refine these recommendations.

Re: Check Point sizing solution for VMware.

Gomboragchaa — Mon, 03 Dec 2018 02:23:38 GMT

Virtual Software security gateways are licensed by CPU core and license starts from 2 core.

I would suggest contact local reseller/partner.

They can provide more detailed information and suggest suitable model(license)

Re: Check Point sizing solution for VMware.

_Val_ — Mon, 03 Dec 2018 08:11:02 GMT

Sizing depends on many things, not only on amount of users. Most importantly, required Software Blades make a difference. Although Appliance Sizing tool does not work for VMware, you still can assess the needs by looking at the highest appliance recommended for your case and then "translate" its HW details into VMware. Mind that Vmware based SG will share resources with other entities and thus will be slower that a dedicated appliance.

I would recommend for cases 1 to 3 8 GB RAM and 2 CPUs. Case will need 4 cores minimum and probably 16 GB or RAM.

Also, your link to some document does not work for anyonee else but yourself, but I guess you were referring to R80.10 Release Notes.

Re: Check Point sizing solution for VMware.

Oleg_Khomutinin — Mon, 03 Dec 2018 12:42:48 GMT

Thank you for answer, we are plan to use no more than 50 Mbps for each branch location.

Re: Check Point sizing solution for VMware.

Benoit_Verove — Mon, 03 Dec 2018 13:01:20 GMT

Hi,

When sizing a VM solution, I usely translate the capacities of an HA appliance.

However, for a VM, it is also important to size the IOPS needs. For now, I've never seen any document that could help.

Any advices for defining IOPS ?

Regards,

Benoit

Re: Check Point sizing solution for VMware.

_Val_ — Mon, 03 Dec 2018 13:13:25 GMT

Have you seen this: Best Practices - Performance Optimization of Security Management Server installed on VMware ESX Virtual Machine ?

Re: Check Point sizing solution for VMware.

Pablo_Barriga — Thu, 06 Dec 2018 16:52:01 GMT

The important part is the hardware, this help me try to understand if my esx host will support that traffic.

Re: Check Point sizing solution for VMware.

Oleg_Khomutinin — Fri, 07 Dec 2018 11:38:20 GMT

Hi Pablo, can you send the link to this document please?

Re: Check Point sizing solution for VMware.

AlekseiShelepov — Fri, 07 Dec 2018 11:50:54 GMT

Worth mentioning here:

Performance improvement on kernel 3.10 based CloudGuard environments is ~300% comparing to current CloudGuard numbers

https://community.checkpoint.com/community/infinity-general/appliances-and-gaia/blog/2018/12/06/r8020-security-gateway-with-new-gaia-based-on-kernel-310-is-ga-for-cloudguard-and-hp-gen10

Re: Check Point sizing solution for VMware.

Pablo_Barriga — Sat, 08 Dec 2018 16:31:26 GMT

Hello Oleg I found it in the public cloudguard site, I’m looking forward for and r80.10 or r80.20 updated information. I used the aws cloudguard performance also for sizing