topic Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores) in Firewall and Security Management

New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

Danny — Mon, 27 Apr 2020 07:20:32 GMT

I really like the all new R80.30 feature for separating management from data traffic via

Routing Separation and
Resource Separation

as described in sk138672.

Did anyone test this already?

Re: New! R80.30 feature: Management Data Plane Separation

Jerry — Tue, 19 Mar 2019 11:16:46 GMT

it is about time! finally arrived.
will test it soon and report back 🙂

Re: New! R80.30 feature: Management Data Plane Separation

Tommy_Forrest — Tue, 19 Mar 2019 12:55:38 GMT

About time! This is a long over due feature!

Re: New! R80.30 feature: Management Data Plane Separation

JozkoMrkvicka — Tue, 19 Mar 2019 21:14:00 GMT

"Use of logical interfaces is not suppoted on management interface (Alias, Bridge, VPN Tunnel, 6in4 Tunnel, PPPoE, Bond, VLAN)"

1. It is a pity. Showstopper for us.
2. There is typo (suppoted -> supported).

Re: New! R80.30 feature: Management Data Plane Separation

HeikoAnkenbrand — Tue, 19 Mar 2019 19:46:56 GMT

Very interesting information.

I will test it tomorrow in our LAB:-)

Thank you!

Re: New! R80.30 feature: Management Data Plane Separation

HeikoAnkenbrand — Tue, 19 Mar 2019 20:01:05 GMT

With Resource Separation the cpu load should not rise when installing the policy. Is that correct?

Re: New! R80.30 feature: Management Data Plane Separation

HeikoAnkenbrand — Tue, 19 Mar 2019 20:13:03 GMT

Hi Dameon,

Do I need a license for the management instance or lose a core license?

Regards

Heiko

Re: New! R80.30 feature: Management Data Plane Separation

PhoneBoy — Tue, 19 Mar 2019 22:07:19 GMT

I assume this dedicated CPU core is treated like any other core: you need a license for it. A minimum of 8 CPU cores are required to use this feature, which means your Open Server license must be for at least 8 cores. Beyond that, no special licensing requirements.

Re: New! R80.30 feature: Management Data Plane Separation

Vladimir — Thu, 21 Mar 2019 15:01:30 GMT

So anything below 5900 will not be able to take advantage of it...

Re: New! R80.30 feature: Management Data Plane Separation

PhoneBoy — Thu, 21 Mar 2019 15:19:41 GMT

Sounds about right.

Re: New! R80.30 feature: Management Data Plane Separation

Vladimir — Thu, 21 Mar 2019 15:48:33 GMT

Danny, you may want to change the heading by adding "for gateways with 8 or more cores".

Otherwise it leads to unwarranted euphoria 🙂

Re: New! R80.30 feature: Management Data Plane Separation

Danny — Thu, 21 Mar 2019 21:01:30 GMT

Added.

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 8+ cores)

Nicholas_Moore — Wed, 10 Jul 2019 17:05:02 GMT

I do have a concern about the best practices from the article: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk138672

"Connectivity to the LDAP and similar servers from the Gateway should be done via the Data Plane."

I've always been told that only the management/control plane of a security gateway should be making or allowing connections to the device. The data plane should not allow or make connections, it should only play the role of traffic cop.

What is everyone's thoughts on this?

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 8+ cores)

John_Michealson — Sun, 26 Apr 2020 15:01:57 GMT

FYI this was changed to min 4 recently

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 8+ cores)

Danny — Mon, 27 Apr 2020 07:21:12 GMT

Thanks for the info. I changed the thread title from 8 to 4 CPU cores.

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

Ramazan_Sengul — Mon, 11 May 2020 13:58:37 GMT

I tested and worked successfully. (resource&routing both enabled)

It's not possible to use mgmt ip on identity collector and i think it should be.

Could you please add a service/task for this issue?

XXXXXXXXX:TACP-0> show mdps state

Management Data plane separation:

Routing plane: Enabled
Dedicated resource: Enabled (FW-Instance [39,38], CPU [4,28])
Management interface: Mgmt
Sync interface: Sync
Management plane configured routes:
default via X.X.X.X

XXXXXXXXX:TACP-0> show mdps tasks

Management plane tasks:
Service: cpri_d
Service: ntpd
Service: sshd
Service: syslog
Process: cloningd
Process: httpd2
Process: ntpd
Process: snmpd
Process: snmpmonitor
Port;Protocol: 256;tcp
Port;Protocol: 257;tcp
Port;Protocol: 2010;tcp
Port;Protocol: 5432;tcp
Port;Protocol: 18181;tcp
Port;Protocol: 18183;tcp
Port;Protocol: 18184;tcp
Port;Protocol: 18187;tcp
Port;Protocol: 18191;tcp
Port;Protocol: 18192;tcp
Port;Protocol: 18195;tcp
Port;Protocol: 18210;tcp
Port;Protocol: 18211;tcp
Port;Protocol: 18264;tcp

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

azadvinskiy — Wed, 20 May 2020 02:45:02 GMT

I tried mdps in the lab. I have two issues so far:

1. Can't make backup traffic to go over Mgmt interface, it attempts ssh connections on one of the data interfaces instead, even if I try to backup gateway to a management appliance.

2. TACACS traffic on port 49 goes over Mgmt interface during initial login the the gateway, which is expected, then it attempts to go over data interface for some reason during 2nd authentication when I try escalate my privileges from TACP-0 to TACP-15.

These two issues are show stoppers for us to deploy this feature.

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

Alex_Shpilman — Tue, 28 Jul 2020 01:55:29 GMT

We have exactly the same issue with R80.40 latest ongoing JHF:

1. Identity Collector planned to communicate with different firewalls in different zones and the only common network is the mgmt

2. We also can't apply JHF using CPUSE GUI, just CLI

3. Lastly, the default route disappears occasionally after a reboot

4. Only one sync is supported

Any light at the end of the tunnel? I wish it would work more like a routing domain with more flexibility.

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

Aviad_Hadarian — Tue, 28 Jul 2020 10:44:51 GMT

Please move clish to mplane environment:

'set mdps environment mplane'

Alternatively you can move confd to mplane permanently via 'add mdps task process confd' (requires reboot)

Re: New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

Aviad_Hadarian — Tue, 28 Jul 2020 10:47:09 GMT

Hi Alex,

Can you share the following please?

'dbget -rv mdps'

Also why do you need more than once interface for Sync? you can use link aggregation (bond) instead.