topic Re: MDPS - sk138672 in Firewall and Security Management

MDPS - sk138672

the_rock — Wed, 05 Jun 2024 12:42:09 GMT

Hey boys and girls,

Just wanted to post this to see if anyone had any experience with it so far and what feedback is. I recall this concept from Palo Alto few years back, but had not seen it on CP side as of yet.

https://support.checkpoint.com/results/sk/sk138672

If anyone has any feedback to share, please be free.

Best,

Andy

Re: MDPS - sk138672

_Val_ — Fri, 07 Jun 2024 13:14:22 GMT

We have multiple customers using MDPS. It helps in case the system runs a high CPU, for example. What's the question?

Re: MDPS - sk138672

the_rock — Fri, 07 Jun 2024 13:15:50 GMT

Thanks for answering Val, appreciated. I did not have really specific question about it, more just to get feedback, though I guess one question I have would be what might be biggest advantage of using this method compared to not using it?

Andy

Re: MDPS - sk138672

Chris_Atkinson — Fri, 07 Jun 2024 13:37:29 GMT

Routing & Resource separation would be the usual reasons for turning to MDPS.

Re: MDPS - sk138672

the_rock — Fri, 07 Jun 2024 13:42:02 GMT

Hey Chris,

Is there good example of that? I mean in a sense of how it would help with routing and resource separation?

Best,

Andy

Re: MDPS - sk138672

Chris_Atkinson — Fri, 07 Jun 2024 14:11:51 GMT

Basic / simplified examples:

- Preventing traffic processing consuming all resources of the system resulting in poor management responsiveness

- Allow separate default routes for the isolated management network versus production

Re: MDPS - sk138672

the_rock — Fri, 07 Jun 2024 14:09:58 GMT

Awesome, thanks guys, that helps.

Best,

Andy

Re: MDPS - sk138672

the_rock — Fri, 07 Jun 2024 14:12:19 GMT

One more question @Chris_Atkinson

I assume this cant be configured via web UI based on the sk...correct? Appears only via clish?

Andy

Re: MDPS - sk138672

Chris_Atkinson — Fri, 07 Jun 2024 14:40:09 GMT

CLI only correct, similar to VSX.

Well perhaps that's too much of a generalisation but it's listed in the limitations in any case.

Re: MDPS - sk138672

the_rock — Fri, 07 Jun 2024 14:58:22 GMT

Thanks mate, always greateful for your help.

Have a nice weekend.

Andy

Re: MDPS - sk138672

Jarvis_Lin — Sun, 09 Jun 2024 16:26:36 GMT

Will this limitation be fixed in the future?

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 16:32:33 GMT

What limitation @Jarvis_Lin ?

Andy

Re: MDPS - sk138672

Jarvis_Lin — Sun, 09 Jun 2024 16:37:49 GMT

setting from command, not from Gaia GUI.

It’s no problem for engineers setting from command, but it’s a big challenge for customers.

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 16:59:36 GMT

O that, right. I really could not say, maybe best to submit RFE, I suppose.

Andy

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 17:04:18 GMT

Btw, I checked the sk again and dont see anything about it there either, so as I mentioned, I would submit RFE about it.

Re: MDPS - sk138672

Jarvis_Lin — Sun, 09 Jun 2024 17:20:55 GMT

Hi Rock,

My English is not good, I checked the sk,

I was referring to the limitations of PMTR-81746, Security groups are not supported for Gaia Portal when MDPS is enabled.

It's hard for customers. If they need to set VLAN or routing.etc.

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 17:46:44 GMT

Ah, now I got it, sorry. Yes, I can imagine that would be somewhat inconvenient, for sure. I would still submit RFE or maybe comment on the sk or if you can, also message your local SE to see if they can push that further within Check Point internally.

Best,

Andy

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 17:49:40 GMT

If you click below, it would ask you to submit a feedback and you would get an email about it from skhelp@checkpoint.com

Andy

Re: MDPS - sk138672

the_rock — Sun, 09 Jun 2024 18:29:43 GMT

I mispelled this, but you get an idea, see below, my feedback, exactly what you said essentially.

Andy

Re: MDPS - sk138672

Jarvis_Lin — Sun, 09 Jun 2024 19:13:47 GMT

Thank you, you're such a kind person.