topic Re: How to script setting concurrent connection limit on VSX? in API / CLI Discussion

How to script setting concurrent connection limit on VSX?

NoMaD_dk — Wed, 30 Apr 2025 08:32:42 GMT

We are looking into having to adjust the concurrent connection limit slightly, due to contractual obligations with our customers and I would like to know if there is any way, API, CLI or other, that would allow us to set a new value, instead of having to go into the GUI and setting a new individual value on 130+ Virtual Systems.

I have not found evidence that vsx_provisioning_tool can do it, unless I missed something.

Any ideas?

We are currently running R81.10 and looking into upgrading to 81.20.

Re: How to script setting concurrent connection limit on VSX?

PhoneBoy — Wed, 30 Apr 2025 12:49:36 GMT

As you know, the number of concurrent connections permitted in a VS is set via SmartConsole in the VS object.
Unfortunately, there is no API support for legacy VSX objects.
Which means this is not scriptable.

Re: How to script setting concurrent connection limit on VSX?

Lesley — Wed, 30 Apr 2025 13:57:00 GMT

Same cannot find anything related to this in the API guide.

Extra tip:

Do you already monitor connection limit with SNMP? This is possible.

Alternative is to run vsx stat-l and the systems and collect the info from there.

Plus not 100% sure ( dont have my notes with me) but i think in r82 on vsx you can now use the option auto for the connection limit.

Re: How to script setting concurrent connection limit on VSX?

NoMaD_dk — Thu, 01 May 2025 12:51:13 GMT

Yes, we already monitor it. The question is if the value could be manipulated in another way than through the GUI, which I see is not possible.

Setting the value to auto is not an option either, due to billing and contracts obligations.

Re: How to script setting concurrent connection limit on VSX?

the_rock — Thu, 01 May 2025 13:04:29 GMT

For what is worth, this is what came from AI.

Andy

*************************************************************************

To script setting the concurrent connection limit on VSX (Virtual System Extension) in Check Point firewalls, you'll typically use CLI commands, particularly through fw ctl or SmartConsole/SmartCenter CLI (mgmt_cli) depending on whether you're modifying kernel parameters or object configurations.

Here’s a practical approach, assuming you want to set connection limits per Virtual System (VS):

🔧 Option 1: Using `fw ctl set int` for runtime kernel limit (not persistent)

This sets the concurrent connection limit in memory, not surviving a reboot.

To verify:

⚠️ Not persistent — use fwkern.conf for persistence.

🔐 Option 2: Make persistent via `/etc/fwkern.conf`

Add the following to /etc/fwkern.conf on the VSX gateway:

You must do this from within the VS context (vsenv <VSID>), and reboot or run fw ctl set int afterward to apply.

🧠 Option 3: Using `mgmt_cli` or API to configure SmartConsole settings

If you want to set limits as part of a policy object (e.g., per gateway or VS), use the management API.

Example with mgmt_cli (not directly for connection limits but to modify VSX objects):

You’ll need to check your exact object type (simple-gateway, vsx, etc.) and fields.

💡 Script Example

Here’s a shell script to set the limit on multiple VSs:

To make this persistent, you’d script editing /etc/fwkern.conf for each VS.

topic Re: How to script setting concurrent connection limit on VSX? in API / CLI Discussion

How to script setting concurrent connection limit on VSX?

Re: How to script setting concurrent connection limit on VSX?

Re: How to script setting concurrent connection limit on VSX?

Re: How to script setting concurrent connection limit on VSX?

Re: How to script setting concurrent connection limit on VSX?

🔧 Option 1: Using fw ctl set int for runtime kernel limit (not persistent)

🔐 Option 2: Make persistent via /etc/fwkern.conf

🧠 Option 3: Using mgmt_cli or API to configure SmartConsole settings

💡 Script Example

🔧 Option 1: Using `fw ctl set int` for runtime kernel limit (not persistent)

🔐 Option 2: Make persistent via `/etc/fwkern.conf`

🧠 Option 3: Using `mgmt_cli` or API to configure SmartConsole settings