topic Re: Smartcenter gaia on nutanix ? in General Topics

Smartcenter gaia on nutanix ?

aner_sagi — Wed, 09 Jan 2019 13:35:57 GMT

Hi All,

A new customer of mine want to move his R80.10 smartcenter (currently on Hyper-V) to Nutanix.

is it supported ?

Thanks in advance

Aner

Re: Smartcenter gaia on nutanix ?

Norbert_Bohusch — Wed, 09 Jan 2019 14:10:18 GMT

Nutanix Hypervisor (AHV)? Not supported as far as I know.

If you only mean Nutanix HW with VMware ESX or Hyper-V, this should work for sure.

Re: Smartcenter gaia on nutanix ?

Dima_M — Fri, 31 May 2019 09:46:12 GMT

Re: Smartcenter gaia on nutanix ?

Alexandru_Costi — Wed, 13 Feb 2019 06:04:05 GMT

Hi Dima,

Are there any news regarding having R80.20 Smart Center running on Nutanix AHV? We also have a customer that has this requirement.

Thank you,

Alex

Re: Smartcenter gaia on nutanix ?

PhoneBoy — Sat, 16 Feb 2019 00:44:26 GMT

We may be able to provide this through your local Check Point office.

Re: Smartcenter gaia on nutanix ?

aner_sagi — Tue, 28 May 2019 10:10:03 GMT

Hi.

Any progress on the certification process?

Thanks in advance

aner.

Re: Smartcenter gaia on nutanix ?

af0e2c12-4d24-3 — Tue, 18 Jun 2019 09:45:06 GMT

I had the same question recently and was told they stopped testing due to lack of a solid business case and there weren't many customers requesting this from checkpoint. I opened an RFE with checkpoint and notified my checkpoint team a couple weeks ago but haven't heard back yet if they will continue testing or not. For us the business case would be pretty simple - we can put everything else in AHV but would have to keep a separate environment just for Checkpoint management VMs. One cluster is sure easier than two (on different technologies). Nutanix loses a lot if we instead do Nutanix on Hyper-V (ADS, windows stability, windows update issues, etc) and I don't have any vmware admins sitting around. It seems like management should be somehow easier to certify than gateways but I suppose it's more a matter of enough customers requesting AHV support.

Re: Smartcenter gaia on nutanix ?

dbritt — Fri, 09 Aug 2019 12:40:28 GMT

We also would like to migrate our SmartCenter to Nutanix AHV. Our business case is similar to yours. In our case, everything else has been migrated from ESX to AHV, now we are stuck maintaining a VMware machine for one VM.

Re: Smartcenter gaia on nutanix ?

PhoneBoy — Fri, 09 Aug 2019 18:40:34 GMT

Your best bet is to engage with your local Check Point office on this requirement.

Re: Smartcenter gaia on nutanix ?

Garrett_DirSec — Fri, 20 Sep 2019 20:43:42 GMT

update Sept20, 2019. significantly more information has surfaced on this topic since original post.

The default GAIA R80.20/R80.30 network driver does not work well on Nutanix platform. Check Point Solution Center has released an updated driver for Nutanix platform that is specifically for GATEWAY deployments. You local Check Point field engineer can obtain this through internal process with Solution Center.

However, the development and testing for this NIC driver and Nutanix is ONLY for gateway and SmartCenter is not currently supported.

>>> original <<<<

We have fielded similar query from customer "migrating SmartCenter virtual instance from VMware to Nutanix".

Our local CP engineer researched and was told "not officially supported but it should work". In addition, there was suggestion to test operation thoroughly as possible to identify any obvious service-affecting issues. If nothing awful, then issues encountered for production instance would be review on case-by-case basis.

Ie -- software config issues would be supported as normal, but it something seems to be result of platform then customer on own.

Customer OK with this position. We built Nutanix SmartCenter image (32G RAM, 8Cores, 500G disk) and have been playing to insure no surprises.

on side topic of GATEWAY on Nutanix, CP engineers have "internal" PDF that details how to deploy gateway on Nutanix. This under the Cloudguard realm. CP maintaining pre-build nutanix images that are downloaded internally and deployed on customer.

Best wishes. -GA

Re: Smartcenter gaia on nutanix ?

Marcos_Vieira — Thu, 10 Oct 2019 01:23:11 GMT

I have seen in the Check Point site, https://www.checkpoint.com/support-services/hcl/, that the Nutanix Acropolis Hypervisor (AHV/AOS), version AHV-20170830.184 & AOS-5.10 is supported by the version R80.30 (3.10 Kernel) to run the Security Gateway (not the SMS).

Re: Smartcenter gaia on nutanix ?

Garrett_DirSec — Sat, 22 Feb 2020 15:45:51 GMT

Nudging this topic to see if there's an update from @Tomer_Noy and team.

I know it's a financial decision. I understand the Nutanix platform supported in Cloudguard IaaS (gateway) with special NIC driver.

Customer would like to leverage Nutanix LEAP (DR-as-a-service).

In the LEAP environment they can deploy stand-alone VM image. Customer wants to deploy CP SmartCenter in Nutanix LEAP environment to augment their existing Mgmt HA between primary and physical DR sites.

Over time, physical DR moving to LEAP as some legacy apps tying them to physical DR are decomissioned.

Of course, a great alternative strategy would be to leverage MaaS (management-as-a-service) but it's unclear if/when MaaS will support Mgmt HA with on-premise SmartCenter.

Yes, I understand target for MaaS is 99.9xxxxx% uptime, but Mgmt HA provides operational flexibility for network circuit issues. Thus, the number of "9's" for MaaS does not solve all issues.

advise on thoughts. -GA

Re: Smartcenter gaia on nutanix ?

Tomer_Noy — Sat, 22 Feb 2020 16:27:37 GMT

Regarding official driver support for Management as well as Gateway, that's really something for the OS team. If you need to promote it, then Solution Center may be the right path.

Regarding MaaS, we are looking into the option of allowing HA but it's not going to be immediate.

There are various challenges when MaaS is maintained by Check Point while the on-premise HA is maintained by the customer. For example, Management machines must be on the same version and JHF level for HF sync to succeed. If the secondary HA will be on-premise the sync will frequently break whenever we update / upgrade our side.

Also, the main benefit of MaaS is not having to deal with maintenance and sizing of the Management. It loses the impact a bit if the customer needs to take care of a secondary.

We are looking into other options such as the ability to fetch an export of the Management environment. A customer could periodically copy these on-premise and in a disaster case, install a new machine / VM, import and control his gateways.

Would be glad to hear thoughts / comments from the field on these directions.

Re: Smartcenter gaia on nutanix ?

PhoneBoy — Sat, 22 Feb 2020 20:27:55 GMT

The relevant Nutanix drivers need to be added to an OS image that support management.
This was done for a special R80.30-3.10 image for gateways.
Not sure why these aren't in the maintrain yet.

As Tomer said, your best bet is to engage with Solution Center.
This will need to be done through your local Check Point office.

Re: Smartcenter gaia on nutanix ?

Jan_Elbers — Sat, 22 Feb 2020 22:42:20 GMT

👍

Re: Smartcenter gaia on nutanix ?

Alexandru_Costi — Sun, 23 Feb 2020 07:09:10 GMT

Hi,

When I started looking into it, I never got a clear answer regarding when/if Smart Management will be officially supported on Nutanix AHV.

In the meantime we have 3 x R80.20 Smart Center VMs running on our Nutanix clusters for the last 6-8 months. We didn't have any issues with network cards, the only problem we had was with no drivers for SCSI disk so we used a SATA disk for the VM instead.

We are running Nutanix AOS - 5.10.8.1 and AHV - 20170830.337. The installation of the Smart Center VMs was done using R80.20 - Build 095.

Recently we upgraded our Nutanix environment (to the versions mentioned above) and we didn't have any problems with the Check Point VMs: no issues with migration of VMs between nodes during the Nutanix upgrade and no downtime.

Thanks,

Alex

Re: Smartcenter gaia on nutanix ?

PhoneBoy — Mon, 24 Feb 2020 03:39:25 GMT

I suspect if you use fairly generic virtual hardware, it should work fine in Nutanix, as Gaia generally does in many virtualized environments, but it may not be as performant as if the specific virtualized hardware Nutanix provides.
Formal support is, of course, a different matter.

Re: Smartcenter gaia on nutanix ?

Garrett_DirSec — Mon, 24 Feb 2020 15:27:20 GMT

Hello @PhoneBoy and @Tomer_Noy .

For past Nutanix builds, @Timothy_Hall observed the following problems with SmartCenter open-server build.

Per comments from @Alexandru_Costi , I plan to have (different) customer re-test and validate Nutanix versions.

[use] netstat -ni . they were accumulating RX-DRPs when under no load whatsoever, the virtio network driver appears to suck.
horrible disk I/O.

Thanks to all. -GA

Re: Smartcenter gaia on nutanix ?

Garrett_DirSec — Mon, 24 Feb 2020 15:29:57 GMT

Hello @Tomer_Noy . thanks for update and insight.

Customer currently using SmartEvent onsite with dedicated appliance (in addition to HA Management between two physical SmartCenters).

How does "logging" work with MaaS? Is there a equivalent of Log Exporter to redirect MaaS logging to SIEM, etc.?

Can customer leverage MaaS with separate on-premise Log Server? Is this recommended when using SmartEvent?

Thanks -GA

Re: Smartcenter gaia on nutanix ?

Garrett_DirSec — Mon, 24 Feb 2020 15:33:56 GMT

hello @Alexandru_Costi . thanks for this very helpful insight. -GA