topic Re: VSX VS0 Interfaces in General Topics

VSX VS0 Interfaces

Dor_Marcovitch — Wed, 13 Jun 2018 08:07:38 GMT

hey

is it possible that VS0 will have multiple interfaces (LAN and WAN)?
is it possible to route traffic through VS0?
has anyone deployed VSX on remote datacenter which VS0 has interface has interface to the itnernet

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Wed, 13 Jun 2018 11:28:36 GMT

Never done it that way but I assume so - it's just a regular firewall in that sense. (traffic/interfaces)

We always had another VS in front of VS0 for traffic coming from internet. I guess you are worried if VSX goes down then you won't be able to reach VS0? Out of band option?

Re: VSX VS0 Interfaces

Dor_Marcovitch — Wed, 13 Jun 2018 12:17:40 GMT

exactly.

Kaspars Zibarts wrote:
I guess you are worried if VSX goes down then you won't be able to reach VS0? Out of band option?

i don't have spare interfaces on the VSX , currently bond1 is my dedicated management interface.

what should be the proccess of moving the ip from bond1 to bond1.10 and adding another interface to vs0 bond1.20 ?

thanks

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Wed, 13 Jun 2018 13:30:13 GMT

In all honesty I don't see it as a big problem having VS0 exposed to internet directly - as long as you have good rulebase and password policy in place

It will be as good as having another firewall in front of it. Minus DDOS - you would be exposed unless you have some external device to protect you from floods.

Re: VSX VS0 Interfaces

Vladimir — Wed, 13 Jun 2018 23:10:21 GMT

Kaspars,

How do you access a VS0 policy post-installation?

I recall being presented with default VSX policy configuration options when converting gateways or clusters to VSX, but cannot figure out where it is hiding once you are operating the unit or cluster.

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Thu, 14 Jun 2018 00:49:29 GMT

Hi Vlad! I'm not entirely sure if I understand your question. VS0 (VSX cluster object) policy is accessible just like any other, from appropriate CMA (in case you use MDM).

I might have misunderstood you

Re: VSX VS0 Interfaces

Vladimir — Thu, 14 Jun 2018 01:16:00 GMT

We may be speaking of different things, but just in case we are not, please verify this:

During initial VSX configuration you have an opportunity to define this policy:

Looking under the VSX Cluster object, you do not see the VS0 (at least I do not see it in the R77.30 demo mode and VSX is not available as an object in R80.10 demo):

So I m not sure how you could specify it as an installation target for the dedicated policy or rules in the common one.

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Thu, 14 Jun 2018 03:16:08 GMT

VSX cluster object is your VS0

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Thu, 14 Jun 2018 03:22:55 GMT

Here's view from command line

and install targets

Re: VSX VS0 Interfaces

Vladimir — Thu, 14 Jun 2018 13:51:17 GMT

That's what I thought, but the initial policy created during installation/conversion is not visible as a stand-alone name policy package.

So you are able to create an additional policy and use cluster object as a target, but where is the policy that was originally created?

If you are to create a new VSX object and look at it via CLI in the context of VS0, what policy will be shown?

Could it be opened and edited?

Re: VSX VS0 Interfaces

Kaspars_Zibarts — Fri, 15 Jun 2018 07:33:09 GMT

If you refer to this one (had to create a test VM just for you as our VSXes were created million years ago..)

and here's the policy it created "testvsx_VSX"

Re: VSX VS0 Interfaces

Vladimir — Fri, 15 Jun 2018 12:23:47 GMT

Thanks! Exactly what i was looking for.

It's just happen to be missing from the Demo Mode in R77.30 and there are no VSX objects in R80.10 Demo, hence the confusion.

Appreciate you going an extra mile to clear the fog