Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
josrime
Explorer
Jump to solution

Firewall Instances

Hi everybody!

Can a Check Point Appliance support virtualization of Firewall instances?

 

 

0 Kudos
2 Solutions

Accepted Solutions
Chris_Atkinson
Employee Employee
Employee

Yes we call it VSX and needs a specific license based on the number of Virtual Systems to be deployed.

Admin guide:

https://downloads.checkpoint.com/dc/download.htm?ID=103853

 

CCSM R77/R80/ELITE

View solution in original post

Bob_Zimmerman
Authority
Authority

One important thing to be aware of: VSX is VRFs (technically network namespaces). It doesn't run a bunch of firewall virtual machines. It's all one OS, one software version, one filesystem. When you upgrade, the whole box is upgraded at once. This is the same as Fortinet vdoms, Palo Alto vsys, and so on, but if you're coming from the virtualization world, it is emphatically not VMs.

This means that maintenance windows and outages affect every VS on the box or cluster. This isn't necessarily a problem, just something to include in your availability planning. If you don't, it's really easy to get yourself into a situation where you can't ever risk an outage for an upgrade.

If you want to implement VSX, ask around for issues people have hit and things they wish they had done if they could start over. My big one is interfaces. Only ever let VSX know about bonds. It cares a lot about the names of the interfaces it uses, which makes hardware swaps more complicated (the names don't always line up). By only letting VSX use bonds, you can change which physical interfaces are a part of the bond much more easily.

 

If you're talking about real VMs, you can run Check Point's software in a VM, for example on your ESXi farm. That has nothing to do with appliances.

View solution in original post

3 Replies
Chris_Atkinson
Employee Employee
Employee

Yes we call it VSX and needs a specific license based on the number of Virtual Systems to be deployed.

Admin guide:

https://downloads.checkpoint.com/dc/download.htm?ID=103853

 

CCSM R77/R80/ELITE
the_rock
Legend
Legend
0 Kudos
Bob_Zimmerman
Authority
Authority

One important thing to be aware of: VSX is VRFs (technically network namespaces). It doesn't run a bunch of firewall virtual machines. It's all one OS, one software version, one filesystem. When you upgrade, the whole box is upgraded at once. This is the same as Fortinet vdoms, Palo Alto vsys, and so on, but if you're coming from the virtualization world, it is emphatically not VMs.

This means that maintenance windows and outages affect every VS on the box or cluster. This isn't necessarily a problem, just something to include in your availability planning. If you don't, it's really easy to get yourself into a situation where you can't ever risk an outage for an upgrade.

If you want to implement VSX, ask around for issues people have hit and things they wish they had done if they could start over. My big one is interfaces. Only ever let VSX know about bonds. It cares a lot about the names of the interfaces it uses, which makes hardware swaps more complicated (the names don't always line up). By only letting VSX use bonds, you can change which physical interfaces are a part of the bond much more easily.

 

If you're talking about real VMs, you can run Check Point's software in a VM, for example on your ESXi farm. That has nothing to do with appliances.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events