Firewall Instances

[josrime]

Hi everybody!

Can a Check Point Appliance support virtualization of Firewall instances?

[Chris_Atkinson · Accepted solution]

Yes we call it VSX and needs a specific license based on the number of Virtual Systems to be deployed.

Admin guide:

https://downloads.checkpoint.com/dc/download.htm?ID=103853

[the_rock]

Chris is right and for your reference below:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_VSX_AdminGuide/Topics-VSXG/Introdu...

Andy

[Bob_Zimmerman · Accepted solution]

One important thing to be aware of: VSX is VRFs (technically network namespaces). It doesn't run a bunch of firewall virtual machines. It's all one OS, one software version, one filesystem. When you upgrade, the whole box is upgraded at once. This is the same as Fortinet vdoms, Palo Alto vsys, and so on, but if you're coming from the virtualization world, it is emphatically not VMs.

This means that maintenance windows and outages affect every VS on the box or cluster. This isn't necessarily a problem, just something to include in your availability planning. If you don't, it's really easy to get yourself into a situation where you can't ever risk an outage for an upgrade.

If you want to implement VSX, ask around for issues people have hit and things they wish they had done if they could start over. My big one is interfaces. Only ever let VSX know about bonds. It cares a lot about the names of the interfaces it uses, which makes hardware swaps more complicated (the names don't always line up). By only letting VSX use bonds, you can change which physical interfaces are a part of the bond much more easily.

If you're talking about real VMs, you can run Check Point's software in a VM, for example on your ESXi farm. That has nothing to do with appliances.