mgmt interface recommendations

[Daniel_Kavan]

The mgmt interface is for the manager to connect to the gateway correct?

One post recommended against using the MGMT interface for SIC, well I don't specifiy what interface is used for SIC however in the case an INT interface isn't defined yet, obviously the MGMT port would be used.

Also, in a cluster should you cluster your MGMT interface?

Also, you can define your gateways main IP address.  Should you ever define it as your MGMT interface?    Long time ago was always told to use the EXT interface to define the gw so you could ensure routing to it.

[the_rock]

Hey Dan,

Technically you can use any interface to be mgmt one, does not need to be native Mgmt interface on the firewall. Put it this way...if there was, say, eth1-03 defined on the firewall, you could use that as well, no issues.

Some people may use that interface for licensing purpose, even if its not physically connected to anything, which can also work.

[Vincent_Bacher]

Traditionally, the USercenter uses the mgmt interface alongside the serial number to identify a system, regardless of whether it is configured and used or not.

[the_rock]

That is correct Vince, would always list mgmt mac address there.

[Daniel_Kavan]

Yeah, it seems like it's just another interface.  It can be clustered or private.   By marking an interface as MGMT it does NOT mean it will be used for communication with smartconsole.  

[the_rock]

Also, see if below posts help.

https://community.checkpoint.com/t5/General-Topics/Request-for-Advice-Changing-Management-Interface-...

https://community.checkpoint.com/t5/General-Topics/Management-interface-on-gateway/m-p/202338#M33679

[Bob_Zimmerman]

Check Point has two things potentially called the "management interface", and neither has anything to do with SIC.

On branded boxes, one interface has a weird name: Mgmt. The MAC of this interface is used to uniquely identify the box in the User Center for support and licensing. The interface is not special in any other way. Unless you're using VSX, it's in the same routing table as all your other interfaces. I avoid using the interface named Mgmt because people expect it to be separate from the through-traffic interfaces.

On all systems, clish has a line in the configuration "set management-interface _____". This has no impact on how the firewall runs, it's not relevant to SIC, it's just a guardrail to prevent you from deleting the IP address.

SIC is just an application protocol which rides on top of the routing. The traffic will go over whichever interface the firewall's routing table says to use to reach the management, same as trying to ping the management server.

[the_rock]

You got it, makes total sense.

[the_rock]

Hey Dan,

Just curious, is this related to the license, SIC or something else? Or were you more wondering generally speaking?