Nano Agent / Nano Services in Quantum SD-WAN: the Control Plane

[WiliRGasparetto]

If you use Quantum SD-WAN in the Infinity Portal, the Nano Agent is the component that turns your gateway into a cloud-managed enforcement point: it receives policy, applies Nano services, and sends telemetry back to the portal. Without it, SD-WAN becomes “local config + hope.” (And that’s usually where troubleshooting starts.)

---

1) What is the Nano Agent?

The Nano Agent is a lightweight agent installed on the Security Gateway / Cluster Member that “hosts” and manages Nano Services. In SD-WAN, it is the mechanism for:

• installing/updating SD-WAN policy on the gateway,

• orchestrating the services required for SD-WAN,

• sending events and metrics to the Infinity Portal.

In practice: you install it using a command/script generated in the portal, and from that point on the gateway has a control channel for SD-WAN.
The SD-WAN guide itself lists the Nano Agent as a required workflow item (“on the gateway… SD-WAN interfaces and the Nano Agent”). (sc1.checkpoint.com)

 

2) Fog + iNext: separating control plane vs data plane (Slide 2)

A mental model that avoids 80% of errors:

Data plane

• User traffic (Internet/Overlay/Backhaul) flows over WAN links, VPN, etc.

Control plane (Nano)

• The Nano Agent communicates with the cloud (Fog/iNext), downloads policy, reports state/events, and receives updates.

Your slide captures it well: Fog acts as a mediator between iNext and the agent, transporting policy and collecting gateway information.

Text diagram (flow):
Infinity Portal (SD-WAN app) → iNext/Fog (cloud control) → Nano Agent (GW) → Nano Services (SD-WAN, Logger, Metric Provider)
GW → (events/metrics/status) → Nano Agent → Fog/iNext → Infinity Portal

 

3) “The first command of your life”: cpnano -s

When something “disappears” in the portal or a policy does not install, the first t-shoot step is:

• cpnano -s → shows detailed status of the Nano Agent and Nano Services (versions, last update, registration, etc.)

This becomes your baseline: before hunting for an “SD-WAN bug,” validate connectivity, registration, and service health.

4) Which Nano Services are involved in SD-WAN

In SD-WAN, you typically see:

• Orchestration Nano Service (baseline, not SD-WAN exclusive)

• SD-WAN Nano Service

• SD-WAN Logger Nano Service

• Cpview Metric Provider

The logic is simple: the orchestrator ensures the other services are present, updated, and running with the correct policy.

5) Orchestration Nano Service: the “systemd” of the Nano world

Think of it as the orchestrator that:

• polls cloud control for updates/policy,

• downloads policy and distributes it to the relevant Nano services,

• reports status, versions, and health back to Fog/iNext.

In SD-WAN, when there is applicable policy for a gateway, the orchestrator triggers the flow to download/update services and their artifacts (SD-WAN/Logger/Metric Provider).

 

6) Orchestration t-shoot: logs and communication debugging

If the gateway does not “update” or the portal does not reflect status, focus on the control plane.

Logs

• /var/log/nano_agent/cp-nano-orchestration.log

• /var/log/nano_agent/cp-nano-orchestration.dbg

The main Nano Agent orchestration log is referenced in official documentation (in other Nano contexts, but the file and pattern are consistent). (sc1.checkpoint.com)

Debug/trace (for communication and HTTP)

• cpnano -d --add --flags D_COMMUNICATION=Trace

• cpnano -d --add --flags D_HTTP_REQUEST=Trace

• rollback: cpnano -d -default

What I look for in the .dbg (time-saving order)

1. DNS resolution / outbound route / proxy (if any)

2. TLS/handshake errors, HTTP codes, timeouts

3. Token/registration state (agent “registered” vs “pending”/“disconnected”)

4. “policy fetched” vs “policy applied” (these are different states!)

 

7) SD-WAN Nano Service: where SD-WAN becomes “real” on the gateway

Gateway Sharing and local policy updates:

• collects/updates VPN peer data and local SD-WAN configuration (next hop, ISP, etc.)

• sends updates to the cloud backend (Fog) when something changes

• applies local SD-WAN policy when a relevant change occurs (peers / topology / link attributes)

Practical point: when gateway sharing does not converge, you get “policy in the portal” but inconsistent state across sites.

---

8) Where to validate policy “for real”: sdwan_steering_policy.json

This file is one of the best local validation points:

• $FWDIR/state/local/SDWAN/sdwan_steering_policy.json

The Quantum SD-WAN guide explicitly references this file for inspecting parameters such as Circuit ID and peer/link details. (sc1.checkpoint.com)

Useful sections (from your slide)

• sdwan_steering_vpn_peers

• sdwan_steering_vpn_local

Objective t-shoot
“What the portal thinks I am” vs “what the installed policy says I am.”
If they diverge, it’s not a “link problem”: it’s policy propagation / install / parsing.

---

9) SD-WAN t-shoot: logs and policy-focused debug

When the pain is “policy does not install” / “steering does not happen”:

Logs

• /var/log/nano_agent/cp-nano-sdwan.log

• /var/log/nano_agent/cp-nano-sdwan.dbg

SD-WAN policy trace

• cpnano -d --add --flags D_SDWAN_POLICY=Trace

• rollback (as in the slide): cpnano -d --add --flags D_SDWAN_POLICY=Error

Practical checklist (my sequence)

1. cpnano -s → is the SD-WAN service Running? Which version/policy?

2. Check whether sdwan_steering_policy.json changed after publish/install.

3. Validate whether traffic matches the correct SD-WAN rule (breakout/overlay/backhaul). There are scenarios where traffic matches breakout and disables overlay encryption (documented in troubleshooting). (sc1.checkpoint.com)

4. Validate health-checks/probing (latency/jitter/loss) and whether links are eligible per thresholds (SD-WAN decisions are based on this). (sc1.checkpoint.com)

---

10) SD-WAN Logger Nano Service: why the portal “doesn’t show events”

The SD-WAN Logger is the event pipeline:

• receives events from SD-WAN steering (link swap, ISP status, etc.)

• receives events from the CPSDWAN process (enablement, policy installation events, …)

• sends them to Fog → iNext → and finally the Infinity Portal displays them

Classic symptom: steering works locally, but the portal looks “blind.”
Primary suspects: logger stopped, delivery backlog, or control-plane issues (orchestration/HTTP).

---

Troubleshooting Blueprint in 7 layers (save this)

1. Portal/Profile: is the gateway in the right profile? is policy published? (Infinity Portal) (sc1.checkpoint.com)

2. Nano health: cpnano -s (registered? last update? services running?)

3. Cloud connectivity: route/DNS/proxy/SSL inspection on the outbound path (top “silent” root cause)

4. Orchestration logs: cp-nano-orchestration.log/.dbg (HTTP/TLS/timeouts) (sc1.checkpoint.com)

5. SD-WAN policy install: SD-WAN logs + sdwan_steering_policy.json (sc1.checkpoint.com)

6. Rule/behavior match: breakout vs overlay vs backhaul (avoids wrong diagnosis) (sc1.checkpoint.com)

7. Telemetry/events: logger + portal (if “it works but doesn’t show,” the issue is observability/pipeline)

[the_rock]

Amazing...thanks for that @WiliRGasparetto 

[WiliRGasparetto]

Thank you so much Andy, coming from someone I admire very much, it means a lot.

[the_rock]

Thanks brother, truly appreciate that! I dont think anyone ever said that for me, and if they did, they must have been drunk OR high...or both 😂😂

[WiliRGasparetto]

Not at all, Andy is an example for all of us.

[the_rock]

Thanks man, really, really appreciate all your comments. I always try to do my best to help, thats all. Hey, FWIW, here is what MS copilot AI gave about this sibjects. Thoughts? : -)

*********************************

Nano Agent & Nano Services in Check Point Quantum SD‑WAN (Infinity Portal)

In Quantum SD‑WAN, the Nano Agent is essentially the cloud control-plane component that turns a Security Gateway (or cluster member) into a cloud-managed enforcement point: it receives SD‑WAN policy, runs/hosts the Nano Services that implement SD‑WAN functions, and sends telemetry/events back to the Infinity Portal. [community….kpoint.com]

---

1) What is the Nano Agent?

Think of the Nano Agent as a lightweight runtime on the gateway that:

• Registers the gateway to the Infinity Portal using a token (so the portal can manage it). [sc1.checkpoint.com]
• Downloads and applies SD‑WAN policy (steering behaviors, link mapping, etc.) pushed from the portal. [community….kpoint.com]
• Hosts and supervises “Nano Services”—modular services that implement SD‑WAN and observability functions (logging, metrics, etc.). [community….kpoint.com], [sc1.checkpoint.com]
• Reports health/telemetry/events (link swaps, status, policy versions) back to Infinity Portal dashboards. [community….kpoint.com]

A useful mental model is:

• Data plane: actual user traffic flowing over WAN links/VPN/overlays
• Control plane (Nano): Nano Agent ↔ cloud backend to fetch policy, report state, update services [community….kpoint.com]

---

2) What are Nano Services (in SD‑WAN context)?

Nano Services are the modular processes that run under the Nano Agent. The SD‑WAN admin documentation explicitly calls out the core set you should see in a healthy deployment (Status: Running) when you check Nano status. [sc1.checkpoint.com]

Common Nano Services you’ll encounter for Quantum SD‑WAN

From the SD‑WAN admin guide (and typical deployments), expect these services: [sc1.checkpoint.com]

• Check Point Orchestration Nano Service – service lifecycle / orchestration (updates, policy distribution, health reporting). [community….kpoint.com], [sc1.checkpoint.com]
• Check Point Messaging Proxy Nano Service – messaging/control communication support used by the Nano framework. [sc1.checkpoint.com]
• Check Point SDWan Nano Service – the SD‑WAN “engine” that turns portal policy into local SD‑WAN behavior on the gateway. [community….kpoint.com], [sc1.checkpoint.com]
• Check Point Cpview Metric Provider Nano Service – feeds metrics/telemetry used for monitoring and dashboards. [community….kpoint.com], [sc1.checkpoint.com]
• Check Point SD‑WAN Logger Nano Service – collects SD‑WAN events/logs and ships them to the cloud so the portal can display them. [community….kpoint.com], [sc1.checkpoint.com]

Broader context: Check Point describes “Nano‑Agents” as a platform concept where Nano Services and attachments are the building blocks that can be used across environments. [github.com]

---

3) Where Nano fits in the Quantum SD‑WAN architecture

A simplified flow (conceptually consistent with Check Point’s SD‑WAN control plane explanation): [community….kpoint.com]

Infinity Portal (SD‑WAN app)
→ Cloud backend (iNext/Fog)
→ Nano Agent on Gateway
→ Nano Services (SDWan, Logger, Metrics, Orchestration, …)
→ (telemetry/events/status) back through Nano Agent to cloud/portal [community….kpoint.com]

Why this matters: If your SD‑WAN “looks configured” in the portal but doesn’t behave on the wire, the issue is often control-plane propagation (agent registration, service health, connectivity, policy install) rather than raw routing. [community….kpoint.com]

---

4) Installation & onboarding (what you actually do)

Install Nano Agent (token-based)

The SD‑WAN admin guide shows Nano Agent installation via nano-egg using the authentication token from your Quantum Profile in Infinity Portal. [sc1.checkpoint.com]

Example shown in the guide (Maestro/SG context):

• nano-egg --install --token <Authentication Token> ... [sc1.checkpoint.com]

---

5) Day‑2 operations: health checks & troubleshooting

The “first command” to check: cpnano -s

A recurring best practice in Quantum SD‑WAN troubleshooting is to run:

• cpnano -s to see Nano Agent/Nano Service status, versions, registration, and update state. [community….kpoint.com], [sc1.checkpoint.com]

The SD‑WAN admin guide explicitly says you should verify required Nano Services are Status: Running in the cpnano -s output. [sc1.checkpoint.com]

Common log locations & debug flags

Operational troubleshooting often centers on the Nano control-plane logs and (when needed) enabling targeted debug flags. Example log locations and debug approach are described in the Check Point community post: [community….kpoint.com]

• Orchestration logs under /var/log/nano_agent/ (e.g., orchestration log/dbg) [community….kpoint.com]
• SD‑WAN Nano service logs under /var/log/nano_agent/ (e.g., sdwan log/dbg) [community….kpoint.com]
• Debug flags for communication/HTTP/policy tracing using cpnano -d ... [community….kpoint.com]

When the portal is “blind” (no events/metrics)

A classic symptom described is: steering works locally, but the Infinity Portal shows no SD‑WAN events. In that case, focus on the SD‑WAN Logger Nano Service and upstream control-plane connectivity (orchestration/HTTP). [community….kpoint.com]

---

6) Practical checklist (fast triage)

If SD‑WAN isn’t behaving as expected, a pragmatic sequence is:

1. Agent registration & service health: cpnano -s (all required services Running). [community….kpoint.com], [sc1.checkpoint.com]
2. Control-plane connectivity (DNS/route/proxy/TLS issues between gateway and cloud) because policy/telemetry depends on it. [community….kpoint.com]
3. Orchestration logs to see fetch/apply cycles and failures. [community….kpoint.com]
4. SD‑WAN service logs for steering/policy-related issues. [community….kpoint.com]
5. Portal alignment: correct profile, published policy, gateway appears under Agents. [community….kpoint.com], [sc1.checkpoint.com]

---

Quick “plain English” summary

• Nano Agent = “the SD‑WAN cloud management/control-plane endpoint on the gateway.” [community….kpoint.com]
• Nano Services = “the modular processes the agent runs (SD‑WAN engine, logging, metrics, orchestration, messaging proxy).” [sc1.checkpoint.com], [community….kpoint.com]
• cpnano -s = the first place you look when things don’t install/show up. [community….kpoint.com], [sc1.checkpoint.com]

---

A couple of questions so I can tailor this to your environment

1. Are you running standalone gateways, a cluster, or Maestro with Security Group members? (Nano behavior differs a bit operationally.) [sc1.checkpoint.com]
2. Are you troubleshooting policy not installing, steering not occurring, or portal dashboards/events missing? [community….kpoint.com]

[WiliRGasparetto]

I found Copilot’s comments very interesting.

[the_rock]

I feel it compiles everything it can find from smartest people out there and breaks it down in sections, so it looks presentable. O well, it is AI at the end of the day lol

[WiliRGasparetto]

Yes, I definitely need to start summarizing my materials with AI, but I don't really like putting too much information in them because I don't know how the data presented there is actually handled.

[the_rock]

I feel it would be literally impossible these days to keep all that data fully protected...just my 2 cents.

[WiliRGasparetto]

I completely agree with you; nowadays we no longer have a choice of whether or not to use our data and whether or not to be exposed to AI.

[the_rock]

100%...thats what data brokers do.

[Amit_Navon]

@WiliRGasparetto @the_rock Guys, get ready in R82.20 we re-design SD-WAN management. 

We will merge it into Smart-1, the nano agent will not be used.

BR,

Amit

[the_rock]

Looking forward to it!

[Amit_Navon]

@the_rock  We will soon start with EA invitations.

[the_rock]

Good news. Will there be free demo customers can get access to?

[Amit_Navon]

Will check the feasibility with the training team and update as part of the EA

Amit 

[the_rock]

Thanks a lot!

[WiliRGasparetto]

If you want and need beta testers, I would very much like to help you.

[WiliRGasparetto]

Very good, another thing I saw about the R82.20 is that it will also accept CGNAT, which will help a lot.

[Amit_Navon]

You can try it now @WiliRGasparetto . CG-NAT phase one is already available as EA and will be GA on the next JHF of R82.10:

SD-WAN VPN peers behind CGNAT Multi interfaces modes behind ISP router 

I asked R&D to create a detailed SK 

Amit

[WiliRGasparetto]

Very good. If possible, once this SK is published and you are able to share it with us, it would be great for us to review it and also pass it along to our customers.

[the_rock]

Excellent idea.

[PhoneBoy]

Pretty comprehensive write-up.

[WiliRGasparetto]

thank you very much

[Dom_Galvao]

Thank you Very mucho for the content

[WiliRGasparetto]

thank you very much Dom

[Roticer138659]

Great breakdown of the Nano Agent and services. 

[WiliRGasparetto]

thank you very much

[N3rg4l]

well done