- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Experiences in Gateway on VMware
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Experiences in Gateway on VMware
Hi,
I wasn't able to find a matching board entry, so I'm creating one here. I'm in need for your experience.
My company has everything virtualized. Only the Checkpoint Security Gateway is not. Now we are discussing the possible virtualization of this machine.
Has anybody experience with this solution? I'm currently torn. Does this method have enouth performance?
Currently we're using an OpenServer with multible VLANs on a Bond and 2 Core licensing.
Hopefully somebody out there has some experience since our reseller has none.
Thank you,
Stephan Kögler
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Security Gateway on VMWare works, We run dozens that way.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For your gateway VMs, I'd suggest creating the interfaces with interface type vxmnet3 (which supports Multi-Queue) instead of the standard e1000.
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tim, doesnt Cloudguard Vsec for vmware running R81 preinstalled with vmxnet3? Those that I spinned up in vCenter already had this config. Though I am wondering why it detects a 10G network adapter and not just unlimited link speed.
Do you have any recommend performance ideas? With 4 cores vsec I can with ngfw get almost 3.6gbps when testing with iperf with 1 mb data package over 1 hour.
Kim
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes it should use vmxnet3, but I have seen some VMWare implementations that still default to e1000 for some reason. Just something to check.
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Throughput is fine. Latency is maybe 10x higher, but that's going from tens of microseconds to hundreds of microseconds. Not really a noticeable difference in most situations. With VT-D, you can hand a whole PCIe card directly to a VM. In that case, latency is still higher than on dedicated hardware, but less so. Virtualization costs a lot of I/O latency.
The larger concern is the failure domain. If your VM environment goes down (e.g., your datacenter loses power and all hosts need to come up from scratch), do you need that firewall working to be able to get tech support and/or recover? With virtualization, it's entirely possible to set up your environment in such a way that it's impossible to recover from a full outage.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have sold Check Point gateways in VMware and public clouds for years.
In the past, the solution went by such names a VE (Virtual Edition), vSEC, and CloudGuard IaaS.
Currently, it is called CloudGuard Network Security.
We even have spaces for it on CheckMates 🙂
Your existing Open Server licenses should work with virtualized gateways, though we sell specific licenses for it now.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you all for your insights.
I'll follow this solution further.
