MDPS - sk138672

[the_rock]

Hey boys and girls,

Just wanted to post this to see if anyone had any experience with it so far and what feedback is. I recall this concept from Palo Alto few years back, but had not seen it on CP side as of yet.

https://support.checkpoint.com/results/sk/sk138672

If anyone has any feedback to share, please be free.

Best,

Andy

[_Val_ · Accepted solution]

We have multiple customers using MDPS. It helps in case the system runs a high CPU, for example. What's the question?

[the_rock]

Thanks for answering Val, appreciated. I did not have really specific question about it, more just to get feedback, though I guess one question I have would be what might be biggest advantage of using this method compared to not using it?

Andy

[Chris_Atkinson · Accepted solution]

Routing & Resource separation would be the usual reasons for turning to MDPS.

[the_rock]

Hey Chris,

Is there good example of that? I mean in a sense of how it would help with routing and resource separation?

Best,

Andy

[Chris_Atkinson · Accepted solution]

Basic / simplified examples:

- Preventing traffic processing consuming all resources of the system resulting in poor management responsiveness 

- Allow separate default routes for the isolated  management network versus production

[the_rock]

Awesome, thanks guys, that helps.

Best,

Andy

[the_rock]

One more question @Chris_Atkinson 

I assume this cant be configured via web UI based on the sk...correct? Appears only via clish?

Andy

[Chris_Atkinson]

CLI only correct, similar to VSX.

Well perhaps that's too much of a generalisation but it's listed in the limitations in any case.

[the_rock]

Thanks mate, always greateful for your help.

Have a nice weekend.

Andy

[Jarvis_Lin]

Will this limitation be fixed in the future?

[the_rock]

What limitation @Jarvis_Lin ?

Andy

[Jarvis_Lin]

setting from command, not from Gaia GUI.

It’s no problem for engineers setting from command, but it’s a big challenge for customers.

[the_rock]

O that, right. I really could not say, maybe best to submit RFE, I suppose.

Andy

[the_rock]

Btw, I checked the sk again and dont see anything about it there either, so as I mentioned, I would submit RFE about it.

[Jarvis_Lin]

Hi Rock,

My English is not good, I checked the sk,

I was referring to the limitations of PMTR-81746, Security groups are not supported for Gaia Portal when MDPS is enabled.

It's hard for customers. If they need to set VLAN or routing.etc.

[the_rock]

Ah, now I got it, sorry. Yes, I can imagine that would be somewhat inconvenient, for sure. I would still submit RFE or maybe comment on the sk or if you can, also message your local SE to see if they can push that further within Check Point internally.

Best,

Andy

[the_rock]

If you click below, it would ask you to submit a feedback and you would get an email about it from skhelp@checkpoint.com

Andy

 

[the_rock]

I mispelled this, but you get an idea, see below, my feedback, exactly what you said essentially.

Andy

 

[Jarvis_Lin]

Thank you, you're such a kind person.

[the_rock]

Thanks man for the kind words. Im just trying to help fellow CP brothers and sisters, thats all 🙂

Andy

[the_rock]

Btw, I got an email again from sk team indicating the sk will be updated once the limitation is fixed. No time frame on it though.

Andy