New! R80.30 feature: Management Data Plane Separation (for gateways with 4+ cores)

[Danny]

I really like the all new R80.30 feature for separating management from data traffic via

• Routing Separation and
• Resource Separation

as described in sk138672.

Did anyone test this already?

[Luis_Miguel_Mig]

Thanks Aviad,
I was wondering if there is any distinction between the  management plane  and the data plane when it comes to cloning groups. You want to share different features in the management and data plane.

[Aviad_Hadarian]

What for example?

[Luis_Miguel_Mig]

For example ip routes: in a ClusterXL environment data plane routes need to be in sync but mgmt plane routes can be different.

[M_Ruszkowski]

Many of you are going to find that your enterprise tools may have issues with this new "mplane" separation.   We have been deploying on all our firewalls and we have issues with our monitoring.  Basically, in order to get the Interface, routes, stats, etc form the "dplane" you need to add an argument "-n dplane" to your monitoring tool so that it pulls from the proper context.   This is simple enough using a snmpwak.  However none of our tools allow for this.   So when you enable this feature you are only going to get L2/L3 data from the mplane.    You really need to test this out in a lab and then try to discover your gateway via one of your monitoring tools before you deploy this.   

[M_Ruszkowski]

I have to say thank you to Aviad. 

We have been working with him and he provided a special Hotfix for R80.40/HFA_156, that has allowed us to move dplane OIDs/MIBs to be proxied via the mplane.  This way our tools work now.  Our tools with SNMPv3 doesn't allow the "-d plane" option.  So this fix was a must.  We are still in EA testing.

After installing the fix we ran these commands to:

/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add .1.3.6.1.2.1.10
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add TCP-MIB
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add UDP-MIB
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add etherStatsTable
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add IP-MIB
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add IF-MIB
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add dot3
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add ifMIB
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add ip
/etc/snmp/vsx-proxy/snmp_vs_do.sh mdps_proxy add rmon

so far so good.

[Nicholas_Moore]

I asked questions about LDAP and TACACS access months ago with no response.  Yes, these should only be available via the management plane and *not* the data plane.  But like I said, I didn't receive any response. 

[azadvinskiy]

Hi Nicholas,

I tested R80.30 JHF 221 in our lab and TACACS traffic goes over Mgmt interface. I believe JHF 221 has a fix for that. Also it looks like you need to make sure confd added to the management plane: add mdps task process confd.

[Luis_Miguel_Mig]

I have tried to implement cloning groups with mgmt/data plane separation and it doesn't work at all. It hangs and keeps tryng to synchronize.
I also had issues with ip spoofing and mgmt/data plane separation. I kept the default ip spoofing configuration for the management interface and all of the sudden my mgmt traffic was blocked. It seems that the ip spoofing configuration is shared between both planes. Shouldn't be independent or even not have any effect in the mgmt plane?

[Aviad_Hadarian]

sk169576

[Luis_Miguel_Mig]

cloning groups is sorted now.
I have noticed that cron runs on the data plane. Can we move it to the mgmt plane? How? I guess it makes more sense, no?

I guess that backups make use of crond, no?

[Luis_Miguel_Mig]

cpview seems to run only in the data plane but the proxy is usually in the mgmt plane. So cpview can't send directly the data to the user centre

[Expert@hqfw2a:0]# mplane
Context set to Management Plane
[Expert@hqfw2a:1]# cpview
Please run on dplane context

[Luis_Miguel_Mig]

I have just tested tacacs on R80.40 take 83 and it works well through the mgmt plane.

[frank_chang]

Has anyone tried to use the Management Data Plane port to create a clusterXL?

I don't know what the IPv4 address of the cluster should be use.

Management Data Plane port same subnet or other?

Can someone help me ?

Thank you.

[Aviad_Hadarian]

Hi @frank_chang , You can fill any IP that you wish, mgmt. port can have VIP like any regular data plane interface.

[Luis_Miguel_Mig]

Hi,0
I have just enabled URL Filtering and I am not able to block anything (only detect) because according to the logs the gateway is failing to reach the OCSP server. I have just noticed some http traffic generated by the gateway going  to the proxy from the data plane.
I see traffic to the proxy server from the control plane and the data plane both. 

Is there anyway to force "url filtering" access to the OCSP server (I guess checkpoint cloud - checkpoint category database) through the management plane? 

[PhoneBoy]

The OSCP server is specified by the site that your users are connecting to and is part of the TLS/SNI verification process.
More precisely, it's part of the certificate.

Don't believe this traffic can be forced over the management plane, it should be permitted by your proxy.

[Luis_Miguel_Mig]

I see...
sqs.us-west-2.amazonaws.com (It may be related with the extension for the conf changes diff) - mgmt plane

and these sites over the data plane:

secureupdates.checkpoint.com
cws.checkpoint.com
ocsp.digicert.com
ocsp.int-x3.letsencrypt.org
productcoverage.checkpoint.com

I guess that it would be nice if all this traffic generated from the gw coud go through through the mgmt plane. Also if not possible, it may be user cases that require two different proxies in both planes.

[Luis_Miguel_Mig]

Not with the OCSP checks resolved I can block categories but I only see a TCP Reset and I don't see any sort of redirect to the usercheck blocked message.

[Aviad_Hadarian]

@Luis_Miguel_Mig 

The solution you described is already under development.

[Luis_Miguel_Mig]

Sorry, which one? My fault for writing two messages so quickly 😉

[Aviad_Hadarian]

first one "I guess that it would be nice if all this traffic generated from the gw coud go through through the mgmt plane. Also if not possible, it may be user cases that require two different proxies in both planes."

[Luis_Miguel_Mig]

so sending all that traffic through the mgmt plane or different proxies in both planes?

[Aviad_Hadarian]

Sending traffic for selected hosts (that can be modified) through the management plane

[Luis_Miguel_Mig]

Same thing with cpd_sched_config. It uses the data plane, but wouldn't it make more sense if it used the mgmt plane?

[Luis_Miguel_Mig]

I have two gateways running mgmt separtion. All of the sudden one of them doesn't respond to the snmp queries with community+_dplane. The other one,  respond to both snmp queries community and community+_dplane as usual.
I wonder what it has gone wrong and how to troubleshoot it.

[Wajdi]

Hello,

I have Checkpoint Appliance with 4 CPUs.

I activated MDPS on the Security Gateway.

Everthing is workin well. But my issue is that the MDPS is taking 2 CPUs out of the 4 CPUs!

Is there a way to disallocate 1 CPU from MDPS and keep only 1?

Thank you for your help.

[_Val_]

Yes, look into sk138672 for more details

[Luis_Miguel_Mig]

How does cpview show how mdps is allocated? I only see the SND/Worker allocation at cpview/cpu.

[Aviad_Hadarian]

@Luis_Miguel_Mig  Under cpview (R80.40 and higher) you will see under "CPU" tab, On the overview/type the purpose of each CPU

[Luis_Miguel_Mig]

This is what I get, but nothing about MDPS

ˇcpview
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CPVIEW.Overview.Host 23Feb2021 11:34:21 |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Overview Top-Protocols Top-Connections Spikes |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Host |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Overview: |
| |
| CPU type CPUs Avg utilization |
| CoreXL_SND 3 0% |
| CoreXL_FW 3 11% |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| CPU: |
| |
| CPU Type User System Idle I/O wait Interrupts |
| 0 CoreXL_SND 0% 0% 100% 0% 3,789 |
| 1 CoreXL_SND 0% 0% 100% 0% 3,789 |
| 2 CoreXL_FW 4% 5% 91% 0% 7,579 |
| 3 CoreXL_SND 0% 1% 100% 0% 3,789 |
| 4 CoreXL_FW 6% 5% 89% 0% 7,580 |
| 5 CoreXL_FW 7% 5% 88% 0% 7,581 |
|