cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Philip_W
Philip_W inside VSX Monday
views 1259 5

rename VSX cluster member

Hi Checkmates,Our customer's wants to upgrade his environment from R77.30 to R80.20.Problem is: he has a VSX cluster with cluster members named 'fw1' and 'fw2'. After importing the SMS database to a new R80.20 management server the Validations tab tells us that "more than one object named fw1 exists" (the other being a default service FW1).Long story short: we have to rename VSX cluster member 'fw1' before we can consider upgrading. In my lab I experimented with vsx_util:- vsx_util add_member to add a Dummy gateway- vsx_util remove_member to remove fw1but this can't be used: "A previous remove member operation did not complete for..." because there is no SIC with the Dummy gateway, which also prevents policy installs to the remaining VSX member.TAC told us to use vsx_provisioning_tool (and to contact Professional Services 🤔), but after reading the documentation and testing some commands I don't see how that would work.Anyone?Ph.
Kaspars_Zibarts
Kaspars_Zibarts inside VSX 2 weeks ago
views 2300 8

VSX upgrade R80.10 to R80.20 - CPUSE or fresh install

Apart from having "fresh slate" and removing old gremlins, are there any other possible reasons to chose fresh install + vsx_util reconfigure over straight CPUSE upgrade on VSX? File system remains the same.. I would prefer simpler approach (CPUSE) unless someone can provide convincing arguments against it 🙂
TheRealDiZ
TheRealDiZ inside VSX 2 weeks ago
views 833 2

Upgrade VSX Cluster from R77.30 to R80.20 with CLEAN INSTALL

Hi Guys, There is a clear SK on how to upgrade VSX from any version to R77.30 : https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101518 Can I use this sk also for R80.20?Is there any specific documents related to it?Did you guys have already tried this procedure with R80.20 (suggestions/tips)? Many many thanks.. in advance! RealD!Z**
Yuvraj_Mehta
inside VSX 2 weeks ago
views 510 2
Employee

Procedure to upgrade a VSX cluster - R77.XX to R80.20

Users can follow the below procedure, in order to upgrade their VSX cluster from R77.XX to R80.20 (VSLS | In-place upgrade with Zero-downtime) Things to discuss A) Management Server i) Pre-Start Tasks ii) Operation vsx_util upgrade B) VSX Upgrade Stand By Member i) Pre-Start Tasks ii) Upgrade (& Install JHF - optional) iii) Verification iv) Connectivity Upgrade C) VSX Upgrade Active Member i) Pre-Start Tasks ii) Upgrade (& Install JHF - optional) iii) Verification D) Recovery Plan A) Management Server i) Pre-Start Tasks 1) Ensure there are no locks on objects relevant to the VSX upgrade and to show the list of all the locked objects in an R80.20 database, let’s open PostgreSQL on MDS cmd line: # $MDS_TEMPLATE/bin/psql_client cpm postgres 2) To see current locks, run: # select objid, name, dlesession, cpmitable, subquery1.lockingsessionid, subquery1.operation FROM dleobjectderef_data, (SELECT lockedobjid, lockingsessionid, operation FROM locknonos) subquery1 WHERE subquery1.lockedobjid = objid and not deleted and dlesession >=0; 3) To exit out of PostgreSQL: (mandatory!) # \q 4) To remove current locks from Smart Console, go to Manage and Settings, view Sessions, locate the columns where "Locks" and "Changes" are not 0, and publish or discard session as required 5) **Take MDS and Firewalls – Snapshot & Backups before proceeding with the operation below. 6) Ensure Serial Console and/or LOM access is available to cluster members during operations. ii) Operation vsx_util Upgrade 1) SSH to Primary MDS > elevate to expert mode 2) mdsenv x.x.x.x (switch to the context of VSX-Master Domain Server) 3) # vsx_util upgrade > enter x.x.x.x for Management Server IP Address , enter admin credentials when prompted! 4) Select Desired VSX Cluster Object Name in numerical list to upgrade 5) Select yes and the desired version to upgrade to and wait for operations to complete on management (all associated virtual objects will be updated in all associated Domains managing virtual objects tied to this VSX cluster) B) VSX Upgrade Stand By Member i) Pre-start Tasks (along with installing a Jumbo Hotfix) 1) Make sure the CPUSE build is up to date, see: sk92449 2) Upload the image to folder /var/log/tmp 3) Upload the Jumbo Hotfix Take_xx on a same/different directory. 4) Compare the MD5sum of packages 5) To import the file to CPUSE repository: > installer import local /var/log/tmp/<>.tgz > installer import local /var/log/tmp/<JHF>.tgz > quit(exit clish) 6) Ensure that the vsls status reflect all VSs in standby state before proceeding with the standby member upgrade (# vsx_util vsls) ii) Upgrade 1) Run cphaprob state to ensure this member is standby and the peer is active 2) On the ssh session to Standby Member Login into clish Run installer upgrade <image number> Gateway will reboot when complete! Jumbo Install (optional) On the ssh session to Standby Member Login into clish. Run installer verify <number of JHF> Run installer verify <# of Take xx>. (Verification should come clean with no conflicts. If not, fix any issues and then re-run this step) Run installer install <# of Take xx> The gateway will automatically reboot when finished. iii) Verification On the ssh session to Upgraded Standby Member Run cphaprob state (should show cluster state as "Ready") After waiting for a minute or two (depending on database size) policy should be installed automatically. Execute an SSH to Primary Member (non-upgraded) Run cphaprob state (should show "Active" or "Active Attention" and upgraded peer as "Down") iv) Commence Connectivity Upgrade Script (Will sync connections for all VSs) Turn off SecureXL On the ssh session to Primary non-upgraded Active Member Elevate to Expert Mode Run vsenv 0 (to ensure you are in the main VSX GW context) Run fwaccel off -a (This will ensure SecureXL and Templates are disabled to ensure delayed connections are synchronized with peer) Run fwaccel stat -a (to verify SecureXL is disabled) On the ssh session to Standby Go to Expert Mode Run cphacu start cphacu will show connection sync status and inform if ready for failover C) VSX Upgrade Active Member i) Pre-start Tasks 1) Make sure the CPUSE build is up to date, see: sk92449 2) Upload the image to folder /var/log/tmp 3) Upload the Jumbo Hotfix Take_xx on the same directory. 4) Compare the MD5sum of packages 5) To import the file to CPUSE repository: > installer import local /var/log/tmp/<>.tgz > installer import local /var/log/tmp/<JHF>.tgz > quit(exit clish) 6) Ensure that the vsls status reflect all VSs in Active state before proceeding with the active member upgrade (# vsx_util vsls) ii) Upgrade 1) Turn off SecureXL Run fwaccel stat -a (to verify SecureXL is disabled) 2) Failover connections to Standby Upgraded Member – R80.20 On the ssh session to Primary non-upgraded Active Member Run cpstop SSH to standby and run cphaprob state (should show its cluster state as active) Run cphacu stat on standby (For connectivity Upgrade status, should show handling connections) Run cphacu stop on standby (to halt the connectivity upgrade process) 3) On the ssh session to Primary Member get into clish Run installer upgrade <Image number> Gateway will reboot when complete 4) Jumbo install (optional) On the ssh session to Standby Member Get into clish. Run installer verify <number of JHF> Run installer verify <# of Take xx>. (Verification should come clean with no conflicts. If not, fix any issues and then re-run this step) Run installer install <# of Takexx> The gateway will automatically reboot when finished. iii) Verification The state should now show up as Active/Standby We do not expect to see any traffic drops. Ensure that the secureXL is turned on at both nodes D) Recovery Plan 1) Restore the snapshots on all servers in question. Alternatively, 2) Management Server: Run mds_restore 3) VSX Servers: Fresh install First-time wizard Run vsx_util reconfigure from MDS
Maik
Maik inside VSX 2 weeks ago
views 1326 5 1

Different DNS server per VS

Hello guys,I'm pretty new when it Comes to VSX deployments and the related VS configuration. I have a quite Basic setup with one VSX cluster consisting out of two physical devices. On top of the VSX cluster we have two VS running (VS #1 and #2). Each VS has two dedicated interfaces. So currently there is not virtual switch or router in place, as there was no need for VS-to-VS communication or shared interfaces.Now to my issue:Basically I just want each VS to use a different DNS server, as per default the DNS config (as well as some other GAiA paramaters) are getting synched from VS0. The issue is, that once a change in clish of VS2 is made (regarding DNS) this is also getting synched to all the other VS (including VS0). So basically I assume that there is not way to have a different dns server entries for each VS...? I found a SK that mentions this problem and offers a solution - but this is only related for the remote access vpn blade and can't be used by any other feature. Without the possibility of configuring one or multiple different dns Servers for each VS I do not see a way to get any updates or the proxy feature working, as the gateway itself needs to send dns queries here.It is also not wanted to have a shared dns in this environment as each VS should work completely independent from the other. So even if I adjust the routing so that VS2 can reach the DNS of VS0 no solution is met.I read the VSX admin guide and could not find any word regarding this issue - so it could be the case that I overlooked something. Hopefully someone can point me in the right direction. 🙂Regards,Maik
Andreas
Andreas inside VSX 2 weeks ago
views 819 1

VSX route propagation with more then one vSwitch

Hi allI have a question to the feature "propagate route to adjacent Virtual Devices".Lets assume we have three external vs: Inbound-vs, Outbound-vs and VPN-vsThis three VS are in a vSwitch sandwich, one vSwitch for the external subnet and one for internal transit LAN leading to internal VS with internal networks.The question is now: How does Check Point decided through which of the two vSwitch traffic is routet from one DMZ to the other? (Random, vs-id, higher ip, ...)In our setup the routes are propagated through the external vSwitch. This works as consequently for all interfaces the external vSwitch is chosen and no asynch routing occurs. From a security point of view and also architectural considerations, this is not the desired path. For example traffic is coming encrpyted over VPN to the VPN-vs and is sent clear text over the external interface to the DMZ of the Outbound-vs. Assuming the two vs are on another physical VSX host, the traffic is sent over a physical switch, which is exposed to the internet. Not so good.Of course, we could disable the feature and manually route through the internal transit vSwitch. As of now, it looks like we have to go that way.Is there a way to force check point to choose the internal vSwitch for the propagated routes?Imho check point should never use an external interface to route traffic. The information, that these interfaces are external is given in the topology. That might be an RFE.What do you think about the topic?
Henry_Poole
Henry_Poole inside VSX 3 weeks ago
views 1157 2

Deleting VSX interfaces from MDS with a script

Hello,Our environment is R80.20 MDS management with Multiple R77.30 VSX gateways. We have a requirement to migrate the current VSX gateways to another fabric. This is a carefully orchestrated change control - however removing the gateways via smart console is a slow clunky task. Compared to none VSX gateways where we can script the usual 'ifconfig ethx.x down' (not supported in VSX) or interface state off in Gaia. The VSX config for interface changes is pushed down from the MDS server in our case, so my question is - Can this configuration be scripted via the API interface? This would make the process much smoother for me and leave much less room for error...
Francois_Beve
inside VSX 3 weeks ago
views 987 1
Employee

how to show connections for VS1 and VS2 using CPViewInsights

Can you let me know how to see the number of connections in each VS, using CPViewInsight ? At this time, we only see the number of connection for VS0
Chris_Phillips
Chris_Phillips inside VSX 2019-05-09
views 995 3

R80.x OSPF routes

Can anyone suggest a reliable and painless way of getting the routing tables from a gateway. I'm specifically interested in getting OSPF routes the gateway has learn't but would like to extend to any and all routes the gateway has learnt from any routing protocols. I'm finding it hard to know which fw to add my rules to if i can't determine which subnets are behind it.TIA
Tarik_Malian
Tarik_Malian inside VSX 2019-05-07
views 819 1

Problem creating virtual switch in VSX R80.20 - CP5900

We have been facing a problem during deploy of a VSX cluster.We are implementing a new VSX cluster with a pair 5900 gateways.Cluster creation seems to be ok, the problem occurs when we try to create a virtual switch: Checking connection with VSXGenerating VSX Configuration for VS-SW on SP2P-IRONGOAT.Pushing VSX Configuration to SP2P-IRONGOAT.SP2P-IRONGOAT-01: processed 14% of configuration...SP2P-IRONGOAT-02: processed 14% of configuration...Operation in progress...SP2P-IRONGOAT-01: VSX configuration was applied successfully.SP2P-IRONGOAT-02: VSX configuration was applied successfully.Virtual Switch Processing Completed SuccessfullyEstablishing Trust with - SP2P-IRONGOAT-01_VS-SW ...The certificate is not valid.Failed to establish trust with SP2P-IRONGOAT-01_VS-SW - Establishing Trust with - SP2P-IRONGOAT-02_VS-SW ...The certificate is not valid.Failed to establish trust with SP2P-IRONGOAT-02_VS-SW -Initiating trust with Virtual Switch operation has finished with warnings....
Antonio
Antonio inside VSX 2019-05-07
views 712 7

VSX routes on vs R80.20 static routes in manager but not in the gateways

Hi people. I have 2 VS in a VSX CLuster. The firstone (VS) works ok, and when I run the #vsx_util view_vs_conf I can see the statics routes was i configured, on the report, and applied in the gateways, the report represent the status vith a "V" in every vsx gateway box. +----------------------------------------------------------+-----+-------------+|Ipv4 Routes |Mgmt |VSX GW(s) |+--------------------------+--------------------+----------+-----+------+------+|Destination / Mask Length |Gateway |Interface | |nvsxgw|nvsxgw|+--------------------------+--------------------+----------+-----+------+------+|10.0.110.0/29 | |eth3 | V | V | V ||10.0.160.0/29 | |eth5 | V | V | V ||192.168.2.0/26 | |wrp128 | V | V | V ||10.100.48.27/32 |10.0.110.1 | | V | V | V ||0.0.0.0/0 |192.168.2.1 | | V | V | V |+--------------------------+--------------------+----------+-----+------+------+ BUt in the secondone, when I run the same report from the Manager, the boxes say me with a "-" the static routes are not present in the gateways.Routing table:+----------------------------------------------------------+-----+-------------+|Ipv4 Routes |Mgmt |VSX GW(s) |+--------------------------+--------------------+----------+-----+------+------+|Destination / Mask Length |Gateway |Interface | |nvsxgw|nvsxgw|+--------------------------+--------------------+----------+-----+------+------+|10.0.16.64/26 | |eth4 | V | V | V ||192.168.2.0/26 | |wrp192 | V | V | V ||10.100.48.27/32 |10.0.16.65 | | V | - | - ||0.0.0.0/0 |192.168.2.1 | | V | V | V |+--------------------------+--------------------+----------+-----+------+------+Routing Table Legend:V - Route exists on the gateway and matches management information (if defined on the management).- - Route does not exist on the gateway. The bahavior is that i have comunication with the first VS, but not to the second, the lastone canot be release it have a configured route with the SmartConsole, on the topology pane. And canot deliver responses to the packets from the internal network. Trying to TS, I was delete the VS, and create again, shutdown the gateways, delete and restore the static routes needed, without expected results. someone have any idea what can i do? thanks a lot for your help.
Marco_Valenti
Marco_Valenti inside VSX 2019-05-07
views 692 3

Vsx backup virtual system settings

Hello fellow check mates Despite the result of the following topic https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/VSX-show-configuration-For-All-Virtual-Systems/m-p/18744#M1430I would like to know how do you backup your vsx gateway with multiple vs created , seems like that the only option valid is snapshot management (won't help in case of hardware fault am I right?) or scheduled backup due to the fact that show configuration save only the configuration of vs0 , if you try to launch the command show configuration from a single vs it does not backup the configuration for the vs Thanks
Uwe_Knoetsch
Uwe_Knoetsch inside VSX 2019-04-30
views 860 3 1

Funny Hide NAT for FW1_ica_services after install Jumbo 189 HF R80.10

Hello,after we install the Jumbo HF 189 on a VSX Gateway Cluster we get problems with central managed SMB Appliances there are connect to a MDM CMA trought this VSX Firewall.We see in the log that packets with service FW1_ics_services are from this moment the firewall hidden by an implicit NAT behind the gateway. But packets with service CDP (TCP/18191) they arn't hide-natted.my Questions: Is this a new special function inside Jumbo HF 189? Has any CheckMates member informations about this new uncomfortable behavior?The god thing is: after we install a no-NAT Rule for the destiantion (the MDM-CMA) all is fine. Regards UweBelow: yellow marked the log before installation jumbo HF 189 (without NAT)
Dave_Hoggan
Dave_Hoggan inside VSX 2019-04-26
views 2315 12

Interface Affinity with VSX

Hi,I've been trying to understand this for a while now, but realised that the more I think I know the answer, the less confident I am! Simply, under VSX, how is interface affinity achieved? For example, on a 23500 how can I assign 4 SNDs to a bond of four 10GB interfaces and individual SNDs to individual 10GB NICs? From reading around, I have become confused and some sources seem to imply that all interfaces are handled by VS0. If that is the case, do I just assign the correct number of CPU cores to VS0 via cpconfig and the use 'sim affinity -s' as normal (in VS0 context). Or have I got it completely wrong?Thanks,Dave
PhoneBoy
inside VSX 2019-04-25
views 2486 7 8
Admin

Running VSX Like a PRO TechTalk and Q&A

In this session, @Jim_MacLeod from Indeni provides some practical advice you can use to ensure your Check Point VSX Security Gateways are running in tip-top shape! Materials: Download Presentation (available to CheckMates members) Watch Full Video (available to CheckMates members) Listen to the audio on SoundCloud (or better yet, subscribe to the podcast feed with RSS, iTunes, Google Play) Preview below: