Showing results for 
Search instead for 
Did you mean: 
Create a Post
Enyi_Ajoku inside VSX Wednesday
views 174 4

BGP in VSX in Active/Established State

Hello, I have 3 virtual systems in a cluster of two 15400s running R80.30, i also have VSLS enabled. I have iBGP running between VS5 and VS6 as well as iBGP between VS6 and VS7. I recently noticed that the peer in VS5 shows an established state and VS6 shows an active state. I can confirm that the networks are fine as i can ping both interfaces when i have the VS in the same gateway or split between gateways.After some troubleshooting, i notices that when i do a cpstop and cpstart, VS6 becomes established. I also noticed that its only established for about 24hours before it goes back to active state.Has anyone come across this. Thank You
Christian_Koehl inside VSX Tuesday
views 153 3

Remove interface from VSX systems.

Dear CheckMates,I have running a VSX Cluster with VSLS with some bond interfaces in version R80.20. A couple of VLANs were added to bond1 and in each of my VS systems one of this bond1 VLAN interfaces is used.Now, the bond1 needs to be remove.Therefore, I have deleted the bond1 VLAN interface in every VS and installed the policy within that VS. A "show configuration" still shows the configuration for all the bond1 VLAN interfaces."vsx_utill show_interfaces" did't show them.How to remove the configuration for the bond1 interface completly?Best regards,Christian
CPRQ inside VSX Monday
views 229 2

double vlan IP addresses

We are on R80.20 on VSX platform.when we add a new vlan with specific IP 10.x.x.x it also automatically assigned a new IP 192.168.x.x to same vlan as shown below.What is the purpose of those IPs 192.168.x.x ?Also when firewall try to resolve DNS, why it use source IP those 192.168.x.x. addresses Not real IP (10.x.x.x) assigned to vlan .How firewall can use its real IP 10.x.x.x as a source IP to resolve DNS?1> show interface bond0.300ipv4-address> show interface bond0.301ipv4-address> show interface bond0.302ipv4-address interface bond0.300 state onset interface bond0.300 mtu 1500set interface bond0.300 ipv4-address mask-length 28set interface bond0.301 state onset interface bond0.301 mtu 1500set interface bond0.301 ipv4-address mask-length 28set interface bond0.302 state onset interface bond0.302 mtu 1500set interface bond0.302 ipv4-address mask-length 28
Moe_89 inside VSX a week ago
views 197 4

Migrating VSX R77.20 to R80.30

Hi,We will be migrating to new CheckPoint appliances from existing VSX setup running on R77.20, SMS & 12000 cluster with 20 VS to R80.30, SMS & 23500 cluster.I am trying to migrate the setup in the lab using R80.30 migration tools to export/import the database.After importing the database, establishing SIC with the gateways and vsx_util upgrade to R80.30i am getting an "internal error" when pushing VSX configuration from dashboard.What could be the issue here. Is migrate export/import not supported for VSX migration ?
Firewallteam_DE inside VSX 2 weeks ago
views 195 1

What "set vsx on/off" actually does under hood?

Hello GuysI am having trouble finding what does turning on/off vsx mode does to firewall cluster. I have 2 members fully configured in cluster VSLS mode, running coreXL, few virtual-systems on it and soon in production. In many guides theres suggestion to turn off vsx mode before applying some commands which otherwise cannot be accepted. I only understand that vsx mode is "interface and routes configuration protection". But is there anything beyond human factor protection in CLI? Subsequently, I have this problem:automatic affinity on one cluster member is working fine, and it doesn't on another:A:eth1-01 : 8eth1-02 : 8eth1-03 : 0eth1-04 : 8eth2-01 : 0eth2-04 : 8eth2-05 : 0eth2-08 : 8eth3-01 : 0eth3-02 : 0 B:eth1-01 : 0eth1-02 : 0eth1-03 : 0eth1-04 : 0eth2-01 : 0eth2-04 : 0eth2-05 : 0eth2-08 : 0eth3-01 : 0eth3-02 : 0some CP article suggests checking "fw ctl multik get_mode" to see if dynamic dispatcher is on, but this command cannot be run in vsx mode:Option not supported in VSX mode.Edit: (there are 2 cores for vs:0 in my setup) after restarting and re-entering default affinity mode (automatic) all interfaces are assigned core 0 (I expected even distribution between cores 0, 8). There is no traffic passing interfaces yet.Thank youTomas
FedericoMeiners inside VSX 3 weeks ago
views 233 2

To configure or not: Management Plane over VSX

Hello Check MatesI wanted to invite you to think about implementing the management plane introduced in R80.30 in a VSX gateway.I'm really eager to implement this functionality described in sk138672. By reading this I cannot help myself to not think about VS0 in VSX.VS0 is the main "connection" and management point for VSX, it has their own cores if you want it to, own routes, policies and it's logically separated.Is there something that I'm missing? Maybe some additional improvements that work on user space / kernel space? I really want to know more but for the moment there is not much information. From my point of view it's an amazing feature to implement in regular gateways.Thanks in advance 🙂Federico____
naren_nd inside VSX 4 weeks ago
views 219 6

Virtual FW on 15400 appliance_urgent help needed

Business asked me to implement a single virtual firewall on Checkpoint 15400 appliance as per the attached network topology. The idea is to achieve end-to-end secure connectivity for O365 applications. In future, there will be additional virtual firewalls on the existing VSX and another VSX gateway for achieving HA. But as of now, only one virtual firewall. I have the following concerns and do not have clarity whether it can be done or not. Appreciate if someone can throw some light. 1> Can I connect two physical ports from the Nexus 9000 switch (ACI switch) to the VSX gateway in bond?2> Can I configure virtual firewall’s external segment in layer 3 and the internal segment as layer-2? As per the network topology, the virtual firewall running at DC will be connected to HQ over the point-to-point layer-2 link.3> Does virtual firewall support IP sec VPN over Layer 2 point-to-point link (DC to HQ)?4> Does virtual FW support dynamic routing if IP Sec VPN configured? What are the pros and cons?5> your views and best practice around FW participating in the end-to-end BGP routing? Is any performance impact if BGP runs on Virtual FW?6> While creating a virtual system on single VSX member, should I create virtual switch or router because the virtual firewall will be using a BGP routing protocol7> Does Checkpoint FW support VPC between Nexus 9k switches and virtual FW to form Link Aggregation?8> Do FW shape the traffic when it passes the traffic from its 10 Gbps interface to 1 Gbps layer 2 links?
Vladimir inside VSX 4 weeks ago
views 5293 14

ARP table size increase is not surviving the reboot

Has anyone run in to it after the upgrade to R80.20?
pandersson inside VSX 4 weeks ago
views 197 5

Failed to find any routes on the machine

Hello. I get this message when trying to create a VSX cluster "Error: Failed to find any routes on the machine".The information in sk144832 does not help, as there are no aliases.Neither does sk92556, which happens if I just try to add one singlenode(Failed to resolve Management Virtual System NIC).Boxes are new out of the box, and have almost no configuration at all.Mainly ip-address and default route, and one additionas I added for testing.I had a couple of bonds, but removed them to see if it made a difference.Does anybody know what to do with this ?(I will ask CheckPoint as soon as support contract is activated)/Per 
Alex_Gilis inside VSX a month ago
views 268 5

Issue with 12000, VSX, VSWITCH & R80.30

I will open a case for this but I wonder if someone has seen this already.I upgraded a 12600 VSX cluster from R80.20 Take 47 to R80.30. All went well but there was a strange issue afterwards.Two VS talk to each other via a "front" VSWITCH used for inter-VS communication. These VS also have "back" VSWITCH for the networks which are located behind them. I'd rather use tagged interfaces but it's another story and there's a reason why they're present.After upgrade to Take 19, some traffic never makes it through a backend LAN on VS-A to the backend of VS-B. In Smart Console, the traffic is seen as accepted. With fw monitor, the traffic is seen but stays in the "i" part on VS-B.The weird thing is that only specific protocols didn't go through, for the other ones we could see the full "iI-oO" and they worked normally. Failing protocols were RDP & HTTPS, but maybe there were others (no HTTPS inspection blade runs on any of the VS, and this is internal traffic only).Now the interesting bit: uninstalling Take 19 actually solves the issue. We tried with the second cluster member which exhibited the exact same behaviour: OK with R80.30.0, fails with R80.30.19.We're now in full production on both systems with R80.30 and no Take. I guess I will need to replicate issue with TAC but it's challenging as we need to install the Take on a production system and take live traces which isn't always easy to arrange, so I thought I'd check if anyone here would have seen that kind of behavior and had an idea.The chassis themselves are all OK in terms of CPU, RAM, I/O and so on so I think it's really a software issue.
Maik inside VSX a month ago
views 229 6

VSX on open server deployments

Hey guys, Just a small question, out of curiosity. Is it possible to set up an open server as a VSX installation? Also if it works theoretically, has anyone ever done this? I could imagine that some sort of issues could come up with such a deployment.Yes - it does not really makes sense in a productive way. I am thinking about lab environments in order to get more hands on experience with VSX (+ maybe MDM). Currently I don't have a lab up and running where I could verify this. Searching the web also did not help me to find the answer. Best regards,Maik
Tom_Hallberg inside VSX a month ago
views 133 4

affinity vsx 15600 r80.20

Hi There are 32 CPU's without HT enabled on a 15600.I have done the following with sim affinity -s:eth3-01: CPU 2eth3-02: CPU 5eth3-03: CPU 6eth3-04: CPU 0eth1-01: CPU 1eth2-01: CPU 3eth2-02: CPU 4And with fw ctl affinity -d -s -fwkall 25 I was hopping to get all VS to share CPU 7-31, but the outcome was the following:VS_0 fwk: CPU 4 5 6 7 8 9 10 11 12 13 14 15 19 20 21 22 23 24 25 26 27 28 29 30 31VS_1 fwk: CPU 4 5 6 7 8 9 10 11 12 13 14 15 19 20 21 22 23 24 25 26 27 28 29 30 31So what happend with cpu 16-18 😞MQ aint enabled, but I was thinking if MQ are enabled on onboard interfacescpmq getActive mlx5_core interfaces:eth2-01 [Off]eth2-02 [Off]Active ixgbe interfaces:eth1-01 [Off]eth3-01 [Off]eth3-02 [Off]eth3-03 [Off]eth3-04 [Off] What am I missing? I can ofcource manually set with fw ctl affinity -d -s -vsid and so on.. but then if I add a new VS I need to manually fix the affinity for that one.   
FedericoMeiners inside VSX 2019-09-16
views 301 7

Question: Max number of Virtual Systems per VSX

Hello everyone,Hope you doing well, I'm designing an architecture to support more than 50 virtual systems with the available resource from a customer.Deployment Distributed deployment with R80.30 (SMS and gateways) - 2 appliances to create an active/passive VSX Cluster, each VS will have their own separate interfaces.One of the things that I'm facing going through all the documentation of VSX to verify the deployment feasibility is the max number of virtual systems per VSX. The main limitation that I found is detailed in sk99121 due to the internal communication network.By default the ICN ( supports a max number of 62 virtual systems with a maximum of 64 interfaces per VS, things get tricky if you have a number VS with more than 64 interfaces:The limit of VS descends to 30 and then 15 if you need between 128 and 265 interfaces per VS. As far as I can see, this limitation is inherent to how VSX works.I've been through the admin guide and many SKs but couldn't find a way to overpass this limitation. I though about using IPv6 only in the internal communication network but there's no enough information for this.Are my assumptions correct here? Maybe there is something that I'm missing. How do you deal with a large scale VSX deployment in this case? Maybe the only way is to create different VSX gateways/clusters.Thank you in advance! 
HS inside VSX 2019-09-13
views 129 1

Add proxy arp entries on R80.20 VSX

Hi,we will migrate security gateway from R77.30 to R80.20 in VSX. We have some proxy arp entries on our gateway but in R80.20 there don't use "/opt/CPsuite-R77/fw1/CTX/CTX00001/conf/local.arp" file. How we add the entries without the local.arp file? Now it is kernel based .
Senthil-Krishna inside VSX 2019-09-06
views 165 3

Spinning up Virtual on 5400/5600 - Licensing and Resource Allocation.

Hi, I am considering replacing couple of 4400's with 5400s/5600's.  Keen to create virtual route domains on the appliance/cluster to help improve on the design. (Vsys?)I believe the platform itself supports upto 20 virtuals but not able to establishing licensing or resource allocation methods/process . Appreciate if you could help.Regards.