CPUSE Requirements

License and Contract File

  • Valid license must be installed on the target Gaia server.

  • Valid Software Subscription or Technical Support Contract must be associated with the license.

  • The Contract File must be installed on the target Gaia server.

Notes:

  1. There is a 30-day grace period upon first installation / activation of the Deployment Agent, during which no license is needed at all.

  2. Evaluation License is not enough to enable Gaia Software Updates.

    Access to Check Point Download Server is available via subscription only.

    A real valid support license is required.

    An Evaluation License is not sufficient.

Connection to the Internet

Gaia server should be connected to the Internet for these purposes:

  • To perform online self-update of the CPUSE Deployment Agent.

  • To obtain Gaia Software Updates from the Check Point cloud.

Important - We recommend to enable the corresponding Consent Flag to download the Contract File:

For additional information, see sk94508 > section "Blade Contracts".

CPUSE Communication with the Check Point Cloud

To allow the CPUSE Deployment Agent to communicate with the Check Point cloud, follow the steps below in SmartConsole.

You must create an explicit allow-rule in these scenarios:

Item

Scenario 1

Scenario 2

Scenario 3

Scenario Description

Check Point Security Gateway running on Gaia OS, which must connect to Check Point cloud.

The implied rule "Accept outgoing packets originating from Gateway" is disabled in SmartConsole > Menu > Global properties > on the FireWall page.

Perimeter Check Point Security Gateway that protects internal Check Point server running on Gaia OS, which must connect to Check Point cloud.

Perimeter non-Check Point Firewall that protects Check Point server running on Gaia OS, which must connect to Check Point cloud.

Which explicit allow-rule rule to configure?

Create an explicit Access Control rule for this Check Point Security Gateway (see the procedure below) to allow the communication between the CPUSE Deployment Agent on this Check Point Security Gateway and the Check Point cloud.

Create an explicit Access Control rule for the Perimeter Check Point Security Gateway (see the procedure below) to allow the communication between the CPUSE Deployment Agent on the internal Check Point Gaia server and the Check Point cloud.

Create an explicit Firewall rule (for reference, see procedure below) for this non-Check Point Firewall to allow the communication between the CPUSE Deployment Agent on the internal Check Point Gaia server and the Check Point cloud.

Traffic Source

Check Point Security Gateway

Internal Check Point Gaia server

Internal Check Point Gaia server

Traffic Destination

Check Point domains

Check Point domains

Check Point domains

Traffic Protocol / Ports

The required HTTP / HTTPS / DNS traffic

The required HTTP / HTTPS / DNS traffic

The required HTTP / HTTPS / DNS traffic

Where to install / apply the explicit allow-rule?

Check Point Security Gateway

Perimeter Check Point Security Gateway

Perimeter non-Check Point Firewall

Procedure for Check Point Security Gateway:

Note - For a non-Check Point Firewall, you must create the equivalent allow-rule. See sk83520.

  1. Create these Domain objects for the required Check Point domains and for the AKAMAI domain (note the period character in the beginning of the FQDN):

    • .updates.checkpoint.com

    • .updates.g01.checkpoint.com

    • .gwevents.checkpoint.com

    • .gwevents.us.checkpoint.com

    • .deploy.static.akamaitechnologies.com

    For instructions, see the Quantum Security Management Administration Guide for your version.

  2. Create this Access Control security rule for the involved Security Gateway (use predefined services):

    Important - Rules with Domain Objects should be located as low as possible in the rulebase.

    For Scenario #1 - Check Point Security Gateway running on Gaia OS (and the implied rule "Accept outgoing packets originating from Gateway" is disabled)

    Source

    Destination

    VPN

    Services & Applications

    Action

    Install On

    Check Point

    Security Gateway /

    Cluster

    .updates.checkpoint.com

     

    .updates.g01.checkpoint.com

     

    .gwevents.checkpoint.com

     

    .gwevents.us.checkpoint.com

     

    .deploy.static.akamaitechnologies.com

    Any

    http

     

    https

     

    HTTP_and_HTTPS_proxy

     

    domain-udp

    Accept

    Check Point

    Security Gateway /

    Cluster

    For Scenario #2 - Perimeter Check Point Security Gateway that protects internal Check Point server

    Source

    Destination

    VPN

    Services & Applications

    Action

    Install On

    Internal

    Check Point

    Gaia

    Server

    .updates.checkpoint.com

     

    .updates.g01.checkpoint.com

     

    .gwevents.checkpoint.com

     

    .gwevents.us.checkpoint.com

     

    .deploy.static.akamaitechnologies.com

    Any

    http

     

    https

     

    HTTP_and_HTTPS_proxy

     

    domain-udp

    Accept

    Perimeter

    Check Point

    Security Gateway /

    Cluster

  3. Install the Access Control policy on the involved Security Gateway / Cluster object.

Update of the CPUSE Deployment Agent to the Latest Version

  • On an online Gaia server (that is connected to the Internet):

    • The CPUSE Deployment Agent must always be updated to the latest available version before being able to perform any action.

    • We recommend to leave the default CPUSE Deployment Agent setting "Automatically update Deployment Agent (recommended)" enabled.

      See CPUSE Update Settings.

  • On an offline Gaia server (that is disconnected from the Internet), we strongly recommended to always update the CPUSE Deployment Agent manually to the latest available build. See sk92449.

    Important - Scalable Platforms (Maestro and Chassis) R81.20 and lower require a dedicated Deployment Agent package that is available in the relevant Home Page SK articles (Known Limitation MBS-2372).

Free Disk Space

  • To import a CPUSE package, the /var/log/ partition on the Gaia server must have enough free disk space - at least twice the size of the package you want to import.

    To see the amount of available disk space in /var/log/ partition, run this command in the Expert mode:

    df -h | grep -E "Avail|/var/log"

    Example output:

    [Expert@Gaia:0]# df -h | grep -E "Avail|/var/log"
Filesystem            Size  Used Avail Use% Mounted on
                       11G  286M  9.9G   3% /var/log
[Expert@Gaia:0]#

  • To upgrade to a higher Major Version, or to perform Clean Installation using CPUSE, server must have enough unallocated (unpartitioned) disk space - at least as the size of the root partition.

    1. Examine the size of the "root" partition:

      df -h | grep -E "Avail|\/$"

      Example output:

      [Expert@Gaia:0]# df -h | grep -E "Avail|\/$"
Filesystem            Size  Used Avail Use% Mounted on
                       17G  9.1G  6.6G  59% /
[Expert@Gaia:0]#

    2. Examine the amount of unallocated (unpartitioned) disk space:

      pvs

      Example output:

      [Expert@Gaia:0]# pvs
 PV         VG       Fmt  Attr PSize  PFree
 /dev/sda3  vg_splat lvm2 a-   57.81G 29.81G
[Expert@Gaia]#

Management Data Plane Separation (MDPS)

When you enable MDPS (sk138672) on a Security Gateway / Cluster Members / Security Group, the CPUSE service runs in the Management Plane.

Therefore, you must run all CPUSE commands only in the Management Plane.

  • The Gaia Clish / Gaia gClish commands are described in CPUSE Syntax in Gaia Clish / Gaia gClish.

    To go to the Management Plane in Gaia Clish / Gaia gClish, run:

    set mdps environment mplane

  • The Expert mode commands are "DAClient" and "da_cli".

    To go to the Management Plane in the Expert mode, run:

    mplane