Important:
Workflow:
Note - This procedure applies to both Check Point Appliances and Open Servers.
Step 1 of 9: Install the VSX Gateway
Important - Make sure the VSX Gateway has enough physical interfaces.
Step |
Description |
---|---|
1 |
Install the Gaia Operating System: |
2 |
|
3 |
During the First Time Configuration Wizard, you must configure these settings:
|
Step 2 of 9: Configure the Monitor Mode interface in Gaia Portal
Step |
Description |
---|---|
1 |
In your web browser, connect to the Gaia Portal on the Security Gateway. |
2 |
In the left navigation tree, click Network Management > Network Interfaces. |
3 |
Select the applicable physical interface from the list and click Edit. |
4 |
Select the Enable option to set the interface status to UP. |
5 |
In the Comment field, enter the applicable comment text (up to 100 characters). |
6 |
On the IPv4 tab, select Use the following IPv4 address, but do not enter an IPv4 address. |
7 |
On the IPv6 tab, select Use the following IPv6 address, but do not enter an IPv6 address. Important - This setting is available only after you enable the IPv6 Support in Gaia and reboot. |
8 |
On the Ethernet tab:
|
9 |
Click OK. |
Step 2 of 9: Configure the Monitor Mode interface in Gaia Clish
Step |
Description |
---|---|
1 |
Connect to the command line on the Security Gateway. |
2 |
Log in to Gaia Clish. |
3 |
Examine the configuration and state of the applicable physical interface:
|
4 |
If the applicable physical interface has an IP address assigned to it, remove it:
|
5 |
Enable the Monitor Mode on the physical interface:
|
6 |
Configure other applicable settings on the Monitor Mode interface: set interface <Name of Physical Interface> auto-negotiation {on | off} comments "Text" link-speed {10M/half | 10M/full | 100M/half | 100M/full | 1000M/full} mtu <68-16000 | 1280-16000> rx-ringsize <0-4096> tx-ringsize <0-4096> |
7 |
Examine the configuration and state of the Monitor Mode interface:
|
8 |
Save the configuration:
|
Step 3 of 9: Configure the VSX Gateway to process packets that arrive in the wrong order
Step |
Description |
---|---|
1 |
Connect to the command line on the Security Gateway. |
2 |
Log in to the Expert mode. |
3 |
Modify the |
3A |
Back up the current
Important - If this file does not exist, create it:
|
3B |
Edit the current
Important - This configuration file does not support spaces or comments. |
3C |
Add this line to enable the Passive Streaming Layer (PSL) Tap Mode:
|
3D |
Add this line to enable the Firewall Tap Mode:
|
3E |
Save the changes in the file and exit the Vi editor. |
4 |
Modify the |
4A |
Back up the current
Important - If this file does not exist, create it:
|
4B |
Edit the current
Important - This configuration file does not support spaces or comments. |
4C |
Add this line to enable the Firewall Tap Mode:
|
4D |
Save the changes in the file and exit the Vi editor. |
5 |
Reboot the Security Gateway. |
6 |
Make sure the Security Gateway loaded the new configuration:
|
Notes:
psl_tap_enable
and fw_tap_enable
on-the-fly with the fw ctl set int <parameter>
command (Issue ID 02386641).Step 4 of 9: Configure the VSX Gateway object in SmartConsole
Step |
Description |
---|---|
1 |
Connect with SmartConsole to the Security Management Server or Main Domain Management Server that should manage this VSX Gateway. |
2 |
From the left navigation panel, click Gateways & Servers. |
3 |
Create a new VSX Gateway object in one of these ways:
The VSX Gateway Wizard opens. |
4 |
On the VSX Gateway General Properties (Specify the object's basic settings) page:
|
5 |
On the Virtual Systems Creation Templates (Select the Creation Template most suitable for your VSX deployment) page:
|
6A |
On the VSX Gateway General Properties (Secure Internal Communication) page:
|
6B |
If the Trust State field does not show Trust established, perform these steps:
|
7 |
On the VSX Gateway Interfaces (Physical Interfaces Usage) page:
|
8 |
On the Virtual Network Device Configuration (Specify the object's basic settings) page:
|
9 |
On the VSX Gateway Management (Specify the management access rules) page:
Important - These access rules apply only to the VSX Gateway (context of VS0), which is not intended to pass any "production" traffic. |
10 |
On the VSX Gateway Creation Finalization page:
|
11 |
Examine the VSX configuration:
|
12 |
Install policy on the VSX Gateway object:
|
13 |
Examine the VSX configuration:
|
Step 5 of 9: Configure the Virtual System (and other Virtual Devices) in SmartConsole
Step |
Description |
---|---|
1 |
Connect with SmartConsole to the Security Management Server, or each Target Domain Management Server that should manage each Virtual Device. |
2 |
Configure the desired Virtual System (and other Virtual Devices) on this VSX Gateway. When you configure this Virtual System, for the Monitor Mode interface, add a regular interface. In the IPv4 Configuration section, enter a random IPv4 address. Important - This random IPv4 address must not conflict with existing IPv4 addresses on your network. |
3 |
Examine the VSX configuration.
|
4 |
Disable the Anti-Spoofing on the Monitor Mode interface:
|
Step 6 of 9: Configure the required Global Properties for the Virtual System in SmartConsole
Step |
Description |
---|---|
1 |
Connect with SmartConsole to the Security Management Server or Target Domain Management Server that manages this Virtual System. |
2 |
In the top left corner, click Menu > Global properties. |
3A |
Click the Stateful Inspection pane. |
3B |
In the Default Session Timeouts section:
|
3C |
In the Out of state packets section, you must clear all the boxes. Otherwise, the Virtual System drops the traffic as out of state (because the traffic does not pass through the Virtual System, it does not record the state information for the traffic). |
4A |
Click the Advanced page > Configure button. |
4B |
Click FireWall-1 > Stateful Inspection. |
4C |
Clear reject_x11_in_any. |
4D |
Click OK to close the Advanced Configuration window. |
5 |
Click OK to close the Global Properties window. |
6 |
Publish the SmartConsole session. |
Step 7 of 9: Configure the required Access Control policy for the Virtual System in SmartConsole
Step |
Description |
---|---|
1 |
Connect with SmartConsole to the Security Management Server or Target Domain Management Server that manages this Virtual System. |
2 |
From the left navigation panel, click Security Policies. |
3 |
Create a new policy and configure the applicable layers:
|
4 |
Create the Access Control rule that accepts all traffic:
|
5 |
We recommend these Aggressive Aging settings for the most common TCP connections:
|
6 |
Publish the SmartConsole session. |
7 |
Install the Access Control Policy on the Virtual System object.
|
8 |
Examine the VSX configuration.
|
Step 8 of 9: Make sure the VSX Gateway enabled the Monitor Mode for Software Blades
Step |
Description |
---|---|
1 |
Connect to the command line on the VSX Gateway. |
2 |
Log in to the Expert mode. |
3 |
Make sure the parameter fw_span_port_mode is part of the installed policy:
The returned output must show :val (true). |
Step 9 of 9: Connect the VSX Gateway to the switch
Connect the Monitor Mode interface of the VSX Gateway to the mirror or SPAN port on the switch.
For more information, see the: