Configuring a Single VSX Gateway in Monitor Mode

Important:

  • For Cloud-based services (for example, Social Network widgets and URL Filtering), you must connect the VSX Gateway in Monitor Mode to the Internet (also, see sk79700 and sk106496).

  • You must install valid license and contracts file on the VSX Gateway in Monitor Mode.

Note - This procedure applies to both Check Point Appliances and Open Servers.

Procedure:

  		1.

    Important - Make sure the VSX Gateway has enough physical interfaces.

    Step

    Instructions

    1

    Install the Gaia Operating System:

    2

    Follow Configuring Gaia for the First Time.

    3

    During the First Time Configuration Wizard, you must configure these settings:

    • In the Management Connection window, select the interface, through which you connect to Gaia operating system.

    • In the Internet Connection window, do not configure IP addresses.

    • In the Installation Type window, select Security Gateway and/or Security Management.

    • In the Products window:

      1. In the Products section, select Security Gateway only.

      2. In the Clustering section, clear Unit is a part of a cluster, type.

    • In the Dynamically Assigned IP window, select No.

    • In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).

  2. You can configure the Monitor Mode on an interface either in Gaia Portal, or Gaia Clish.

    Step

    Instructions

    1

    With a web browser, connect to Gaia Portal at:

    https://<IP address of Gaia Management Interface>

    2

    In the left navigation tree, click Network Management > Network Interfaces.

    3

    Select the applicable physical interface from the list and click Edit.

    4

    Select the Enable option to set the interface status to UP.

    5

    In the Comment field, enter the applicable comment text (up to 100 characters).

    6

    On the IPv4 tab, select Use the following IPv4 address, but do not enter an IPv4 address.

    7

    On the IPv6 tab, select Use the following IPv6 address, but do not enter an IPv6 address.

    Important - This setting is available only after you enable the IPv6 Support in Gaia and reboot.

    8

    On the Ethernet tab:

    • Select Auto Negotiation, or select a link speed and duplex setting from the list.

    • In the Hardware Address field, enter the Hardware MAC address (if not automatically received from the NIC).

      Caution - Do not manually change the MAC address unless you are sure that it is incorrect or has changed. An incorrect MAC address can lead to a communication failure.

    • In the MTU field, enter the applicable Maximum Transmission Unit (MTU) value (minimal value is 68, maximal value is 16000, and default value is 1500).

    • Select Monitor Mode.

    9

    Click OK.

    Step

    Instructions

    1

    Connect to the command line on the Security Gateway.

    2

    Log in to Gaia Clish.

    3

    Examine the configuration and state of the applicable physical interface:

    show interface <Name of Physical Interface>

    4

    If the applicable physical interface has an IP address assigned to it, remove that IP address.

    • To remove an IPv4 address:

      delete interface <Name of Physical Interface> ipv4-address

    • To remove an IPv6 address:

      delete interface <Name of Physical Interface> ipv6-address

    5

    Enable the Monitor Mode on the physical interface:

    set interface <Name of Physical Interface> monitor-mode on

    6

    Configure other applicable settings on the interface in the Monitor Mode:

    set interface <Name of Physical Interface> ...

    7

    Examine the configuration and state of the Monitor Mode interface:

    show interface <Name of Physical Interface>

    8

    Save the configuration:

    save config

  3. Step

    Instructions

    1

    Connect to the command line on the VSX Gateway.

    2

    Log in to the Expert mode.

    3

    Modify the $FWDIR/boot/modules/fwkern.conf file:

    1. Back up the current $FWDIR/boot/modules/fwkern.conf file:

      cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

      If this file does not exist, create it:

      touch $FWDIR/boot/modules/fwkern.conf

    2. Edit the current $FWDIR/boot/modules/fwkern.conf file:

      vi $FWDIR/boot/modules/fwkern.conf

      Important - This configuration file does not support spaces or comments.

    3. Add this line to enable the Passive Streaming Layer (PSL) Tap Mode:

      psl_tap_enable=1

    4. Add this line to enable the Firewall Tap Mode:

      fw_tap_enable=1

    5. Save the changes in the file and exit the Vi editor.

    4

    Modify the $PPKDIR/conf/simkern.conf file:

    1. Back up the current $PPKDIR/conf/simkern.conf file:

      cp -v $PPKDIR/conf/simkern.conf{,_BKP}

      If this file does not exist, create it:

      touch $PPKDIR/conf/simkern.conf

    2. Edit the current $PPKDIR/conf/simkern.conf file:

      vi $PPKDIR/conf/simkern.conf

      Important - This configuration file does not support spaces or comments.

    3. Add this line to enable the Firewall Tap Mode:

      fw_tap_enable=1

    4. Save the changes in the file and exit the Vi editor.

    5

    Reboot the VSX Gateway.

    6

    Make sure the VSX Gateway loaded the new configuration:

    1. Examine the status of the PSL Tap Mode:

      fw ctl get int psl_tap_enable

      Output must show:

      psl_tap_enable = 1

    2. Examine the status of the Firewall Tap Mode:

      fw ctl get int fw_tap_enable

      Output must show:

      fw_tap_enable = 1

    Notes:

    • This configuration helps the VSX Gateway process packets that arrive in the wrong or abnormal order (for example, TCP [SYN-ACK] arrives before TCP [SYN]).

    • This configuration helps the VSX Gateway work better for the first 10-30 minutes when it processes connections, in which the TCP [SYN] packets did not arrive.

    • This configuration is also required when you use a TAP device or Mirror / Span ports with separated TX/RX queues.

    • This configuration will make the Mirror Port on VSX Gateway work better for the first 10-30 minutes when processing connections, in which the TCP-SYN packet did not arrive.

    • It is not possible to set the value of the kernel parameters "psl_tap_enable" and "fw_tap_enable" on-the-fly with the "fw ctl set int <parameter>" command (Known Limitation 02386641).

  4. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Main Domain Management Server that should manage this VSX Gateway.

    2

    From the left navigation panel, click Gateways & Servers.

    3

    Create a new VSX Gateway object in one of these ways:

    • From the top toolbar, click the New () > VSX > Gateway.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > VSX > New Gateway.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > VSX > Gateway.

    The VSX Gateway Wizard opens.

    4

    On the VSX Gateway General Properties (Specify the object's basic settings) page:

    1. In the Enter the VSX Gateway Name field, enter the applicable name for this VSX Gateway object.

    2. In the Enter the VSX Gateway IPv4 field, enter the same IPv4 address that you configured on the Management Connection page of the VSX Gateway's First Time Configuration Wizard.

    3. In the Enter the VSX Gateway IPv6 field, enter the same IPv6 address that you configured on the Management Connection page of the VSX Gateway's First Time Configuration Wizard.

    4. In the Select the VSX Gateway Version field, select R80.40.

    5. Click Next.

    5

    On the VSX Gateway General Properties (Secure Internal Communication) page:

    1. In the Activation Key field, enter the same Activation Key you entered during the VSX Gateway's First Time Configuration Wizard.

    2. In the Confirm Activation Key field, enter the same Activation Key again.

    3. Click Initialize.

    4. Click Next.

     

    If the Trust State field does not show Trust established, perform these steps:

    1. Connect to the command line on the VSX Gateway.

    2. Make sure there is a physical connectivity between the VSX Gateway and the Management Server (for example, pings can pass).

    3. Run:

      cpconfig

    4. Enter the number of this option:

      Secure Internal Communication

    5. Follow the instructions on the screen to change the Activation Key.

    6. In SmartConsole, on the VSX Gateway General Properties page, click Reset.

    7. Enter the same Activation Key you entered in the cpconfig menu.

    8. In SmartConsole, click Initialize.

    6

    On the VSX Gateway Interfaces (Physical Interfaces Usage) page:

    1. Examine the list of the interfaces - it must show all the physical interfaces on the VSX Gateway.

    2. If you plan to connect more than one Virtual System directly to the same physical interface, you must select VLAN Trunk for that physical interface.

    3. Click Next.

    7

    On the Virtual Network Device Configuration (Specify the object's basic settings) page:

    1. You can select Create a Virtual Network Device and configure the first applicable Virtual Network Device at this time (we recommend to do this later) - Virtual Switch or Virtual Router.

    2. Click Next.

    8

    On the VSX Gateway Management (Specify the management access rules) page:

    1. Examine the default access rules.

    2. Select the applicable default access rules.

    3. Configure the applicable source objects, if needed.

    4. Click Next.

    Important - These access rules apply only to the VSX Gateway (context of VS0), which is not intended to pass any "production" traffic.

    9

    On the VSX Gateway Creation Finalization page:

    1. Click Finish and wait for the operation to finish.

    2. Click View Report for more information.

    3. Click Close.

    10

    Examine the VSX configuration:

    1. Connect to the command line on the VSX Gateway.

    2. Log in to the Expert mode.

    3. Run:

      vsx stat -v

    11

    Install the default policy on the VSX Gateway object:

    1. Click Install Policy.

    2. In the Policy field, select the default policy for this VSX Gateway object.

      This policy is called:

      <Name of VSX Gateway object>_VSX

    3. Click Install.

    12

    Examine the VSX configuration:

    1. Connect to the command line on the VSX Gateway.

    2. Log in to the Expert mode.

    3. Run:

      vsx stat -v

  5. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server, or each Target Domain Management Server that should manage each Virtual Device.

    2

    Configure the applicable Virtual System (and other Virtual Devices) on this VSX Gateway.

    When you configure this Virtual System, for the Monitor Mode interface, add a regular interface. In the IPv4 Configuration section, enter a random IPv4 address.

    Important - This random IPv4 address must not conflict with existing IPv4 addresses on your network.

    3

    Examine the VSX configuration:

    1. Connect to the command line on the VSX Gateway.

    2. Log in to the Expert mode.

    3. Run:

      vsx stat -v

    4

    Disable the Anti-Spoofing on the interface that is configured in the Monitor Mode:

    1. In the SmartConsole, open the Virtual System object.

    2. Click the Topology page.

    3. Select the Monitor Mode interface and click Edit.

      The Interface Properties window opens.

    4. Click the General tab.

    5. In the Security Zone field, select None.

    6. Click the Topology tab.

    7. In the Topology section, make sure the settings are Internal (leads to the local network) and Not Defined.

    8. In the Anti-Spoofing section, clear Perform Anti-Spoofing based on interface topology.

    9. Click OK to close the Interface Properties window.

    10. Click OK to close the Virtual System Properties window.

    11. The Management Server pushes the VSX Configuration.

  6. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Target Domain Management Server that manages this Virtual System.

    2

    In the top left corner, click Menu > Global properties.

    3

    From the left tree, click the Stateful Inspection pane and configure:

    1. In the Default Session Timeouts section:

      1. Change the value of the TCP session timeout from the default 3600 to 60 seconds.

      2. Change the value of the TCP end timeout from the default 20 to 5 seconds.

    2. In the Out of state packets section, you must clear all the boxes.

      Otherwise, the Virtual System drops the traffic as out of state (because the traffic does not pass through the Virtual System, it does not record the state information for the traffic).

    4

    From the left tree, click the Advanced page > click the Configure button, and configure:

    1. Click FireWall-1 > Stateful Inspection.

    2. Clear reject_x11_in_any.

    3. Click OK to close the Advanced Configuration window.

    5

    Click OK to close the Global Properties window.

    6

    Publish the SmartConsole session.

  7. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Target Domain Management Server that manages this Virtual System.

    2

    From the left navigation panel, click Security Policies.

    3

    Create a new policy and configure the applicable layers:

    1. At the top, click the + tab (or press the CTRL T keys).

    2. On the Manage Policies tab, click Manage policies and layers.

    3. In the Manage policies and layers window, create a new policy and configure the applicable layers.

    4. Click Close.

    5. On the Manage Policies tab, click the new policy you created.

    4

    Create the Access Control rule that accepts all traffic:

    No

    Name

    Source

    Destination

    VPN

    Services & Applications

    Action

    Track

    Install On

    1

    Accept All

    *Any

    *Any

    Any

    *Any

    Accept

    Log

    Object of
    Virtual System

    5

    Best Practice

    We recommend these Aggressive Aging settings for the most common TCP connections:

    1. In the SmartConsole, click Objects menu > Object Explorer.

    2. Open Services and select TCP.

    3. Search for the most common TCP connections in this network.

    4. Double-click the applicable TCP service.

    5. From the left tree, click Advanced.

    6. At the top, select Override default settings.

      On Domain Management Server, select Override global domain settings.

    7. Select Match for 'Any'.

    8. In the Aggressive aging section:

      • Select Enable aggressive aging.

      • Select Specific and enter 60.

    9. Click OK.

    10. Close the Object Explorer.

    6

    Publish the SmartConsole session.

    7

    Install the Access Control Policy on the Virtual System object.

    1. Click Install Policy.

    2. In the Policy field, select the applicable policy for this Virtual System object.

    3. Click Install.

    8

    Examine the VSX configuration:

    1. Connect to the command line on the VSX Gateway.

    2. Log in to the Expert mode.

    3. Run:

      vsx stat -v

  8. Step

    Instructions

    1

    Connect to the command line on the VSX Gateway.

    2

    Log in to the Expert mode.

    3

    Install the default policy on the VSX Gateway object:

    Make sure the parameter fw_span_port_mode is part of the installed policy:

    grep -A 3 -r fw_span_port_mode $FWDIR/state/local/*

    The returned output must show:

    :val (true)

  9. On the VSX Gateway, connect the interface in the Monitor Mode to the mirror or SPAN port on the switch.

For more information, see the: