Working with the Distribution Mode

Background

The Quantum Maestro Orchestrator A scalable Network Security System that connects multiple Check Point Security Appliances into a unified system. Synonyms: Orchestrator, Quantum Maestro Orchestrator, Maestro Hyperscale Orchestrator. Acronym: MHO. uses the Distribution Mode to assign incoming traffic to Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. Members in each Security Group.

By default, the Quantum Maestro Orchestrator automatically configures the Distribution Mode.

Supported Distribution Modes

Mode	Instructions
User (Internal)	Packets are assigned to a Security Group Member based on the packet's Destination IP address. If Layer 4 distribution is enabled, Quantum Maestro Orchestrator assigns packets to a Security Group Member based on the packet's Source Port and the Destination IP address.
Network (External)	Packets are assigned to a Security Group Member based on the packet's Source IP address. If Layer 4 distribution is enabled, Quantum Maestro Orchestrator assigns packets to a Security Group Member based on the packet's Source IP address and Destination Port.
General	Quantum Maestro Orchestrators assign packets to a Security Group Member based on the packet's Source IP address and the Destination IP address. If Layer 4 distribution is enabled, Quantum Maestro Orchestrators assign packets to a Security Group Member based on the packet's Source IP address, Source Port, Destination IP address, and Destination Port.
Auto-Topology (Per-Port)	Each port for a Security Group Member is configured separately in the User Mode or Network Mode.

Mode

Instructions

User

(Internal)

Packets are assigned to a Security Group Member based on the packet's Destination IP address.

If Layer 4 distribution is enabled, Quantum Maestro Orchestrator assigns packets to a Security Group Member based on the packet's Source Port and the Destination IP address.

Network

(External)

Packets are assigned to a Security Group Member based on the packet's Source IP address.

If Layer 4 distribution is enabled, Quantum Maestro Orchestrator assigns packets to a Security Group Member based on the packet's Source IP address and Destination Port.

General

Quantum Maestro Orchestrators assign packets to a Security Group Member based on the packet's Source IP address and the Destination IP address.

If Layer 4 distribution is enabled, Quantum Maestro Orchestrators assign packets to a Security Group Member based on the packet's Source IP address, Source Port, Destination IP address, and Destination Port.

Auto-Topology

(Per-Port)

Each port for a Security Group Member is configured separately in the User Mode or Network Mode.

Notes:

The default mode is Auto-Topology ((Per-Port)) and the Layer 4 distribution is enabled.
The User ((Internal)) Mode and Network ((External)) Mode can work together.

The supported combinations are:
- User Mode and User Mode
- User Mode and Network Mode
- Network Mode and Network Mode
In many scenarios, it is possible to optimize the combination of the User Mode and Network Mode to pass traffic through same Security Group Member from the two sides.

Automatic Distribution Configuration (Auto-Topology)

By default, Security Groups work in the General Mode.

The best Distribution Mode is selected based on the Security Group topology as defined in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. in the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object.

The Distribution Mode is automatically based on these interface types:

Physical interfaces, except for management and synchronization interfaces
VLAN
Bond
VLAN on top of Bond

Manual Distribution Configuration (Manual-General)

In some deployments, you must manually configure a Distribution Mode to the General.

In other cases, it may be necessary to force the system to work in the General Mode.

When the Distribution Mode is manually configured (Manual-General Mode), the Distribution Mode of each SSM Role of the Quantum Maestro Orchestrator (SSM) that manages the flow of network traffic to and from the Security Groups. is General.

In this configuration, the topology of the interfaces is irrelevant.

Best Practice - Do not manually change the Distribution Mode of a Virtual System. This can cause performance degradation.

Setting and Showing the Distribution Configuration (set distribution configuration)

Use these Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group. commands on a Security Group to set and show the distribution configuration.

Important - If the Security Group runs in a VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode, run the commands in the context of VS0 only. The commands apply immediately across all Virtual Systems.

Syntax to show the Distribution Configuration

show distribution configuration

Syntax to set the Distribution Configuration

set distribution configuration {auto-topology | manual-general} ip-version {ipv4 | ipv6 | all} ip-mask <Mask>

Parameters

Parameter

Notes

auto-topology

Configures the distribution mode to Auto-Topology (Per-Port).

manual-general

Configures the distribution mode to Manual General.

ipv4

Configures the distribution mode for IPv4 traffic only.

ipv6

Configures the distribution mode for IPv6 traffic only.

all

Configures the distribution mode for IPv4 and IPv6 traffic.

ip-mask <Mask>

Must be the same as the distribution matrix size.

Must be specified in the Hex format.

Follow these steps:

Examine the distribution matrix size:

show distribution verification verbose

Examine the Matrix Size line.

Example:

...
Matrix Size 512
...

Exit from the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish to the Expert mode.

Convert the matrix size from the decimal to the hexadecimal format:

printf '%x\n' <Matrix Size>

Example:

[Expert@HostName-ch0x-0x:0]# printf '%x\n' 512
200
[Expert@HostName-ch0x-0x:0]#

Go to the Gaia gClish:

gclish

Configure the distribution mode with the required mask:

set distribution ... ip-mask <Matrix Size in HEX>

Example:

set distribution ... ip-mask 200

Configuring the Interface Distribution Mode (set distribution interface)

Description

Use these Gaia gClish commands on a Security Group to:

Set the interface Distribution Mode - For an interface when the system is not working in the General Mode
Show the interface Distribution Mode - If it is assigned by Auto-Topology, or is manually configured

Note - In VSX mode, you must go to the context of the applicable Virtual System before you can change the interface Distribution Mode.

Run the "set virtual-system <VS ID>" command.

Syntax to set the interface Distribution Mode

set distribution interface <Name of Interface> configuration {user | network | policy}

Syntax to show the interface Distribution Mode

show distribution interface <Name of Interface> configuration

Parameters

Parameter	Description
`<Name of Interface>`	Interface name as assigned by the operating system.
`user`	Manually assign the User (Internal) Distribution Mode - based on the Destination IP address.
`network`	Manually assign the Network (External) Distribution Mode - based on the Source IP address.
`policy`	Use Auto-Topology to automatically assign the Distribution Mode according to the policy.

Examples

Showing Distribution Status (show distribution status)

Description

Use this Gaia gClish command on a Security Group to show the status report of the Distribution Mode.

Syntax

show distribution status [verbose]

Examples

Explanation about the output

Field	Instructions
`L4 Mode`	Shows the Layer 4 distribution status: `on` - enabled `off` - disabled
`Mode`	Shows the currently configured Distribution Mode: `per-port` - Auto-Topology `user` - User (Internal) `network` - Network (External) `general` - General
`Matrix Size`	Shows the size of the Distribution Mode matrix.
`Ports`	Shows the Distribution Mode assignment for each interface.

Running a Verification Test (show distribution verification)

Description

Use this Gaia gClish command on a Security Group to run a verification test of the Distribution Mode configuration.

This test compares the Security Group configuration with the actual results.

You can see a summary or a verbose report of the test results.

Syntax

show distribution verification [verbose]

Examples

Example - Verbose output of successful tests

[Expert@HostName-ch0x-0x:0]# gclish

[Global] HostName-ch01-01 > show distribution verification verbose

Test:                                               Configuration:                    Verification:                     Result:

chassis 1 blade 1 dxl-general-mode                  off                               off                               Passed

chassis 1 blade 1 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 1 blade 1 dxl-size                          1024                              1024                              Passed

chassis 1 blade 2 dxl-general-mode                  off                               off                               Passed

chassis 1 blade 2 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 1 blade 2 dxl-size                          1024                              1024                              Passed

chassis 1 blade 3 dxl-general-mode                  off                               off                               Passed

chassis 1 blade 3 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 1 blade 3 dxl-size                          1024                              1024                              Passed

chassis 1 blade 4 dxl-general-mode                  off                               off                               Passed

chassis 1 blade 4 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 1 blade 4 dxl-size                          1024                              1024                              Passed

chassis 1 blade 5 dxl-general-mode                  off                               off                               Passed

chassis 1 blade 5 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 1 blade 5 dxl-size                          1024                              1024                              Passed

chassis 1 ssm 1 ipv6-mode                           on                                on                                Passed

chassis 1 ssm 1 l4-mode                             off                               off                               Passed

chassis 1 ssm 1 mask ipv4 general destination       0000001f                          0000001f                          Passed

chassis 1 ssm 1 mask ipv4 general source            0000001f                          0000001f                          Passed

chassis 1 ssm 1 mask ipv4 l4 ip                     000000ff                          000000ff                          Passed

chassis 1 ssm 1 mask ipv4 l4 port                   00000003                          00000003                          Passed

chassis 1 ssm 1 mask ipv4 user-network destination  000003ff                          000003ff                          Passed

chassis 1 ssm 1 mask ipv4 user-network source       000003ff                          000003ff                          Passed

chassis 1 ssm 1 mask ipv6 general destination       0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 1 ssm 1 mask ipv6 general source            0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 1 ssm 1 mask ipv6 user-network destination  000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 1 ssm 1 mask ipv6 user-network source       000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 1 ssm 1 matrix-max_size                     2k                                2k                                Passed

chassis 1 ssm 1 matrix-size                         1024                              1024                              Passed

chassis 1 ssm 1 mode                                user                              user                              Passed

chassis 1 ssm 1 signature                           d9195da1c6de046ab3581836c911f98f  d9195da1c6de046ab3581836c911f98f  Passed

chassis 1 ssm 2 ipv6-mode                           on                                on                                Passed

chassis 1 ssm 2 l4-mode                             off                               off                               Passed

chassis 1 ssm 2 mask ipv4 general destination       0000001f                          0000001f                          Passed

chassis 1 ssm 2 mask ipv4 general source            0000001f                          0000001f                          Passed

chassis 1 ssm 2 mask ipv4 l4 ip                     000000ff                          000000ff                          Passed

chassis 1 ssm 2 mask ipv4 l4 port                   00000003                          00000003                          Passed

chassis 1 ssm 2 mask ipv4 user-network destination  000003ff                          000003ff                          Passed

chassis 1 ssm 2 mask ipv4 user-network source       000003ff                          000003ff                          Passed

chassis 1 ssm 2 mask ipv6 general destination       0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 1 ssm 2 mask ipv6 general source            0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 1 ssm 2 mask ipv6 user-network destination  000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 1 ssm 2 mask ipv6 user-network source       000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 1 ssm 2 matrix-max_size                     2k                                2k                                Passed

chassis 1 ssm 2 matrix-size                         1024                              1024                              Passed

chassis 1 ssm 2 mode                                user                              user                              Passed

chassis 1 ssm 2 signature                           d9195da1c6de046ab3581836c911f98f  d9195da1c6de046ab3581836c911f98f  Passed

chassis 2 blade 1 dxl-general-mode                  off                               off                               Passed

chassis 2 blade 1 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 2 blade 1 dxl-size                          1024                              1024                              Passed

chassis 2 blade 2 dxl-general-mode                  off                               off                               Passed

chassis 2 blade 2 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 2 blade 2 dxl-size                          1024                              1024                              Passed

chassis 2 blade 3 dxl-general-mode                  off                               off                               Passed

chassis 2 blade 3 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 2 blade 3 dxl-size                          1024                              1024                              Passed

chassis 2 blade 4 dxl-general-mode                  off                               off                               Passed

chassis 2 blade 4 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 2 blade 4 dxl-size                          1024                              1024                              Passed

chassis 2 blade 5 dxl-general-mode                  off                               off                               Passed

chassis 2 blade 5 dxl-md5sum                        a5a0317b8cc0de2a8518396e61593d2b  a5a0317b8cc0de2a8518396e61593d2b  Passed

chassis 2 blade 5 dxl-size                          1024                              1024                              Passed

chassis 2 ssm 1 ipv6-mode                           on                                on                                Passed

chassis 2 ssm 1 l4-mode                             off                               off                               Passed

chassis 2 ssm 1 mask ipv4 general destination       0000001f                          0000001f                          Passed

chassis 2 ssm 1 mask ipv4 general source            0000001f                          0000001f                          Passed

chassis 2 ssm 1 mask ipv4 l4 ip                     000000ff                          000000ff                          Passed

chassis 2 ssm 1 mask ipv4 l4 port                   00000003                          00000003                          Passed

chassis 2 ssm 1 mask ipv4 user-network destination  000003ff                          000003ff                          Passed

chassis 2 ssm 1 mask ipv4 user-network source       000003ff                          000003ff                          Passed

chassis 2 ssm 1 mask ipv6 general destination       0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 2 ssm 1 mask ipv6 general source            0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 2 ssm 1 mask ipv6 user-network destination  000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 2 ssm 1 mask ipv6 user-network source       000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 2 ssm 1 matrix-max_size                     2k                                2k                                Passed

chassis 2 ssm 1 matrix-size                         1024                              1024                              Passed

chassis 2 ssm 1 mode                                user                              user                              Passed

chassis 2 ssm 1 signature                           d9195da1c6de046ab3581836c911f98f  d9195da1c6de046ab3581836c911f98f  Passed

chassis 2 ssm 2 ipv6-mode                           on                                on                                Passed

chassis 2 ssm 2 l4-mode                             off                               off                               Passed

chassis 2 ssm 2 mask ipv4 general destination       0000001f                          0000001f                          Passed

chassis 2 ssm 2 mask ipv4 general source            0000001f                          0000001f                          Passed

chassis 2 ssm 2 mask ipv4 l4 ip                     000000ff                          000000ff                          Passed

chassis 2 ssm 2 mask ipv4 l4 port                   00000003                          00000003                          Passed

chassis 2 ssm 2 mask ipv4 user-network destination  000003ff                          000003ff                          Passed

chassis 2 ssm 2 mask ipv4 user-network source       000003ff                          000003ff                          Passed

chassis 2 ssm 2 mask ipv6 general destination       0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 2 ssm 2 mask ipv6 general source            0000000000000000000000000000001f  0000000000000000000000000000001f  Passed

chassis 2 ssm 2 mask ipv6 user-network destination  000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 2 ssm 2 mask ipv6 user-network source       000000000000000000000000000003ff  000000000000000000000000000003ff  Passed

chassis 2 ssm 2 matrix-max_size                     2k                                2k                                Passed

chassis 2 ssm 2 matrix-size                         1024                              1024                              Passed

chassis 2 ssm 2 mode                                user                              user                              Passed

chassis 2 ssm 2 signature                           d9195da1c6de046ab3581836c911f98f  d9195da1c6de046ab3581836c911f98f  Passed

Summary:

all active SSMs are configured as: user

all active SSMs are configured as: user

[Global] HostName-ch01-01 >

Configuring the Layer 4 Distribution Mode and Masks (set distribution l4-mode)

Description

Use these commands in Gaia gClish on a Security Group to:

Enable Layer 4 distribution and set new masks for the IP address and the port
Disable Layer 4 distribution
Show Layer 4 Distribution Mode and masks

Syntax

set distribution l4-mode enabled

set distribution l4-mode disabled

show distribution l4-mode

Examples