Maximum Supported Items

This section provides the maximum supported numbers for various hardware and software items.

Management Server

Item

Maximum Number

Hard Limit

Comment

Network objects in all Domains

1,000,000

Yes

This applies to objects of these types - Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources., ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., Network, Host, Group, Address Range, Dynamic ObjectClosed Special object type, whose IP address is not known in advance. The Security Gateway resolves the IP address of this object in real time., Wildcard Object, Security Zone, LSV Profile, Domain, Interoperable Device, VoIP Domain, Logical Server, OSE Device, Access Point Name.

Network objects in each Domain

100,000

No

 

Security Gateway objects in each Domain

300

and

500

No

To make sure the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. is responsive when you manage more than 300 Security Gateways, it is necessary to disable the three LSM Add-ons as described in sk135972 (LSMServerAddon, PAServerAddon, and PAHBServerAddon).

Objects in each Group object

12,000

Yes

 

Rules in each policy

28,000

Yes

To ensure optimal Security Gateway responsiveness, we recommend configuring a maximum of 20,000 rules in a policy.

While the Security Gateway can support more rules than 20,000 rules, the smaller the number of rules in the installed policy, the more responsive the Security Gateway is.

Changes in one session

100

No

To ensure optimal Management Server responsiveness, we recommend making 100 or fewer changes in each session (although the Management Server can support more than 500 changes at a time).

Interfaces in each Security Gateway

200

No

To ensure optimal SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. responsiveness, we recommend configuring a maximum of 200 interfaces in SmartConsole.

If the Security Gateway object contains more interfaces, use the applicable Management API to configure interfaces. See the Check Point Management API Reference. To ensure optimal API responsiveness, we recommend configuring a maximum of 600 interfaces with API.

Layers in Access Control Policy

251

and

231

Yes

The maximum number of Policy Layers in an Access Control Policy is 251.

A Security Gateway has a limit of 4900 kernel tables.

Each Access Control Policy LayerClosed Layer (set of rules) in a Security Policy. creates 21 kernel tables on the Security Gateway.

Each Access Control Policy creates 40 global kernel tables on the Security Gateway (that apply to all Policy Layers).

Therefore, the additional calculation is:

(4900 tables - 40 tables) / 21 tables per Policy Layer = 231 Policy Layers.

Smart-1 6000-L/6000-XL Sizing Recommendations and Limitations

See sk178325.

Maximum Supported Number of Interfaces on Security Gateway

The maximum number of interfaces supported (physical and virtual) is shown in this table.

Mode

Max # of Interfaces

Notes

Security Gateway

1024

Non-VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts.

VSX GatewayClosed Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0.

4096

Includes VLANs and Warp Interfaces

Virtual SystemClosed Virtual Device on a VSX Gateway or VSX Cluster Member that implements the functionality of a Security Gateway. Acronym: VS.

250

 

Note - This table applies to Check Point Appliances and Open Servers.

Maximum Supported Number of Cluster Members

Cluster Type

Maximum Supported Number of Cluster Members

ClusterXLClosed Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic.

5

Virtual System Load SharingClosed VSX Cluster technology that assigns Virtual System traffic to different Active Cluster Members. Acronym: VSLS.

13

Number of Supported Items in a Maestro Environment

Item

Number of
Supported Items

Notes

Number of Security GroupsClosed A logical group of Security Appliances (in Maestro) / Security Gateway Modules (on Scalable Chassis) that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances / Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. In Maestro, each Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. configured

  • Minimum: 1

  • Maximum: 8

None

Number of Security Appliances in one Security Group

In Single Site and Dual Site deployment:

  • Minimum: 1

  • Maximum: 28

In Dual Site deployment:

  • Each Security Group must contain at least one Security Appliance from each site (see MBS-7606 in sk148074).

  • Each Security Group can contain a maximum of 28 Security Appliances - 14 Security Appliances from each site (see MBS-7773 in sk148074).

Number of interfaces configured on top of Uplink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to external and internal networks. Gaia operating system shows these interfaces in Gaia Portal and in Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security Gateway object. in one Security Group

In Security Gateway Mode:

  • Minimum: 2

  • Maximum: 1024

In VSX Mode:

  • Minimum: 2

  • Maximum: 4096

For every Virtual System:

  • Minimum: 2

  • Maximum: 250

Includes all interface types

(Physical, Bonds, VLAN, Warp).