Configuring Bond Interface on the Management Ports

Important - If this Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. is configured in VSX mode, follow this workflow:

  1. In Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group., temporarily disable the VSX mode:

    set vsx off

  2. Configure a Bond Interface on the Management Ports as described below.

  3. In Gaia gClish, enable the VSX mode:

    set vsx on

Note - You can perform Steps 2 - 5 in either Gaia Portal (see Configuring Security Groups in Gaia Portal), or Gaia Clish (see Configuring Security Groups in Gaia Clish).

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Create a new Security Group:

  1. In the Network settings section, enter a dummy IP address configuration.

  2. Configure the First Time Wizard settings.

3

Assign two available management interfaces ethM-MgmtX and ethN-MgmtY to the Security Group.

4

Assign the applicable Security Appliances to the Security Group.

5

Assign the applicable Uplink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to external and internal networks. Gaia operating system shows these interfaces in Gaia Portal and in Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security Gateway object. to the Security Group.

6

Connect through the console port to the Security Appliance with Member ID 1 in this Security Group.

7

Log in to the Expert mode.

8

Go to the Gaia gClish:

gclish

9

Check which eth#-Mgmt# interface has the IP address you assigned to the Security Group.

In our example, we assume it is ethM-MgmtX.

10

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

11

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

12

Assign the real IP address (you wish to use for this Security Group) to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

13

Set the Bonding group as the new Gaia Management Interface:

set management interface magg<Bond ID>

14

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

15

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

16

Connect to one of the Quantum Maestro Orchestrators.

17

Make sure the Security Group settings are correct.

18

In a web browser, connect to the Management IP address of the Security Group and complete the First Time Configuration Wizard manually.

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Assign a second available management interface ethN-MgmtY to the Security Group.

You can perform this step in Gaia Portal (see Configuring Security Groups in Gaia Portal), or Gaia Clish (see Configuring Security Groups in Gaia Clish).

In our example, we assume that the interface ethM-MgmtX is already assigned.

3

Connect through the console port to the Security Appliance with Member ID 1 in this Security Group.

4

Log in to the Expert mode.

5

Go to the Gaia gClish:

gclish

6

Change the IP address on the ethM-MgmtX interface to some dummy IP address:

set interface ethM-MgmtX ipv4-address <Dummy IPv4 Address> mask-length <Mask Length>

7

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

8

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

9

Assign the real IP address to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

10

Set the Bonding group as the new Gaia Management Interface:

set management interface magg<Bond ID>

11

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

12

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

13

Connect to one of the Quantum Maestro Orchestrators.

14

Make sure the Security Group settings are correct.

15

In SmartConsole:

  1. From the left navigation panel, click Gateways & Servers.

  2. Open the Security Gateway object.

  3. From the left tree, click Network Management.

  4. Click Get Interfaces > Get Interfaces With Topology.

  5. Examine the configuration and accept it.

  6. Click OK.

  7. Install the applicable Access Control Policy.