Configuring Bond Interface on the Management Ports

Important - If this Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. is configured in VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode, follow this workflow:

  1. In Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group., temporarily disable the VSX mode:

    set vsx off

  2. Configure a Bond Interface on the Management Ports as described below.

  3. In GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish, enable the VSX mode:

    set vsx on

Note - You can perform Steps 2 - 5 in either Gaia PortalClosed Web interface for the Check Point Gaia operating system. (see Configuring Security Groups in Gaia Portal), or Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). (see Configuring Security Groups in Gaia Clish).

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Create a new Security Group:

  1. In the Network settings section, enter a dummy IP address configuration.

  2. Do not configure the First Time Wizard settings.

3

Assign two available management interfaces ethM-MgmtX and ethN-MgmtY to the Security Group.

4

Assign the applicable Security Appliances to the Security Group.

5

Assign the applicable Uplink portsClosed Interfaces on the Quantum Maestro Orchestrator used to connect to external and internal networks. Gaia operating system shows these interfaces in Gaia Portal and in Gaia Clish. SmartConsole shows these interfaces in the corresponding SMO Security Gateway object. to the Security Group.

6

Connect over the serial console to the Security Appliance with Member ID 1 in this Security Group.

7

Log in to the Expert mode.

8

Go to the Gaia gClish:

gclish

9

Check which eth#-Mgmt# interface has the IP address you assigned to the Security Group.

In our example, we assume it is ethM-MgmtX.

10

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

11

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

12

Assign the real IP address (you wish to use for this Security Group) to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

13

Set the Bonding group as the new Gaia Management InterfaceClosed (1) Interface on a Gaia Security Gateway or Cluster member, through which Management Server connects to the Security Gateway or Cluster member. (2) Interface on Gaia computer, through which users connect to Gaia Portal or CLI.:

set management interface magg<Bond ID>

14

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

15

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

16

Connect to one of the Quantum Maestro Orchestrators.

17

Make sure the Security Group settings are correct.

Step

Instructions

1

Connect to one of the Quantum Maestro Orchestrators.

2

Assign a second available management interface ethN-MgmtY to the Security Group.

You can perform this step in Gaia Portal (see Configuring Security Groups in Gaia Portal), or Gaia Clish (see Configuring Security Groups in Gaia Clish).

In our example, we assume that the interface ethM-MgmtX is already assigned.

3

Connect over the serial console to the Security Appliance with Member ID 1 in this Security Group.

4

Log in to the Expert mode.

5

Go to the Gaia gClish:

gclish

6

Change the IP address on the ethM-MgmtX interface to some dummy IP address:

set interface ethM-MgmtX ipv4-address <Dummy IPv4 Address> mask-length <Mask Length>

7

Add a new Bonding group with this syntax:

add bonding group <Bond ID> mgmt

8

Add the free ethN-MgmtY interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethN-MgmtY

9

Assign the real IP address to the Bonding group with this syntax:

set interface magg<Bond ID> ipv4-address <Real IPv4 Address> mask-length <Mask Length>

10

Set the Bonding group as the new Gaia Management Interface:

set management interface magg<Bond ID>

11

Delete the dummy IP address from the ethM-MgmtX interface:

delete interface ethM-MgmtX ipv4-address

12

Add the free ethM-MgmtX interface (without an IP address) to the bonding group with this syntax:

add bonding group <Bond ID> mgmt interface ethM-MgmtX

13

Connect to one of the Quantum Maestro Orchestrators.

14

Make sure the Security Group settings are correct.

15

In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on.:

  1. From the left navigation panel, click Gateways & Servers.

  2. Open the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object.

  3. From the left tree, click Network Management.

  4. Click Get Interfaces > Get Interfaces With Topology.

  5. Examine the configuration and accept it.

  6. Click OK.

  7. Install the applicable Access Control Policy.