NAT and the Correction Layer on a VSX Gateway
In a VSX Gateway
Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0., the guidelines in NAT and the Correction Layer on a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. apply to each Virtual System individually.
For best results, manage an entire session by a specified Virtual System on the same Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. Member.
When a Virtual Switch (junction) connects several Virtual Systems, the same session can be handled by one Virtual System on one Security Group Member, and by another Virtual System on a different Security Group Member.
When a packet reaches a Virtual System from a junction, the system VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Stateless Correction Layer checks the distribution again according to the Distribution Mode configured on the WRP interface. It can decide to forward the packet to a different Security Group Member.
In addition, on each Virtual System, the stateful Correction Layer can forward session packets, similar to the Security Gateway.
All forwarding operations have a performance impact. Therefore, the Distribution Mode configuration should minimize forwarding operations.
To achieve optimal distribution between Security Group Members in a Security Group in VSX mode:
|
NAT Rules |
Guidelines |
|---|---|
|
Not using NAT rules on any Virtual System |
Set the Distribution Mode to General. |
|
Using NAT rule |
|