Preparing the Security Gateway, each Cluster Member, Security Group

Step

Instructions

Select a designated physical interface for Mirror and Decrypt on the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster Member Security Gateway that is part of a cluster. / Scalable Platform Security Group.

Important - On cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. members, you must select an interface with the same name (for example, eth3 on each cluster member).

Configure a dummy IP address on this designated physical interface.

Important - This IP address cannot collide with other IP addresses used in your environment. This IP address cannot belong to subnets used in your environment. Make sure to configure the correct subnet mask. After you enable traffic mirroring on this interface in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., all other traffic that is routed to this interface is dropped.

For instructions about configuring an IP address on a physical interface, see the R81 Gaia Administration Guide - Chapter Network Management - Section Network Interfaces - Section Physical Interfaces.

Configure the required Maximum Transmission Unit (MTU) on this designated physical interface.

MTU has to be the default 1500, or at least the maximal MTU value from other interfaces on the Security Gateway / Cluster Member / Security Group.

For instructions about configuring an MTU on a physical interface, see the R81 Gaia Administration Guide - Chapter Network Management - Section Network Interfaces - Section Physical Interfaces.

Important - On cluster members, you must configure this designated physical interface in the $FWDIR/conf/discntd.if file on each Cluster Member.

Connect to the command line on each Cluster Member.
Log in to the Expert mode.

Create the $FWDIR/conf/discntd.if file:

touch $FWDIR/conf/discntd.if

Edit the $FWDIR/conf/discntd.if file in the Vi editor:

vi $FWDIR/conf/discntd.if

Write the name of the designated physical interface. After the interface name, you must press Enter.

Note - Comments are not allowed in this file.
Save the changes in the file and exit the editor.

Note - To apply the configuration from the file and make it persistent, install an Access Control Policy on the cluster object. You install the Access Control Policy later, after the required configuration steps in the SmartConsole.