Configuring VSX Gateways

Creating a New VSX Gateway

Notes: It is not supported to convert an existing Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. to a VSX Gateway Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0.. It is not supported to convert an existing VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Gateway to a Security Gateway.

This section explains how to create a new VSX Gateway using the VSX Gateway Wizard.

After you complete the VSX Gateway Wizard, you can change the VSX Gateway definition from SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

For example, you can add or delete interfaces, or configure existing interfaces to support VLANs.

To start the VSX Gateway wizard:

1. Connect with SmartConsole to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Main Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that manages the VSX Gateway.

2. From the left navigation panel, click Gateways & Servers.

3. At the top, click New > VSX > Gateway.

   The General Properties page of the VSX Gateway Wizard opens.

Wizard Step 1: Defining VSX Gateway General Properties

Configure these parameters on the General Properties page:

• VSX Gateway Name: Unique, alphanumeric name for the VSX Gateway. The name cannot contain spaces or special characters except the underscore.

• VSX Gateway Addresses: Management interface addresses.

  Note - If you define an IPv6 IP address you must also define an IPv4 address.

• VSX Gateway Version: Select the VSX version installed on the VSX Gateway from the drop-down list.

Wizard Step 2: Establishing SIC Trust

Initialize SIC Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. trust between the VSX Gateway and the Management Server.

They cannot communicate without Trust.

Initializing SIC Trust

When you create a VSX Gateway, you must enter the same Activation Key you entered during the First Time Configuration Wizard.

Enter and confirm the activation key and then click Initialize.

If you enter the correct activation key, the Trust State changes to Trust established.

Troubleshooting SIC Trust Initialization Problems

If SIC trust was not successfully established, click Check SIC Status to see the reason for the failure.

The most common issues are an incorrect activation key and connectivity problems between the Management Server and the VSX Gateway.

Troubleshooting to resolve SIC initialization problems:

• Re-enter and re-confirm the activation key.

• Make sure that the IP address defined in General Properties is correct.

• Ping the Management Server to test the connectivity. Resolve connectivity issues.

• From the VSX Gateway command line, use the cpconfig command to re-initialize SIC.

  After this process completes, click Reset in the wizard and then re-enter the activation key.

For more about resolving SIC initialization, see the R81 Security Management Administration Guide.

Wizard Step 3: Defining Physical Interfaces

In the VSX Gateway Interfaces window, define physical interfaces as VLAN trunks.

The window shows the interfaces currently defined on the VSX Gateway.

To define an interface as a VLAN trunk, select VLAN Trunk for the interface.

Wizard Step 4: Virtual Network Device Configuration

If you chose the Custom Configuration option, the Virtual Network Device Configuration window opens.

In this window, define a Virtual Device Logical object that emulates the functionality of a type of physical network object. Virtual Device can be on of these: Virtual Router, Virtual System, or Virtual Switch. with an interface shared with the VSX Gateway.

If you do not want to define a Virtual Device at this time, click Next to continue.

To define a Virtual Device with a shared interface:

Note - Configuration with a Non-Dedicated Management Interface Shared physical interface on VSX Gateway or VSX Cluster Members (supported only in versions R80.40 and lower), which carries user "production" traffic and through which Check Point Security Management Server or Multi-Domain Server connects to VSX Gateway or VSX Cluster Members. Non-DMI configuration requires the use of a Virtual Router or Virtual Switch. Acronym: Non-DMI. (Non-DMI, shared interface) is deprecated and not supported.

1. Select Create a Virtual Device.

2. Select the Virtual Network Device type (Virtual Router or Virtual Switch).

3. Select the Shared physical interface to define a non-DMI VSX Gateway.

   Do not select the management interface if you want to define a Dedicated Management Interface (DMI) VSX Gateway.

   If you do not define a shared Virtual Device, a DMI VSX Gateway is created by default.

   Important - This setting cannot be changed after you complete the VSX Gateway Wizard. If you define a non-DMI VSX Gateway, you cannot change it to a DMI VSX Gateway later.

4. Define the IP address and Net Mask for a Virtual Router Virtual Device on a VSX Gateway or VSX Cluster Member that functions as a physical router. Acronym: VR..

   These options are not available for a Virtual Switch Virtual Device on a VSX Gateway or VSX Cluster Member that functions as a physical switch. Acronym: VSW..

5. Optional: Define a Default Gateway for a Virtual Router (DMI only).

Wizard Step 5: VSX Gateway Management

In the VSX Gateway Management window, define security policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. rules that protect the VSX Gateway.

This policy is installed automatically on the new VSX Gateway.

Note - This policy applies only to traffic destined for the VSX Gateway. Traffic destined for Virtual Systems, other Virtual Devices, external networks, and internal networks is not affected by this policy.

The security policy consists of predefined rules for these services:

• UDP - SNMP requests

• TCP - SSH traffic

• ICMP - ICMP Echo (ping)

• TCP - HTTPS traffic

Completing the VSX Wizard

Click Next to continue and then click Finish to complete the VSX Gateway wizard.

This may take several minutes to complete.

A message shows successful or unsuccessful completion of the process.

If the process ends unsuccessfully, click View Report to see the error messages.

See VSX Diagnostics and Troubleshooting.

Configuring the Security Policy

1. Allow: Select to pass traffic on the selected services.

   Clear this option to block traffic on this service.

   By default, all services are blocked.

   For example, to be able to ping the VSX Gateway from the Management Server, allow ICMP traffic.

2. Source: Click the arrow and select a Source Object from the list.

   The default value is *Any.

   Click New Source Object to define a new source.