Working with Virtual Systems

This section presents procedures for creating and configuring Virtual Systems.

Introduction

The Virtual SystemClosed Virtual Device on a VSX Gateway or VSX Cluster Member that implements the functionality of a Security Gateway. Acronym: VS. definition process varies somewhat according to the template selected when creating the VSX GatewayClosed Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0..

A typical Virtual System contains two interfaces:

  • External interface leading to external networks, a DMZ, or the Internet

  • Internal interface leading to internal networks or servers, often by means of a VLAN trunk

VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. supports up to 128 interfaces for each Virtual DeviceClosed Logical object that emulates the functionality of a type of physical network object. Virtual Device can be on of these: Virtual Router, Virtual System, or Virtual Switch. and a total of up to 4096 interfaces per VSX Gateway or clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing..

The supported interfaces include VLANs and Warp Links.

Note - By default, a Virtual System supports up to 64 interfaces. For more about how to increase the number of supported interfaces, see sk99121.

You can add as many interfaces to a Virtual System as required, according to system resources.

Here is an example of a typical VSX Gateway deployment with two Virtual Systems, each with two interfaces.

Item

Description

 

Item

Description

1

Internet

 

8

Virtual System 2

2

Router

 

9

VLAN Switch

3

VSX Gateway

 

10

Network 1

4

Virtual SwitchClosed Virtual Device on a VSX Gateway or VSX Cluster Member that functions as a physical switch. Acronym: VSW.

 

11

Network 2

5

External Interface

 

VLAN Interface

6

Virtual System 1

 

VLAN Trunk

7

Internal Interface

 

Warp LinkClosed Logical interface that is created automatically in a VSX topology between: (1) Virtual System and Virtual Switch (2) Virtual System and Virtual Router. Acronym: WRP.

Creating a New Virtual System

You use the Virtual Systems Wizard to create a new Virtual System. Modify the initial definition and configure advanced options after you complete the wizard.

To start the Virtual System wizard:

  1. Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Target Domain Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that manages the new Virtual System.

  2. From the left navigation panel, click Gateways & Servers.

  3. Create a new Virtual System object in one of these ways:

    • From the top toolbar, click the New () > VSX > New Virtual System.

    • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > VSX > New Virtual System.

    • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > VSX > Virtual System.

    The Virtual System Wizard opens.

  4. Configure the applicable settings in the wizard as described below.

  5. Install the applicable Access Control Policy on the new Virtual System object.

Modifying a Virtual System

  1. Connect with SmartConsole to the Security Management Server or Target Domain Management Server used to manage the Virtual System.

  2. From the Gateways & Servers view or Object Explorer, double-click the Virtual System object.

  3. Configure the applicable settings as described below.

  4. Click OK to push the VSX Configuration.

  5. Install the applicable Access Control Policy on the new Virtual System object.

Deleting a Virtual System

To delete a Virtual System:

  1. From the Gateways & Servers view or Object Explorer tree, right-click the Virtual System object and select Delete.

  2. In the window that opens, click Yes.

Configuring DNS Servers on a Virtual System

GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. uses the Domain Name Service (DNS) to translate host names into IP addresses.

To enable DNS lookups, you must enter the primary DNS server for your system. You can also enter secondary and tertiary DNS servers.

When the system resolves host names, it consults the primary name server. If a failure or time-out occurs, the system consults the secondary name server, and if necessary, the tertiary.

You can also define a DNS Suffix, which is a search for host-name lookup.

From R81, it is possible to configure each Virtual System:

Important:

  • You can configure one or all of the above specific DNS settings on a Virtual System.

    To configure and use any of the above specific DNS settings, you must enable the entire feature on the VSX Gateway (each VSX Cluster MemberClosed Security Gateway that is part of a cluster.).

  • By default, this feature is disabled:

    All Virtual Systems you create use the global DNS settings configured on the VSX Gateway or VSX Cluster Member.

  • When you enable this feature:

    1. The default DNS settings in the context of VS0 become the same as the global DNS settings configured on the VSX Gateway or VSX Cluster Member.

    2. The default DNS settings in the context of every new Virtual System become the same as the DNS settings in the context of VS0.

  • When you disable this feature:

    The global DNS settings on the VSX Gateway or VSX Cluster Member become the same as the DNS settings in the context of VS0.

  • You must configure all DNS settings in Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). on the VSX Gateway (each VSX Cluster Member).

  • In a VSX Cluster, you must configure all the VSX Cluster Members in the same way.

  • Some programs that use POSIX sockets to resolve hostnames (for example, ping and ssh) fail to do so when they resolve names without “.” in them. These programs rely on the DNS search suffix.

  • For Software Blades that require contracts or updates to function, you must configure the DNS servers in the context of the VSX Gateway or VSX Cluster Member itself (context of VS0). For additional information, see sk106496.