Installing a Traditional VSX Gateway

Notes: Starting in R82, there are two modes: "VSNext" (new). See Installing a cluster in the VSNext mode. "Traditional VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts." (formerly called just "VSX"). This configuration is described below. This procedure applies to both Check Point Appliances and Open Servers. This procedure does not apply to Check Point Small Office Appliance models lower than 3000.

Procedure:

1. Install the Traditional VSX Gateway

   Step	Instructions
   1	Install the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Operating System: Installing the Gaia Operating System on Check Point Appliances Installing the Gaia Operating System on Open Servers
   2	Follow Configuring Gaia for the First Time.
   3	During the First Time Configuration Wizard, you must configure these settings: In the Installation Type window, select Security Gateway and/or Security Management. In the Products window: In the Products section, select Security Gateway only. In the Clustering section, clear Unit is a part of a cluster, type. In the Dynamically Assigned IP window, select the applicable option. In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).
   4	Install a valid license. See Working with Licenses.

2. Configure the Traditional VSX Gateway object in SmartConsole

   The steps below are only for a Clean Install Installation of a Check Point Operating System from scratch on a computer. of a new Traditional VSX Gateway Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0.. To configure a Traditional VSX Gateway that failed, see the R82 VSX Administration Guide > Chapter Command Line Reference > Section vsx_util > Section vsx_util reconfigure. The steps below are for the Dedicated Management Interfaces (DMI) configuration. For the non-DMI configuration, see the R82 VSX Administration Guide.

   Step	Instructions
   1	Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Main Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that should manage this Traditional VSX Gateway.
   2	From the left navigation panel, click Gateways & Servers.
   3	Create a new VSX Gateway object in one of these ways: From the top toolbar, click the New () > VSX > Gateway. In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > VSX > New Gateway. In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > VSX > Gateway. The VSX Gateway Wizard opens.
   4	On the VSX Gateway General Properties (Specify the object's basic settings) page: In the Enter the VSX Gateway Name field, enter the applicable name for this VSX Gateway object. In the Enter the VSX Gateway IPv4 field, enter the same IPv4 address that you configured on the Management Connection page of the VSX Gateway's First Time Configuration Wizard. In the Enter the VSX Gateway IPv6 field, enter the same IPv6 address that you configured on the Management Connection page of the VSX Gateway's First Time Configuration Wizard. In the Select the VSX Gateway Version field, select R82. Click Next.
   5	On the VSX Gateway General Properties (Secure Internal Communication) page: In the Activation Key field, enter the same Activation Key you entered during the VSX Gateway's First Time Configuration Wizard. In the Confirm Activation Key field, enter the same Activation Key again. Click Initialize. Click Next.
   	If the Trust State field does not show Trust established, perform these steps: Connect to the command line on the VSX Gateway. Make sure there is a physical connectivity between the VSX Gateway and the Management Server (for example, pings can pass). Run: cpconfig Enter the number of this option: Secure Internal Communication Follow the instructions on the screen to change the Activation Key. In SmartConsole, on the VSX Gateway General Properties page, click Reset. Enter the same Activation Key you entered in the cpconfig menu. In SmartConsole, click Initialize.
   6	On the VSX Gateway Interfaces (Physical Interfaces Usage) page: Examine the list of the interfaces - it must show all the physical interfaces on the VSX Gateway. If you plan to connect more than one Virtual System directly to the same physical interface, you must select VLAN Trunk for that physical interface. Click Next.
   7	On the Virtual Network Device Configuration (Specify the object's basic settings) page: You can select Create a Virtual Network Device and configure the first applicable Virtual Network Device at this time (we recommend to do this later) - Virtual Switch or Virtual Router. Click Next.
   8	On the VSX Gateway Management (Specify the management access rules) page: Examine the default access rules. Select the applicable default access rules. Configure the applicable source objects, if needed. Click Next. Important - These access rules apply only to the VSX Gateway (context of VS0), which is not intended to pass any "production" traffic.
   9	On the VSX Gateway Creation Finalization page: Click Finish and wait for the operation to finish. Click View Report for more information. Click Close.
   10	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v
   11	Open the Traditional VSX Gateway object.
   12	On the General Properties page, click the Network Security tab.
   13	Enable the applicable Software Blades for the Traditional VSX Gateway object itself (context of VS0). Refer to: sk79700: VSX supported features sk106496: Software Blades updates Applicable Administration Guides on the R82 Home Page.
   14	Click OK to push the updated VSX Configuration. Click View Report for more information.
   15	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v
   16	Install the default policy on the VSX Gateway object: Click Install Policy. In the Policy field, select the default policy for this VSX Gateway object. This policy is called: <Name of VSX Gateway object>_VSX Click Install.
   17	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v
   18	Configure the applicable Threat Prevention Policy for this Traditional VSX Gateway.
   19	Install the applicable Threat Prevention Policy on the Traditional VSX Gateway object: Click Install Policy. In the Policy field, select the applicable Threat Prevention Policy for this Traditional VSX Gateway object. Click Install.
   20	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v

3. Configure the Traditional Virtual Devices and their Security Policies in SmartConsole

   Step	Instructions
   1	Connect with SmartConsole to the Security Management Server, or each Target Domain Management Server that should manage each Traditional Virtual Device.
   2	Configure the applicable Traditional Virtual Devices on this VSX Gateway.
   3	Configure the applicable Access Control Policies for these Traditional Virtual Devices.
   4	Install the configured Access Control Policies on these Traditional Virtual Devices.
   5	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v
   6	Configure the applicable Threat Prevention Policies for these Traditional Virtual Devices.
   7	Install the configured Threat Prevention Policies on these Traditional Virtual Devices.
   8	Examine the VSX configuration: Connect to the command line on the VSX Gateway. Log in to the Expert mode. Run: vsx stat -v