Checkpoint   Checkpoint – VSX Virtual Memory full – Enable 64 bit



Symptoms

I manage a 2 node VSX clusterXL environment that hosts 3 firewalls (virtual systems).
Some days ago I came across a problem in which one of them started  (or maybe more time ago but not aware) to experience bad performance, outages, timeouts…

Trying to make a failover and move the VS to the other node fixed the problem until … Read more

Checkpoint   Checkpoint – Database Revision Control



“Database Revision Control” is a really useful feature when you are going to make important and/or many changes in the firewall policy, objects…

To make an analogy, DRC are like snapshots (as in the case of VMWare of a virtual machine) of the policies, objects, etc … everything that contains the database of the management server of Checkpoint is backed … Read more

Checkpoint   Checkpoint – GAIA commands to check backup status and logs



I have configured my VSX appliances to perfom scheduled backups every week. Today, my icinga monitoring system has raised an alert informing that VSX2 backup has failed.

Icinga monitoring checkpoint VSX backups

GAIA provides some commands to get useful data about the execution of the backup processes.

last-successful

Show the the latest successful backup

vsx2:0> show backup last-successful
Backup Type: local ( latest )
Backup 
Read more

Checkpoint   Checkpoint – dropped Reason: UDP packet that belongs to an old session



Problem

Last week I came across a DHCP problem. Devices from certain VLAN were not getting DHCP assigned IP.

Even though firewall policy should have accepted those packets, tcpdump showed Checkpoint gateway was not forwarding them to the destination.

To capture DHCP traffic:

# tcpdump -n -i <interface> port 67 or port 68 -e

Incoming interface DHCP tcpdump:

# tcpdump 
Read more

Checkpoint   Checkpoint – Incrementing virtual system instances to solve cpu overload



Due to some network infrastructure changes, the traffic passing through my internal FW (a Checkpoint VSX virtual system) started to suffer latency and packet loss.

No change had been made to the Checkpoint VSX, but for any reason, since that network changes, Checkpoint was not processing the traffic succesfully.

Performing a top on the VSX appliance containing the active “iNTERNAL … Read more

Checkpoint   Checkpoint – Hide NAT vs Static NAT



This post tries to be a simple explanation of the Hide NAT and Static NAT concepts.
Given the following simple company network let’s see how this NAT types could fit in this scenario:

Hide Static NAT example scenario

  • We need the web server to be published, so it needs to be accesible from the Internet
  • We need all the workstations to be able to browse
Read more

Checkpoint   Checkpoint – Reinstall SMS using configuration backup



Last week my smartcenter server became corrupted (the filesystem) and I could not install any fw policy (checkpoint software could not find some needed inodes).

Fortunately I perform periodically checkpoint configuration backups (using the migrate export utility) this way -> Checkpoint – Schedule management database backup

These are the steps to get a working SMS again:

  1. Pre install steps
  2. Install
Read more

Checkpoint   Checkpoint – Proxy ARP for manual NAT on VSX



In my post Checkpoint – Automatic NAT vs Manual NAT I explained both types of NAT clarifying that the Manual NAT makes neccesary the Proxy ARP entry configuration. This example is for a Checkpoint VSX cluster scenario.

This is an example that was used:
Checkpoint host general properties
Checkpoint NAT rule

The IP that should be configured to answer to ARP request is the 80.80.100.100 (No server … Read more

Checkpoint   Checkpoint – Nagios plugin to monitor ARP table in VSX



When suffering random network interruptions, a possible cause (and diffcult to find) is our firewall ARP table overflow. In Checkpoint systems, the Linux kernel Gaia is based on would log messages like "kernel: neighbour table overflow" to /var/log/messages.

After living two small crisis due to this problem (network scanning software and mask B networks are dangerous for the … Read more