It is very important to keep your Checkpoint environment monitored. Given that it offers a wide variety of SNMP data, I have collected some of the (in my opinion) most useful OIDs MIBs. Altough I use Icinga and Grafana (as you can see the related outputs in this post), almost any monitoring system can be used to get … Read more
Running a top directly on the VSX, I delimited the high to one of the virtual systems that runs on that VSX. In this image the fwk2 threads that … Read more
I manage a 2 node VSX clusterXL environment that hosts 3 firewalls (virtual systems).
Some days ago I came across a problem in which one of them started (or maybe more time ago but not aware) to experience bad performance, outages, timeouts…
Trying to make a failover and move the VS to the other node fixed the problem until … Read more
I have configured my VSX appliances to perfom scheduled backups every week. Today, my icinga monitoring system has raised an alert informing that VSX2 backup has failed.
GAIA provides some commands to get useful data about the execution of the backup processes.
Show the the latest successful backup
… Read more
vsx2:0> show backup last-successful Backup Type: local ( latest ) Backup
Due to some network infrastructure changes, the traffic passing through my internal FW (a Checkpoint VSX virtual system) started to suffer latency and packet loss.
No change had been made to the Checkpoint VSX, but for any reason, since that network changes, Checkpoint was not processing the traffic succesfully.
Performing a top on the VSX appliance containing the active “iNTERNAL … Read more
In my post Checkpoint – Automatic NAT vs Manual NAT I explained both types of NAT clarifying that the Manual NAT makes neccesary the Proxy ARP entry configuration. This example is for a Checkpoint VSX cluster scenario.
The IP that should be configured to answer to ARP request is the 184.108.40.206 (No server … Read more
When suffering random network interruptions, a possible cause (and diffcult to find) is our firewall ARP table overflow. In Checkpoint systems, the Linux kernel Gaia is based on would log messages like "kernel: neighbour table overflow" to /var/log/messages.
After living two small crisis due to this problem (network scanning software and mask B networks are dangerous for the … Read more
Having our Checkpoint VSX Virtual System active connections under control can be very important to avoid problems, configure a higher connection limit, be ready for growth (and so scalate our environment)…
Steps needed to configure the plugin:
- SNMP OID for virtual systems active connections
- Develop an script
When trying to perform SNMP queries in an VSX environment, data related to virtual systems may be returned always as 0 value. By default, R77.10 and R77.20 vsx systems behave this way. For example, this is an SNMP query to get the concurrent connections of the phisical VSX and its virtual systems:
… Read more
# /usr/bin/snmpwalk -v1 -c public 10.0.5.5 vsxCountersConnNum CHECKPOINT-MIB::vsxCountersConnNum.1.0
There are several reasons to force a failover on a firewall cluster (in this case a virtual system on a 2 node Checkpoint VSX cluster). For example, testing, analyzing or maintenance purposes.
First of all, we can check the cluster and virtual systems states by executing the command on the VS0 (on Gaia clish or expert mode):
… Read more