1. Install Security Management Server / Multi-Domain Security Management Server:
Install SmartConsole for Management Server.
Enable the CloudGuard Controller by running the 'cloudguard on' command (refer to the relevant CloudGuard Controller Administration Guide, chapter "Integrating with Data Center Servers", section "Enabling the CloudGuard Controller")
Install the Service Registration Hotfix on the Management Server. Refer to section 3 above for the supported Hotfixes and management versions.
3. How to upgrade to CloudGuard Service Registration
Upgrade to Management Server if needed.
Install the new CloudGuard Service Registration Hotfix. The Security Management Server with the new CloudGuard registration Hotfix re-attaches itself to a Gateway that has already been deployed. All services continue as they did before the upgrade.
Important Notes about upgrading a CloudGuard Service Registration:
Upgrading to a newer Service Insertion Hotfix is applicable only from VSRv5.
Refer to the instructions in sk141955. Only R80.10 Management with R80.10 jumbo Hotfix Take 112 is supported.
Transfer the hotfix package to the machine (into some directory, e.g., /some_path_to_fix/).
Unpack and install the hotfix package: [Expert@HostName:0]# cd /some_path_to_fix/ [Expert@HostName:0]# tar -zxvf Check_Point_R77.30_vSEC_Controller_Enforcer_Hotfix_Gaia_sk115772.tgz [Expert@HostName:0]# ./fw1_wrapper_HOTFIX_GIRAFFE_V2_<BUILD> Note: The script will stop all of Check Point services (cpstop) - read the output on the screen.
Transfer the hotfix package to the machine (into some directory, e.g., /some_path_to_fix/).
Unpack and install the hotfix package: [Expert@HostName:0]# cd /some_path_to_fix/ [Expert@HostName:0]# tar -zxvf Check_Point_R77.30_vSEC_Controller_Enforcer_Hotfix1_Gaia_sk111963.tgz [Expert@HostName:0]# ./fw1_wrapper_HOTFIX_GIRAFFE_V2_<BUILD> Note: The script will stop all of Check Point services (cpstop) - read the output on the screen.
When using CloudGuard Controller for ACI, the Default GW for servers needs to be defined as a Bridge Domain Subnet in order for IP entries of silent endpoints not to be aged out by the fabric.
In this scenario, the VS connectors can be configured as:
L2-adjacent ('General') GoTo deployments can define a dummy IP address as Default GW for the subnet. In this case, a VRF split is necessary in order to prevent firewall bypass.
L3-adjacent
-
IPv6 was not supported.
-
Dynamic Routing configuration via Device Package is not supported. Dynamic Routing requires manual configuration in Gaia Clish.
Install R80.10 Security Management Server / Multi-Domain Security Management Server
Install R80.10 SmartConsole for R80.10 Management Server
Enable the CloudGuard Controller by running the "vsec on" command (refer to the R80.10 CloudGuard Controller Administration Guide - chapter "Integrating with Data Center Servers" - section "Enabling the CloudGuard Controller")
Install CloudGuard Service Registration v3 Hotfix on R80.10 Management Server:
Package
CPUSE Online Identifier
CPUSE Offline
CloudGuard Service Registration v3 Hotfix for R80.10 Management Server
Transfer the hotfix package to the machine (into some directory, e.g., /some_path_to_fix/).
Unpack and install the hotfix package: [Expert@HostName:0]# cd /some_path_to_fix/ [Expert@HostName:0]# tar -zxvf Check_Point_R77.30_vSEC_Controller_Enforcer_Hotfix_Gaia_sk115772.tgz [Expert@HostName:0]# ./fw1_wrapper_HOTFIX_GIRAFFE_V2_<BUILD> Note: The script will stop all of Check Point services (cpstop) - read the output on the screen.
Added "CloudGuard for ACI managed by R80.10 Management Server"
09 Apr 2017
Redesigned the entire article.
Added information about "R77.30 CloudGuard v2 for ACI managed by R80 CloudGuard Controller v2"
28 Feb 2017
Minor text corrections.
26 Feb 2017
Minor text corrections.
12 Feb 2017
Updated the instructions for "R77.30 vSEC v1 for ACI managed by R80 CloudGuard Controller v1" to say "Take_159 and above of Jumbo Hotfix Accumulator for R77.30".
