• General
  • General
  • Gaia OS
  • Hardware
  • License
  • Cluster
  • Management and Policy

• Infrastructure
  • SecureXL
  • VSX

• Networking
  • Networking
  • IPv6
  • Carrier Grade NAT (CGNAT)

• Software Blades
  • Firewall
  • VPN
  • Threat Prevention
  • HTTPS Inspection
  • DLP
  • SmartView Monitor
  • QoS
  • SmartProvisioning

• DHCP Client configuration
• DHCP Server configuration
• Dynamically Assigned IP (DAIP) configuration

• Scalable Platforms 40000 / 60000
• Small Business and Branch Offices appliances 3000, 1400, 1200R, or lower.

• Google Chrome 71.0 and later
• Microsoft Edge 40.15063 and later
• Microsoft Internet Explorer 11.0.50 and later
• Firefox 64.0 and later

1. In SmartConsole, click on "Gateways & Servers" on the navigation panel.
2. Right-click on the Maestro Security Appliance gateway object. 
3. The "Scripts" menu and "Actions" menu are not supported.  

• 10 GbE and 40 GbE
• 10 GbE and 100 GbE

• All Security Appliances must have 1 x Quad-Port NIC, 1 x Dual-Port NIC, or 2 x Dual-Port NICs.
• All other Expansion Cards must be removed from all Security Appliances, even if these Expansion Cards are not used.

• eth1-Mgmt1, eth1-Mgmt2, eth1-Mgmt3, eth1-Mgmt4
• eth2-Mgmt1, eth2-Mgmt2, eth2-Mgmt3, eth2-Mgmt4

• General
  • General
  • Gaia OS (Global Shell / Commands)
  • Hardware
  • Management and Policy
  • Dual Site Deployment
  • VoIP
  
  
  
• Installation
  • Installation / Upgrade
  • Licensing

• Infrastructure
  • Security Gateway
  • VSX
  • SecureXL
  • CoreXL
  • Cluster
  • Hyper-Threading
  
  
  
• Networking
  • Networking
  • Dynamic Routing
  • IPv6

• Software Blades
  • IPS
  • VPN
  • Threat Prevention
  • URL Filtering
  • HTTPS Inspection
  • Identity Awareness
  • ConnectControl
  • DLP
  • Logs

• Monitoring
  • SNMP
  • CPView

• set chassis id VALUE alert_threshold cpus_temperature_threshold_low VALUE
• set chassis id VALUE alert_threshold fans_threshold_high VALUE
• set chassis id VALUE alert_threshold fans_threshold_low VALUE
• set chassis id VALUE alert_threshold power_consumption_threshold_perc_high VALUE
• set chassis id VALUE alert_threshold power_consumption_threshold_perc_low VALUE
• set chassis id VALUE modules_amount cmm VALUE
• set chassis id VALUE modules_amount fans VALUE
• set chassis id VALUE modules_amount power_units VALUE

• show chassis high-availability factors sensor cmm
• show chassis high-availability factors sensor fans
• show chassis high-availability factors sensor power_supplies
• show chassis id VALUE alert_threshold cpus_temperature_threshold_high  
• show chassis id VALUE alert_threshold cpus_temperature_threshold_low  
• show chassis id VALUE alert_threshold fans_threshold_high
• show chassis id VALUE alert_threshold fans_threshold_low
• show chassis id VALUE alert_threshold power_consumption_threshold_perc_high
• show chassis id VALUE alert_threshold power_consumption_threshold_perc_low
• show chassis id VALUE modules_amount cmm
• show chassis id VALUE modules_amount fans
• show chassis id VALUE modules_amount power_units

Workaround: Run the 'show snapshots' command again.

Workaround: Run the 'show snapshots' command again.

Relocating the local arguments within the command (where applicable) can resolve the problem. For example, run the 'g_ls /tmp/ -l' command instead of the 'g_ls -l /tmp/' command.

• To export a snapshot, run the 'set snapshot export <image_name> path /var/log/' command.
• To import a snapshot, run the 'set snapshot import <image_name> path /var/log/ name <new_name_for_image>' command.

It takes one minute for the SGM to shut down after running the 'asg_hard_shutdown' command. During this interval, do not run the 'asg_hard_shutdown' command again.

If verification fails, change the QSFP mode on SSMs again:
"set ssm id <SSM_ID> qsfp-ports-mode <Port_Speed>"

(1) The same port type (mgmt / uplink / downlink / external sync / internal sync) must be configured for the same ports.

Example 1: 

If Port 5 on Orchestrator 1_1 is configured as uplink, then Port 5 on Orchestrator 2_1 must also be configured as uplink.

Example 2:

If Port 20 on Orchestrator 1_2 is configured as downlink, then Port 20 on Orchestrator 2_2 must also be configured as downlink.

(2) The split cables and ports, to which they are connected. must be identical.

Example 1:

If a 4x10 DAC is connected to Port 5 on Orchestrator 1_1, then an identical 4x10 DAC must also be connected to Port 5 on Orchestrator 2_1.

Example 2:

If a 4x10 DAC is connected to Port 20 on Orchestrator 1_2, then an identical 4x10 DAC must also be connected to Port 20 on Orchestrator 2_2.

A reset of SIC between the Security Appliances in VSX mode and the Management Server might cause the non-SMO members to change their state to DOWN.

To recover: Reboot the non-SMO members.

1. Assign at least two interfaces to the Security Group.
2. Install the R80.20SP Jumbo Hotfix Accumulator (sk155832) on all Security Appliances in the Security Group.
3. In SmartConsole, create a VSX Gateway object.

Notes:

• To see the current number of entries in the Connections Table, run this command in Expert mode: [Expert@HostName:0]# fw tab -t connections -s
• To configure the Connections Table limit of a Virtual System: In SmartDashboard, open the Virtual System object - go to the "Capacity Optimization" pane - set the value in the "Limit the maximum concurrent connections" field - click on OK - install the policy.

You can manually configure thresholds for Virtual Systems using the 'dbset' command from the Expert shell:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold: <alert_name> <value>

Where <value> is the percentage of the default threshold per SGM.

Example:

[Expert@HostName:0]# g_all dbset chassis:vs:0:alert_threshold:packet_rate_threshold_high 30

In this example, an alert is triggered when any Virtual System packet rate is higher than 30% x 1.8MB (1.8MB is the default packet rate threshold per SGM).

Note:

One ratio applies to all Virtual Systems.

These SecureXL commands are not supported:

• g_fw sam_policy batch
• g_fw6 sam_policy batch

If you need to configure another static route for the eth1-Mgmt4 interface:

1. Remove the current static route to 192.168.1.254
2. Add the required static route for the eth1-Mgmt4 interface. 

1. Connect to the command line of the Check Point appliance.

2. Log into Expert mode.

3. Run this single long command:

[Expert@Appliance:0]# for NIC in $(ifconfig | grep ethsBP | awk '{print $1}') ; do echo $NIC: ; ethtool -i $NIC | grep firmware ; done

4. The 'firmware-version' has to be '12.22.1002' or higher.

Example output:

ethsBP4-01:
firmware-version: 12.22.1002
ethsBP4-02:
firmware-version: 12.22.1002

Note: Configure these VLAN IDs in the Gaia Portal on the Maestro Orchestrator.

Example Topology: (VLAN Trunk port) ==== (Uplink ports on Maestro Orchestrator that are assigned to a Security Group in Bridge mode).

• In BGP DR Manager failback scenarios, the old BGP DR manager will go down for 2 minutes.
• When RouteD daemon restarts on BGP DR Manager, BGP DR Manager will go down for 2 minutes.

• Site-to-Site VPN with IPv6 peers is not supported.
• Remote Access VPN from IPv6 clients is not supported.

Example of a VSX topology:

(Virtual System) === wrp100 === (Virtual Switch) === (eth1-01)

The same distribution mode must be configured for the interface wrp100 as was configured for the interface eth1-01.

• Main address
• Selected address from topology table
• Statically NATed IP