Come to Munich to talk about Check Point

It is not too late to attend the most open and interesting technical discussion of the year - Check Point User Group conference in Munich. We have the best experts and we have beers, what could be a better combination?

Check the agenda, consider to stay two more days for custom training.

See you there, guys.

How to read some of Check Price licensing instructions (not a happy post)

Here is a logics exercise. Read the following quote from the Check Point licensing instruction:

"Starting from the 4800 model and above, each appliance running R75.40VS, R76 includes a total of 2 Virtual Systems (all SW Blades available on the GW are automatically supported on the free VS)"

Now, tell me, how many Virtual Systems can one run on a cluster of middle and high end appliances with the default, non VSX, licensing, according to Check Point?

Two, right?

Wrong. You can easily test it by yourself. Convert your physical cluster of R75.40VS or R76 to a VSX cluster. Once done, you will have your firewall converted to a Virtual System. That is VS number one. Now, try to add another VS. No, you cannot.

Why? Because there is only a single VS licensed, according to vsx stat:

Number of Virtual Systems allowed by license:     1

But where is the second one we should have? Where is our freebee FW?

Well, it was all just an illusion, according to a very recent Check Point SecureKnowledge case number 93415. Here is the quote from it (original orthography used): "the answer is that it comes with an initial gateway +1. so in the bottom line initial 2 vs license only covers VS0 and VS1."

Let me translate this for you from Checkpoint-ish. In plain English, that means you only have one VS licensed (VS1). VS0 is representing your physical cluster environment. After conversion to VSX it cannot route traffic anymore.

I wonder, how many customers have already misunderstood the quoted price list statement? R75.40VS is out for a year, and this confusion must be one year old. Then again, the mentioned SecureKnowledge case is only about two weeks old.

21.08.2013 - Update:

Peter Sandkuill, Check Point SE manager network security for Europe, was kind to reply to  this article. I am quoting his email:

"In the latest versions, starting R75.40vs, we consider VS0 to be the first virtual system. We can debate whether you want to use that exclusively for management (as a best practice) or deploy it as a full-fledged VS that runs just like other VS’s and happens to also accept management traffic as one of its interfaces is the management interface. If you convert a gateway all regular gateway interfaces become a member of VS0. This will route traffic just fine. Only if you decide to remove all interfaces and leave only a single one for management would it no longer route, as you would expect.
Especially when designing virtualization in smaller environments this is a compromise I have seen customers willing to make.

For the licensing part, VS0 is the licensed system. You get VS1 for free. Also note that when adding an additional VS package you lose that free VS. In example in a (to VSX) converted gateway you could have 2 * VS. VS0 and VS1. Adding a VS-10 package will give you a grand total of 11 * VS. VS0 and 10 additional ones."

Smart-1 upgrade to R75.40VS fails miserably with grub corruption and other issues

It is the second day on the row we are trying to upgrade two Smart-1 25 appliances from R75.10 to R75.40VS.

On the first trial we were doing SPLAT WebUI based upgrade. It has failed because of corruption of grab.conf that would not allow the machine to boot normally. Symptoms and solution are described in SK66029.

System was not bootable even after reverting to the original image of R75.10, so we have had to apply the solution anyway.

Hoping Gaia would be better, we have tried it now. Guess what? The machine is in a loop: booting and restoring image all the time.

grub.conf seems to be OK, but the system is no longer operational.

Hello, Check Point, any QA these days? We know the upgrade works on VMs, but what about testing your own alliance lines?

Personal invitation to Check Point Best Practices course

I will be teaching two days of Check Point Best Practices course in Munich as part of extended CPUG gathering.

I would like to use this opportunity to invite you to my class. We will be covering the following topics:

• Disaster recovery, backup techniques and tricks around them
• Upgrades and migrations done right
• Design of Check Point security systems
• Unknown and undocumented tools
• SPLAT and GAIA tricks

The course was originally started as a series of internal trainings for my colleagues. In the last several years it evolved into by far most popular training in my portfolio. Come and see why.

You can register to the course on CPUGcon registration page.

Thanks a lot for your interest.

Will I see you in Munich on CPUG conference?

Hello all!

Just a reminder, there is still some time to register to CPUGcon 2013. I would like to see you there during the conference and maybe even on one (better mine :-)) of the following classes.

Are you coming?

Check Point announces End of Sales for IP Appliances

Check Point will discontinue sales of the remaining IP appliances by the end of year 2013. That concludes the long and somewhat dramatic history of Nokia Security Appliances Business which was sold to Check Point almost 5 years ago.

Check Point customers may finally concentrate on a single appliance line, with GAIA as the main choice of OS.

With all its ups and downs, IPSO was quite interesting OS. For starters, it is based on BSD kernel while SPLAT and GAIA are based on RH Linux. In my personal opinion, GAIA still has some distance to cover before being as good as IPSO in terms of stability and features.

Anyhow, yet another page of network security history is about to be closed.

VSX provisioning bypass actually works on R75.40VS

In my previous post I have said VSX bypass debug commands do not work. I was wrong.
The trick works perfectly on R75.40VS Management, both SmartCenter and MDM.

Nevertheless, the weird part is that it only works if one types the commands manually and not by copy / paste. I guess it was only about some weird corruption when pasted from the buffer.

I am sorry for being wrong before and for all time spent on this topic by David Bar, Shahar Solomon, Eran Ashkenazi and other Check Point engineers. I appreciate the assistance.