Security Gateway Virtual Edition

Transcription

1 Security Gateway Virtual Edition R71 Release Notes 9 February 2012 Classification: [Restricted]

2 2012 Check Point Software Technologies Ltd. All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying, distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior written authorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors or omissions. This publication and features described herein are subject to change without notice. RESTRICTED RIGHTS LEGEND: Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS and FAR TRADEMARKS: Refer to the Copyright page ( for a list of our trademarks. Refer to the Third Party copyright notices ( for a list of relevant copyrights and third-party licenses. VMware, VMware VMotion and VMware vsphere are registered trademarks and/or trademarks of VMware, Inc. in the United States and/or other jurisdictions.

3 Important Information Latest Version The latest version of this document is at: For more technical information, visit the Check Point Support Center ( Revision History Date 6 September 2011 Abra is supported on Network Mode. 27 July 2011 Dynamic Routing is supported on Network Mode. 9 March 2011 Added known limitation Updated known limitation February 2011 Added known limitation January 2011 Added supported platforms. Updated known limitations. New build number. 8 November 2010 Initial version. Feedback Check Point is engaged in a continuous effort to improve its documentation. Please help us by sending your comments (mailto:cp_techpub_feedback@checkpoint.com?subject=feedback on Security Gateway Virtual Edition R71 Release Notes).

4 Contents Important Information... 3 Introduction... 5 What's New... 5 Selecting an Operation Mode... 6 Supported Features and Software Blades... 6 System Requirements... 7 Supported Builds and Platforms... 7 Known Limitations... 8 Security Gateway Virtual Edition Limitations... 8 Non-supported R71 Features... 8 VMware Feature Limitations... 8 General Limitations... 8 Hypervisor Mode Limitations... 9 Non-supported R71 Features... 9 Network Limitations...10 ESX Configuration Limitations...10 General Limitations...11 Hypervisor Mode Cluster Deployment Limitations...11 Non-supported R71 Features...11 Network Limitations...11 General Limitations...12

5 Introduction Introduction Check Point Security Gateway Virtual Edition protects dynamic virtual environments and external networks from internal and external threats by securing virtual machines and applications. This solution uses proven Check Point security technologies: Software Blade architecture, Firewall with content inspection, IPS, central management, and more. Security Gateway Virtual Edition has different operation modes. Decide which is best for your environment and plan the installation accordingly. The Hypervisor Mode enforces VM security within the VMware Hypervisor by inspecting inter-vm traffic, without changing the virtual network topology. The Network Mode is deployed as a virtual network device to protect virtual networks and physical environments. You can configure it as a router or a bridge, in the same way as a physical gateway. Note - All references to ESX throughout the document are also relevant for ESXi unless specifically noted otherwise. What's New Hypervisor Mode: Protects VMs and traffic between VMs. Secures dynamic virtual environments without network topology changes. Supports VMware VMsafe. Protects against security breaches caused by configuration errors. Gives out-of-the-box protection with easy configuration. Supports R71 Software Blade architecture. Maximizes security granularity at the vswitch, port group, and VM levels. Supports ESX clusters for VM high availability and load sharing. Enforces security with no downtime during vmotion migration. Lets growing enterprises protect expanding virtual networks while reducing hardware investment, maintenance, energy, and site costs. Optimizes performance for virtual environments. Network Mode: Operates as a layer-2 or layer-3 Security Gateway for virtual network environments. Supports ClusterXL for high availability and load sharing. Enforces security with no downtime during vmotion migration. Supports vmotion on the Security Gateway Virtual Edition virtual machine. Lets growing enterprises protect expanding virtual networks while reducing hardware investment, maintenance, energy, and site costs. Optimizes performance for virtual environments. Security Gateway Virtual Edition Release Notes R71 5

6 Introduction Selecting an Operation Mode To select the mode that is optimal for your environment, compare VMware and Check Point features. VMware Features Hypervisor Mode Network Mode VMotion for 3rd party VMs Yes Yes VMotion for the Security Gateway Virtual Edition VM No Yes DRS Yes Yes VMSafe Integration Yes No vshield No No Fault Tolerance No No DVS Yes Yes Nexus 1000v Yes Yes Supported Features and Software Blades Features and Software Blades Hypervisor Mode Network Mode Firewall Yes Yes NAT No Yes IPsec VPN No Yes IPS Yes Yes URL Filtering Yes Yes Security and Anti-Spam No Yes CoreXL No Yes ClusterXL No Yes IPv6 No Yes SSL VPN No Yes SSL Network Extender No Yes Mobile Client No No QoS No Yes Dynamic Routing No Yes Web Security Yes Yes VoIP No Yes Security Gateway Virtual Edition Release Notes R71 6

7 System Requirements Features and Software Blades Hypervisor Mode Network Mode Abra No Yes Anti-Malware Limited* Yes * See in Known Limitations ("Non-supported R71 Features" on page 9). System Requirements Item Minimum Recommended Notes Memory 512 MB 2.5 GB Add more memory to inspect many connections concurrently. Disk Space 12 GB 12 GB Number of Virtual CPUs 1 2 Supported Builds and Platforms This table shows the supported builds and platforms for Security Gateway Virtual Edition. Build, Platform, Server Version Security Gateway Virtual Edition Build To verify: fw ver -k VMware Platform VMware vsphere ESX 4.0, 4.1. VMware vsphere ESXi 4.0, 4.1. Note: For ESX/ESXi 4.0, the recommended build is or above. Build is not supported Check Point Security Management Server or Multi- Domain Security Management Multi-Domain Server R71 or higher Note - Security Gateway Virtual Edition is based on the R71.10 Security Gateway. Security Gateway Virtual Edition Release Notes R71 7

8 Known Limitations Known Limitations Note - The numbers next to each known limitation are for your tracking information. Check Point constantly makes an effort to improve released products. Check the tracking numbers in the next release for fixes. Security Gateway Virtual Edition Limitations Note - All Security Gateway R71 and R71.10 limitations ( apply also to Security Gateway Virtual Edition. In this section: Non-supported R71 Features 8 VMware Feature Limitations 8 General Limitations 8 Non-supported R71 Features The Check Point Mobile client is not supported in Security Gateway Virtual Edition Management High Availability and Log Server are not supported on a standalone Security Gateway Virtual Edition Performance Pack Heavy Load Quality of Service feature (HLQoS) is not supported. VMware Feature Limitations Cloning and templates are supported for Security Gateway Virtual Edition VM, if: The VM is a newly deployed Security Gateway Virtual Edition (immediately following the first boot). You have not yet configured any Check Point products. You have not yet done any configuration steps, such as sysconfig or cpconfig VMware Tools are not supported on a Security Gateway Virtual Edition Virtual Machine. General Limitations Upgrade to R71 is not supported. You must install Security Gateway Virtual Edition R71 as a clean installation. You cannot install Security Gateway R71 HFA packages or releases above R71 on top of the Security Gateway Virtual Edition. Security Gateway Virtual Edition Release Notes R71 8

9 Known Limitations CPU consumption for the Security Gateway Virtual Edition might show inaccurate results. To resolve this issue, reserve CPU resources on the ESX: 1. In the vsphere client, right click the Security Gateway Virtual Edition. 2. Select Edit Settings. 3. On the Resources tab, move the Reservation slider to allocate a guaranteed CPU share (in MHz) You can configure up to 2 virtual CPUs for the Security Gateway Virtual Edition The SecurePlatform WebUI is disabled until you assign an IP address to one of its network adapters In environments with more than one Security Gateway Virtual Edition on one ESX host, (where one is in Hypervisor mode and the others are in Network Mode), apply this configuration on the Security Gateway Virtual Edition in Hypervisor Mode: 1. Run sysconfig and configure the security of the Security Gateway Virtual Edition in Network mode instances to bypassed 2. Run sysconfig and configure the security of the VMs that are secured by one of the Security Gateway Virtual Editions in Network mode to bypassed. 3. Run sysconfig and configure the global failure setting to fail-open. Hypervisor Mode Limitations In this section: Non-supported R71 Features 9 Network Limitations 10 ESX Configuration Limitations 10 General Limitations 11 Non-supported R71 Features Unsupported Feature Security Gateway Virtual Edition in Hypervisor Mode cannot operate as a layer 3 network device (router). Layer 3 features, such as NAT and VPN, are not supported The following features are not supported in the current version: Security HTTP/FTP/SMTP with resource User/client/session authentication Anti-Virus in the proactive mode Anti-Virus for FTP Anti-Virus by file direction ClusterXL high availability and load sharing are not supported QoS is not supported Bridge mode is not supported. Security Gateway Virtual Edition Release Notes R71 9

10 Known Limitations Unsupported Feature CoreXL is not supported VoIP is not supported Header spoofing protection is not supported The SSL VPN blade and SSL Network Extender are not supported IPv6 is not supported. Network Limitations Dynamic Routing is not supported When a VM operates as a router for other VMs, you must configure these settings: 1. Run sysconfig to configure the routing VM security setting to bypassed. 2. Do not configure IP Anti-spoofing for VMs that use the routing VM as a default gateway When a VM operates as a bridge for other VMs, run sysconfig to configure the bridge-vm security setting to bypassed You cannot configure a VLAN using the VM guest operating system in an ESX environment. Configure the VLAN using a vswitch Hypervisor Mode does not support duplicate IP or MAC addresses for different VMs You cannot change a vnic MAC address using the guest operation system A Check Point management server cannot connect to a Security Gateway Virtual Edition if all of these cases are true: The management server is installed on an ESX cluster member. The management server uses a dedicated network. The Security Gateway Virtual Edition is not directly connected to this network. Workaround: Connect the management server VM to the ESX management network or connect the Security Gateway Virtual Edition to the management network Microsoft Network Load Balancing (NLB) is not supported for VMs. ESX Configuration Limitations VMDirectPath I/O is not supported You can only install one Security Gateway Virtual Edition with Hypervisor Mode on an ESX host Security Gateway Virtual Edition supports a maximum of 100 VMs on an ESX host When using the VMware Distributed Resource Scheduler, you must disable it on the Security Gateway Virtual Edition. Security Gateway Virtual Edition Release Notes R71 10

11 Known Limitations vnetwork Appliance products are not supported with Security Gateway Virtual Edition in Hypervisor Mode. General Limitations After creating a Virtual Machine from a template or after cloning a Virtual Machine, the following entry may show in the SmartView Tracker logs: "A misconfigured filter was created due to VM import, deployment of VM from template or VM cloning. Traffic is blocked for this new VM. Please reset the newly created VM in order to fix this issue." If this occurs, reset the new Virtual Machine. This message may also occur when powering on the source (original) Virtual Machine after cloning it. If this occurs, reset both the source and the newly cloned Virtual Machines The Reinstall Hypervisor Connector operation might fail on ESXi 4.1. See the Troubleshooting section of the R71 Security Gateway Virtual Edition Administration Guide ( for instructions. Hypervisor Mode Cluster Deployment Limitations In this section: Non-supported R71 Features 11 Network Limitations 11 General Limitations 12 Non-supported R71 Features Unsupported Feature ISN scrambling (spoofing) protection in IPS is not supported The SYN attack protection in IPS is not supported vmac is not supported. Network Limitations After a VM migrates from one ESX host (source) to another (destination), the source member continues to inspect existing connections. If the source member fails, existing connections are dropped If routers (virtualized or physical) are used to route traffic between virtual networks, only one of the virtual networks can be secured by the Security Gateway Virtual Edition. You must configure the other networks in Bypass. Security Gateway Virtual Edition Release Notes R71 11

12 Known Limitations General Limitations Hypervisor Mode supports up to ten cluster members You must install Hypervisor Mode on all ESX Cluster members. Security Gateway Virtual Edition Release Notes R71 12