Installing and Configuring VSX

What is VSX:

VSX stands for Virtualized Security gateway. Ideal for ISP’s, VSX allows many virtual firewalls to reside on a single hardware appliance (or several in the case of an HA environment). Though VSX is supported on many platforms, including SPLAT and Nokia, this guide is specific to VSX on Crossbeam X series firewalls.


VAP – Virtual Application Processor. Represents the resources and operating environment allocated for the APM

APM- Application Processor Module is where the applications reside, such as Checkpoint, content filtering, and IPS (including Proventia G).

VAP Group- A group of APMs used for load balancing.

Root shell- Crossbeam has both a Unix Root Shell and a CPM. The Root shell is accessed by typing “unix su” from the command line.

CPM- Control Processor Module is the managing environment for the Crossbeam. This manages most appliance functions and global configurations.

Installing VSX for the first time:

unix su

Copy the rpm for VSX to /usr/os/rpm

cd /usr/os/rpm

ls app*

rpm -i app-firewallvsx-NGX*-XXXXXXXXX-*.*.*.*.7xXOS.i686.rpm

Install to VAP group

At crossbeam prompt (not unix):

show application

Displays loaded applications

application VSX vsp-group version NGX install

Will be prompted to use existing settings if there is an existing configuration, select the management interface, and provide licensing information.

If the VAP group load count was set to 0 run the following command:

configure vap-group <name> max-load-count

Next all modules need to be reloaded. If you are unsure of the slot number run the following command:

show ap-vap-mapping

reload module <slot_low> [<slot_high>]

Reboot the module

Next reload the vap group:

reload vap-group

This reboots all APMs associated with this VAP group

In order to check the status of VSX, Application monitoring must be enabled.

application vsx vap-group <vap_group_name> configure

To check the status of the VAP group:

show application vap-group fw

Upgrading VSX NG to NGX:

1. First upgrade Checkpoint to NGX

2. Upgrade the modules/clusters; vsx_util upgrade

3. Remove VSX from the VSX VAP group: application VSX vap-group <groupname> version NGAI uninstall

4. log in as root: unix su

5. Uninstall VSX Application: rpm –e app-firewallvsx-NGAI-Bx.x.x.x.7xXOS

6. Upgrade XOS (see the XOS guide)

7. Install VSX for NGX: rpm –i app-firewallvsx-NGX-x.x.x.x.7xXOS.i686.rpm

Log into the CPM and apply VSX to the VAP group: CBS# application VSX vap-group <groupname> version NGX install

CBS# reload vap-group <groupname>

8. On the VSX Management Station, run vsx_util reconfigure. Connect to the CMA which holds the cluster

configuration. Complete the reconfiguration. This will push the configuration/policies to the newly created


  1. Reload the Vap group:

reload vap-group

Configuring Checkpoint Firewall components on VSX:

Install the application to the VAP group:

From the CPM enter show application

This will show installed applications.

application VSX vap-group version NGX install

Activate the VAP group:

configure vap-group <name> max-load-count

Next reload the modules associated with the VAP group:

reload module <slot_low> [<slot_high>] -R61

reload vap-group -R65

If you are unsure of the module:

show ap-vap-mapping

Configuring VSX:

Configuring Single System Application Synchronization (SBHA) (Active/Passive) and Dual System Application Synchronization (Active/Active):

State synchronization (HA) VSX is used to backup to other VAPs and load balanced. Circuits are configured for synchronization and should be unique for each VAP group.

application VSX vap-group group1 version NGX_EC config

Enabled synchronization. Select “Enable Check Point High Availability/State Sync”

May require a reboot

Create an internal circuit for the cluster:

config circuit <circuit_name> internal

config circuit <circuit_name> vap-group <vapGroupName> ip <starting address/mask-bits> increment-per-vap <end-address>

Eth0 and Eth1 cannot be used for the sync network.

To send broadcast sync packets, add the following line to the $FWDIR/boot/modules/fwkern.conf to each

VAP in the VAP group.


On the CMA:

Create a VSX Gateway Cluster object and include each VAP as its member.

Set the synchronization network.

Download policies to the VSX Gateway Cluster object..

Disabling Application Synchronization:

application VSX vap-group group1 version NGX_EC config

In the Configuration Options menu, choose to disable Check Point High Availability/State


May require a reboot.

On the CMA remove all VAPs from the Gateway object.

Adding cluster members:

Increase the Max and Vap counts:

configure vap-group vap-count

configure vap-group max-load-count

Install VSX to the new VAP

application-update vap-group

Enter the management IP address and license information for the new cluster member.

Reboot the new VAP after the installation completes.

Add a new member. From VSX Management station (Provider-1 or SmartCenter), use one of the following


Backup of VSX configurations:

Copy running-config

Or to backup a specific VSX configuration:

application VSX vap-group <vap-group-name> config

select the option to backup the VSX configuration.


1. If restoring a VSX configuration in Dual Box High Availability (DBHA) setup, make sure that every

failover group using the VSX VAP group is disabled by using the configure vrrp failover-group no

enable command.

2. If necessary, move the backup file to the backup directory on the respective VAP, for example:

mv /tftpboot/_1/usr/vsx-backup

3. Launch the application configuration program, using the following command:

CBS# application VSX vap-group <vap-group-name> config

4. In the Configuration Options menu, select the option to restore the VSX configuration.

5. When prompted, choose the option to cleanup before restore.

6. After the VSX restore, reload the VAP group.

7. If you disabled any failover groups, you need to re-enable them.


VSX considerations:

The VSX application supports up to five members in a VSX cluster.

If Static NAT (Automatic or Manual) is defined for an IP address in the Security Policy of a Virtual System,

a route to that IP needs to be added to any Virtual Router connected to that Virtual System. This should be

done by adding the following "dummy" route on the NATing VS and propagating it to the EVR/VR:

destination , next hop .

Using SNMP to retrieve status information on the VSX gateway is supported only for the Management VS.

To activate Hub-mode for a Virtual System, you must edit the objects_5_0.C file using dbedit and set the

allow_VPN_routing_from_SR attribute on that Virtual System to true.

Before changing the VLAN ID of an interface configured in the Virtual System (VS) using

SmartDashboard, use the XOS CLI to delete all manual configurations associated with the VS circuit. For

example, if you bind an ARP entry to a VS circuit, you must manually remove the entry before changing the


By default every circuit created by VSX is placed into a different domain, which could have an effect on

performance. The VSX configuration option, Disable Overlapping IP Support, allows you to disable

overlapping IP Support and place every circuit into a single domain.

If configuring a bridge where a different VLAN is on each side of the bridge, use hide-vlan-header on the

firewall VAP group.

Deleting the VSX object from SmartDashboard removes the VSX object and its related Virtual Systems

from the SmartCenter management only. The Virtual Systems are not deleted from the VSX gateway/

cluster. To re-use the VAP group, run the reset_ gw command on each cluster member. This clears the VSX

configuration and prepares the modules for the new VSX installation.

• SmartConsole’s revision control is not supported.

Verifying VSX status:

show application vap-group

A large CPD.elg file may prevent VSX changes.

Start/stop/configure VSX:

application VSX vap-group vap-group-name version start

application VSX vap-group vap-group-name version config

application VSX vap-group vap-group-name version stop

application VSX vap-group vap-group-name version restart

application VSX vap-group vap-group-name version uninstall


0 Responses to "Installing and Configuring VSX"

Post a Comment

Search This Blog

Blog Archive

Total Pageviews