Checkpoint MAESTRO R80.20SP Instruction Manual

[Classification: Protected]
18 February2020
CHECK POINT MAESTRO
R80.20SP
Administration Guide

Check Point Copyright Notice
© 2020 Check Point Software Technologies Ltd.
All rights reserved. This product and related documentation are protected by copyright and distributed
under licensing restricting their use, copying, distribution, and decompilation. No part of this product or
related documentation may be reproduced in any form or by any means without prior written authorization
of Check Point. While every precaution has been taken in the preparation of this book, Check Point
assumes no responsibility for errors or omissions. This publication and features described herein are
subject to change without notice.
RESTRICTED RIGHTS LEGEND:
Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)
(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 and FAR
52.227-19.
TRADEMARKS:
Refer to the Copyright page for a list of our trademarks.
Refer to the Third Party copyright notices for a list of relevant copyrights and third-party licenses.

Check Point Maestro R80.20SP Administration Guide
Check Point Maestro R80.20SP Administration Guide|3
Important Information
Latest Software
We recommend that you install the most recent software release to stay up-to-date with the
latest functional improvements, stability fixes, security enhancements and protection
against new and evolving attacks.
Certifications
For third party independent certification of Check Point products, see the Check Point
Certifications page.
Check Point Maestro R80.20SP
For more about this release, see the R80.20SP home page.
Latest Version of this Document
Open the latest version of this document in a Web browser.
Download the latest version of this document in PDF format.
Feedback
Check Point is engaged in a continuous effort to improve its documentation.
Please help us by sending your comments.

Check Point Maestro R80.20SP Administration Guide
Check Point Maestro R80.20SP Administration Guide|4
Revision History
Date Description
18
February2020
Updated:
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190 - removed the steps for "Online CPUSE packages"
07 January
2020
Added:
n
"IP and URL Block Feature" on page221
n
"Configuring High Availability" on page218
Updated:
n
"Packet Drop Monitoring (drop_monitor and asg_drop_monitor)" on page125
n
"Showing Bond Interfaces (asg_bond)" on page76
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190
12 August
2019
Updated:
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190
lAdded instructions for installation of CPUSE Online packages
lRemoved the section
Deleting a Hotfix Package as not supported
06 August
2019
Updated:
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190 :
lUpdated the Important Notes about dividing all Security Appliances in a
specific Security Group into two logical groups
lAdded the Important Notes about connection over the serial console
04 August
2019
Updated:
n
"Installing and Uninstalling a Hotfix on Maestro Hyperscale Orchestrators" on
page187 - added a note that upgrade of CPUSEAgent is not supported
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190 - added a note that upgrade of CPUSEAgent is not supported

Check Point Maestro R80.20SP Administration Guide
Check Point Maestro R80.20SP Administration Guide|5
Date Description
01 July 2019 Updated:
nDocument design
Removed:
nInformation about initial configuration was moved to the R80.20SPMaestro
Getting Started Guide:
lConnecting Cables to Maestro Hyperscale Orchestrators
lConfiguration Procedure
lLicense Installation
lManaging Security Groups (some topics)
Added:
n
"Installing and Uninstalling a Hotfix on Maestro Hyperscale Orchestrators" on
page187
n
"Installing and Uninstalling a Hotfix on Maestro Security Appliances" on
page190
n
"RMA of a Maestro Hyperscale Orchestrator" on page216
24 March
2019
Updated:
nBreakout Cables
17 March
2019
Updated:
nConnecting Two Maestro Hyperscale Orchestrators for Redundancy
nConnecting Cables to MHO-170
nConnecting Cables to MHO-140
nSummary of Configuration Options
nSpecial Scenarios
nLicense Installation
nSnapshot Management
nLog and Configuration Files
Added:
nInstalling the Gaia Operating System on a Maestro Hyperscale Orchestrator
nGeneral Diagnostic in Security Groups
28 February
2019
First release of this document

Table of Contents
Check Point Maestro R80.20SP Administration Guide|6
Table of Contents
Glossary
11
Introduction
23
Managing Security Groups
24
Global Commands
24
Working with Global Commands
24
Check Point Global Commands
26
General Global Commands
29
Configuring Security Appliance State (g_clusterXL_admin)
36
Configuring a Unique MAC Identifier (asg_unique_mac_utility)
38
Working with the ARP Table (asg_arp)
40
The asg_arp Command
40
Example Default Output
41
Example Verbose Output
41
Example Output for Verifying MAC Addresses
42
Verifying ARP Entries
42
Example Legacy Output
43
Security Group Concepts
44
Single Management Object and Policies
44
Single Management Object
44
Installing and Uninstalling Policies
45
Working with Policies (asg policy)
46
Security Appliance Policy Management
49
Synchronizing Policy and Configuration Between Security Appliances
50
Understanding the Configuration File List
51
MAC Addresses and Bit Conventions
52
MAC Address Resolver (asg_mac_resolver)
55
Working with the Distribution Mode
56
Automatic Distribution Configuration (Auto-Topology)
57
Manual Distribution Configuration (Manual-General)
57
Setting and Showing the Distribution Configuration (set distribution configuration)
58

Table of Contents
Check Point Maestro R80.20SP Administration Guide|7
Configuring the Interface Distribution Mode (set distribution interface)
60
Showing Distribution Status (show distribution status)
62
Running a Verification Test (show distribution verification)
63
Configuring the Layer 4 Distribution Mode and Masks (set distribution l4-mode)
64
NAT and the Correction Layer on a Security Gateway
65
NAT and the Correction Layer on a VSX Gateway
66
Working with the GARP Chunk Mechanism
67
Description
67
Configuration
67
Verification
68
IPS Cluster Failover Management
69
IPv6 Neighbor Discovery
70
Logging and Monitoring
71
CPView
71
Overview of CPView
71
Using CPView
71
CPView User Interface
72
Network Monitoring
73
Working with Interface Status (asg if)
73
Global View of All Interfaces (show interfaces)
75
Showing Bond Interfaces (asg_bond)
76
Viewing a Global List of All Bonds (asg_bond)
77
Viewing a Specific Bond Interface (asg_bond -i)
77
Bond Verification Test (asg_bond -v)
78
Showing Traffic Information (asg_ifconfig)
79
Native Usage
81
Using the Analyze Option
82
Showing Multicast Traffic Information
83
Showing Multicast Routing (asg_mroute)
83
Showing PIM Information (asg_pim)
85
Showing IGMP Information (asg_igmp)
88
Monitoring VPN Tunnels
91
Traceroute (asg_tracert)
92

Table of Contents
Check Point Maestro R80.20SP Administration Guide|8
Multi-blade Traffic Capture (tcpdump -mcap, tcpdump -view)
93
Monitoring Management Interfaces Link State
95
Performance Monitoring and Control
97
Global Operating System Commands
97
Monitoring Performance (asg perf)
102
Performance Hogs (asg_perf_hogs)
109
Syntax
109
Configuration
110
The [tests] Section
110
Setting Port Priority
116
Searching for a Connection (asg search)
117
Description
117
Searching with the Command Line
117
Searching with Interactive Mode
121
Showing the Number of Firewall and SecureXL Connections (asg_conns)
123
Packet Drop Monitoring (drop_monitor and asg_drop_monitor)
125
The "drop_monitor" command
125
The "asg_drop_monitor" command
129
Hardware Monitoring and Control
131
Showing Hardware State (asg stat)
131
Monitoring System and Component Status (asg monitor)
135
Configuring Alert Thresholds (set chassis alert_threshold)
137
Monitoring System Resources (asg resource)
139
Configuring Alerts for Security Appliance and Chassis Events (asg alert)
144
Collecting System Diagnostics (smo verifiers)
148
Diagnostic Tests
148
Showing the Tests
150
Showing the Last Run Diagnostic Tests
151
Running all Diagnostic Tests
152
Running Specific Diagnostic Tests
153
Collecting Diagnostic Information for a Report Specified Section
154
Error Types
155
Changing Compliance Thresholds
156

Table of Contents
Check Point Maestro R80.20SP Administration Guide|9
Changing the Default Test Behavior of the 'asg diag resource verifier'
156
Troubleshooting Failures
157
Alert Modes
160
Diagnostic Events
160
Important Notes
160
Known Limitations of the SMO Verifiers Test
162
System Monitoring
163
Showing System Serial Numbers (asg_serial_info)
163
Showing the Security Group Version (ver)
164
Showing System Messages (show smo log)
165
Configuring a Dedicated Logging Port
166
Log Server Distribution (asg_log_servers)
168
Command Auditing (asg log audit)
170
Viewing a Log File (asg log)
171
Monitoring Virtual Systems (cpha_vsx_util monitor)
174
Working with SNMP
175
Monitoring Maestro Hyperscale Orchestrators over SNMP
175
Enabling SNMP Monitoring on Maestro Hyperscale Orchestrators
175
Supported SNMP OIDs for Maestro Hyperscale Orchestrators
176
Supported SNMP Trap OIDs for Maestro Hyperscale Orchestrators
176
Monitoring Security Groups over SNMP
178
Enabling SNMP Monitoring of Security Groups
178
Supported SNMP OIDs for Security Groups
179
Supported SNMP Trap OIDs for Security Groups
179
SNMP Monitoring of Security Groups in VSX Mode
179
Common SNMP OIDs for Security Groups
180
System Optimization
182
Firewall Connections Table Size for VSX Gateway
182
Working with Session Control (asg_session_control)
183
Session Control
183
Defining Session Control Rules
184
Showing Session Control Statistics
185
Applying Session Control Rules
186

Table of Contents
Check Point Maestro R80.20SP Administration Guide|10
Disabling Session Control
186
Installing and Uninstalling a Hotfix
187
Installing and Uninstalling a Hotfix on Maestro Hyperscale Orchestrators
187
Installing a Hotfix Package
188
Uninstalling a Hotfix Package
189
Deleting a Hotfix Package
189
Installing and Uninstalling a Hotfix on Maestro Security Appliances
190
Installing a Hotfix Package
190
Uninstalling a Hotfix Package
194
Troubleshooting
197
Collecting System Information (asg_info)
197
General Diagnostic in Security Groups
202
Configuration Verifiers
205
MAC Verification (mac_verifier)
205
Layer 2 Bridge Verifier (asg_br_verifier, asg_brs_verifier)
207
Verifying VSX Gateway Configuration (asg vsx_verify)
209
Log and Configuration Files
212
Installing the Gaia Operating System on a Maestro Hyperscale Orchestrator
214
RMA of a Maestro Hyperscale Orchestrator
216
Configuring High Availability
218
Setting Security Appliance Weights (Chassis High Availability Factors)
218
Setting the Quality Grade Differential
220
IP and URL Block Feature
221
IP Block Feature
221
Description
221
CLI
222
Procedure
223
URL Block Feature
225
Description
225
CLI
225
Procedure
226

Table of Contents
Check Point Maestro R80.20SP Administration Guide|11
Glossary
A
Administrator
A user with permissions to manage Check Point security products and the network
environment.
API
In computer programming, an application programming interface (API) is a set of
subroutine definitions, protocols, and tools for building application software. In general
terms, it is a set of clearly defined methods of communication between various software
components.
Appliance
A physical computer manufactured and distributed by Check Point.
B
Bond
A virtual interface that contains (enslaves) two or more physical interfaces for
redundancy and load sharing. The physical interfaces share one IP address and one
MAC address. See "Link Aggregation".
Bonding
See "Link Aggregation".
Breakout
See "Breakout Cable".
Breakout Cable
An optical fiber cable that contains several jacketed simplex optical fibers that are
packaged together inside an outer jacket. Also called fanout, fan-out, or splitter cable.
Bridge Mode
A Security Gateway or Virtual System that works as a Layer 2 bridge device for easy
deployment in an existing topology.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|12
C
CA
Certificate Authority. Issues certificates to gateways, users, or computers, to identify
itself to connecting entities with Distinguished Name, public key, and sometimes IP
address. After certificate validation, entities can send encrypted data using the public
keys in the certificates.
Certificate
An electronic document that uses a digital signature to bind a cryptographic public key
to a specific identity. The identity can be an individual, organization, or software entity.
The certificate is used to authenticate one identity to another.
Cluster
Two or more Security Gateways that work together in a redundant configuration - High
Availability, or Load Sharing.
Cluster Member
A Security Gateway that is part of a cluster.
CoreXL
A performance-enhancing technology for Security Gateways on multi-core processing
platforms. Multiple Check Point Firewall instances are running in parallel on multiple
CPU cores.
CoreXL Firewall Instance
Also CoreXL FW Instance. On a Security Gateway with CoreXL enabled, the Firewall
kernel is copied multiple times. Each replicated copy, or firewall instance, runs on one
processing CPU core. These firewall instances handle traffic at the same time, and
each firewall instance is a complete and independent firewall inspection kernel.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|13
CoreXL SND
Secure Network Distributer. Part of CoreXL that is responsible for: Processing incoming
traffic from the network interfaces; Securely accelerating authorized packets (if
SecureXL is enabled); Distributing non-accelerated packets between Firewall kernel
instances (SND maintains global dispatching table, which maps connections that were
assigned to CoreXL Firewall instances). Traffic distribution between CoreXL Firewall
instances is statically based on Source IP addresses, Destination IP addresses, and the
IP 'Protocol' type. The CoreXL SND does not really "touch" packets. The decision to
stick to a particular FWK daemon is done at the first packet of connection on a very high
level, before anything else. Depending on the SecureXL settings, and in most of the
cases, the SecureXL can be offloading decryption calculations. However, in some other
cases, such as with Route-Based VPN, it is done by FWK daemon.
CPUSE
Check Point Upgrade Service Engine for Gaia Operating System. With CPUSE, you
can automatically update Check Point products for the Gaia OS, and the Gaia OS itself.
For details, see sk92449.
D
DAC
See "DAC Cable".
DAC Cable
Direct Attach Copper cable. A form of the high-speed shielded twinax copper cable with
pluggable transceivers on both ends. Used to connect to network devices (switches,
routers, or servers).
DAIP Gateway
A Dynamically Assigned IP (DAIP) Security Gateway is a Security Gateway where the
IP address of the external interface is assigned dynamically by the ISP.
Data Type
A classification of data. The Firewall classifies incoming and outgoing traffic according
to Data Types, and enforces the Policy accordingly.
Database
The Check Point database includes all objects, including network objects, users,
services, servers, and protection profiles.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|14
Distributed Deployment
The Check Point Security Gateway and Security Management Server products are
deployed on different computers.
Domain
A network or a collection of networks related to an entity, such as a company, business
unit or geographical location.
Domain Log Server
A Log Server for a specified Domain. It stores and processes logs from Security
Gateways that are managed by the corresponding Domain Management Server.
Acronym: DLS.
Domain Management Server
A virtual Security Management Server that manages Security Gateways for one
Domain, as part of a Multi-Domain Security Management environment. Acronym: DMS.
Downlink
See "Downlink Ports".
Downlink Ports
Interfaces on the Maestro Hyperscale Orchestrator used to connect to Check Point
Security Appliances. You use DAC cables, Fiber cables (with transceivers), or Breakout
cables to connect between the Downlink ports and Security Appliances. The Check
Point Management traffic (policy, logs, synchronization, and so on) co-exists with the
data (user) traffic on the Downlink ports. Bandwidth is guaranteed for the Check Point
Management traffic (portion of the downlink bandwidth). These ports form the system
backplane (management, data plane, synchronization).
E
Expert Mode
The name of the full command line shell that gives full system root permissions in the
Check Point Gaia operating system.
External Network
Computers and networks that are outside of the protected network.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|15
External Users
Users defined on external servers. External users are not defined in the Security
Management Server database or on an LDAP server. External user profiles tell the
system how to identify and authenticate externally defined users.
F
Firewall
The software and hardware that protects a computer network by analyzing the incoming
and outgoing network traffic (packets).
G
Gaia
Check Point security operating system that combines the strengths of both
SecurePlatform and IPSO operating systems.
Gaia Clish
The name of the default command line shell in Check Point Gaia operating system. This
is a restrictive shell (role-based administration controls the number of commands
available in the shell).
Gaia gClish
The name of the command line shell in Check Point Gaia operating system for Security
Appliances connected to Check Point Maestro Hyperscale Orchestrators. Commands
you run in this shell apply to all Security Appliances in the Security Group.
Gaia Portal
Web interface for Check Point Gaia operating system.
gClish
See "Gaia gClish".
H
Hotfix
A piece of software installed on top of the current software in order to fix some wrong or
undesired behavior.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|16
HyperSync
Check Point patented technology that makes sure that active connections are only
synchronized to backup Security Appliances in the Security Group. HyperSync makes
sure each connection flow has a backup within the Security Group.
I
ICA
Internal Certificate Authority. A component on Check Point Management Server that
issues certificates for authentication.
Internal Network
Computers and resources protected by the Firewall and accessed by authenticated
users.
IPv4
Internet Protocol Version 4 (see RFC 791). A 32-bit number - 4 sets of numbers, each
set can be from 0 - 255. For example, 192.168.2.1.
IPv6
Internet Protocol Version 6 (see RFC 2460 and RFC 3513). 128-bit number - 8 sets of
hexadecimal numbers, each set can be from 0 - ffff. For example,
FEDC:BA98:7654:3210:FEDC:BA98:7654:3210.
J
Jumbo Hotfix Accumulator
Collection of hotfixes combined into a single package. Acronyms: JHA, JHF.
L
Link Aggregation
Various methods of combining (aggregating) multiple network connections in parallel to
increase throughput beyond what a single connection could sustain, and to provide
redundancy in case one of the links should fail.
Log
A record of an action that is done by a Software Blade.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|17
Log Server
A dedicated Check Point computer that runs Check Point software to store and process
logs in Security Management Server or Multi-Domain Security Management
environment.
M
Maestro Hyperscale Orchestrator
A scalable Network Security System that connects multiple Check Point Security
Appliances into a unified system. Acronym: MHO.
Management High Availability
Deployment and configuration mode of two Check Point Management Servers, in which
they automatically synchronize the management databases with each other. In this
mode, one Management Server is Active, and the other is Standby. Acronyms:
Management HA, MGMT HA.
Management Interface
Interface on Gaia computer, through which users connect to Portal or CLI. Interface on a
Gaia Security Gateway or Cluster member, through which Management Server
connects to the Security Gateway or Cluster member.
Management Server
A Check Point Security Management Server or a Multi-Domain Server.
Multi-Domain Log Server
A computer that runs Check Point software to store and process logs in Multi-Domain
Security Management environment. The Multi-Domain Log Server consists of Domain
Log Servers that store and process logs from Security Gateways that are managed by
the corresponding Domain Management Servers. Acronym: MDLS.
Multi-Domain Security Management
A centralized management solution for large-scale, distributed environments with many
different Domain networks.
Multi-Domain Server
A computer that runs Check Point software to host virtual Security Management Servers
called Domain Management Servers. Acronym: MDS.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|18
N
Network Object
Logical representation of every part of corporate topology (physical machine, software
component, IP Address range, service, and so on).
O
Open Server
A physical computer manufactured and distributed by a company, other than Check
Point.
Orchestrator
See "Maestro Hyperscale Orchestrator".
P
Primary Multi-Domain Server
The Multi-Domain Server in Management High Availability that you install as Primary.
R
Rule
A set of traffic parameters and other conditions in a Rule Base that cause specified
actions to be taken for a communication session.
Rule Base
Also Rulebase. All rules configured in a given Security Policy.
S
Secondary Multi-Domain Server
The Multi-Domain Server in Management High Availability that you install as
Secondary.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|19
SecureXL
Check Point product that accelerates IPv4 and IPv6 traffic. Installed on Security
Gateways for significant performance improvements.
Security Gateway
A computer that runs Check Point software to inspect traffic and enforces Security
Policies for connected network resources.
Security Group
A logical group of Security Appliances that provides Active/Active cluster functionality. A
Security Group can contain one or more Security Appliances. Security Groups work
separately and independently from each other. To the production networks, a Security
Group appears a single Security Gateway. Every Security Group contains: (A)
Applicable Uplink ports, to which your production networks are connected; (B) Security
Appliances (the Maestro Hyperscale Orchestrator determines the applicable Downlink
ports automatically); (C) Applicable management port, to which the Check Point
Management Server is connected.
Security Management Server
A computer that runs Check Point software to manage the objects and policies in Check
Point environment.
Security Policy
A collection of rules that control network traffic and enforce organization guidelines for
data protection and access to resources with packet inspection.
SGM
Security Appliance. Part of the Security Group that contains the assigned Security
Appliances. Security Appliance in a Security Group has one IPv4 address and
represents all assigned Security Appliances as one entity.
Shared Management
Feature that allows to assign the same Management Port (interface ethX-MgmtY) on a
Maestro Hyperscale Orchestrator to different Security Groups. The assigned
Management Port has a different IP address and a different MAC address in each
Security Group, to which this port is assigned.

Table of Contents
Check Point Maestro R80.20SP Administration Guide|20
SIC
Secure Internal Communication. The Check Point proprietary mechanism with which
Check Point computers that run Check Point software authenticate each other over
SSL, for secure communication. This authentication is based on the certificates issued
by the ICA on a Check Point Management Server.
Single Sign-On
A property of access control of multiple related, yet independent, software systems. With
this property, a user logs in with a single ID and password to gain access to a
connected system or systems without using different usernames or passwords, or in
some configurations seamlessly sign on at each system. This is typically accomplished
using the Lightweight Directory Access Protocol (LDAP) and stored LDAP databases
on (directory) servers. Acronym: SSO.
SmartConsole
A Check Point GUI application used to manage Security Policies, monitor products and
events, install updates, provision new devices and appliances, and manage a multi-
domain environment and each domain.
SmartDashboard
A legacy Check Point GUI client used to create and manage the security settings in
R77.30 and lower versions.
SMO
Single Management Object. Single Security Gateway object in SmartConsole that
represents a Security Group configured on Maestro Hyperscale Orchestrator.
SMO Master
The physical Security Appliance in a Security Group that handles management tasks for
all Security Appliances in the Security Group. By default, the Security Appliance with
the lowest Member ID is assigned this role.
Software Blade
A software blade is a security solution based on specific business needs. Each blade is
independent, modular and centrally managed. To extend security, additional blades can
be quickly added.
SSM
Security Switch Module. Role of the Maestro Orchestrator that manages the flow of
network traffic to and from the Security Groups.