Check Point CCVS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Virtual System (VS)

A software-based independent security gateway instance running on a VSX gateway, with its own Security Policy, NAT, VPN, and administrator permissions, sharing physical hardware and OS with other VSs.

VSX Gateway

The physical appliance or open server that hosts multiple Virtual Systems; it runs the VSX operating system and provides shared hardware resources, physical interfaces, and Virtual Switches for all VSs.

VS ID

A unique numeric identifier (1–255) assigned to each Virtual System on a VSX gateway; VS ID 0 is reserved for the VSX Gateway management VS; IDs must be unique across the VSX cluster.

Virtual Switch (VSW)

A virtual network switch defined in SmartConsole that connects Virtual Systems to each other and to physical interfaces; VSs on the same VSW communicate without leaving the appliance.

VSX Cluster

A high-availability deployment of two VSX gateways using ClusterXL, where each VS has its own Virtual IP addresses per interface and can fail over independently between cluster members.

Virtual Interface

A logical interface assigned to a Virtual System and mapped to a physical interface or bond, optionally with a VLAN ID; multiple VSs can share a physical interface using different VLANs.

VSX license

A license that covers the VSX Gateway and a specific number of Virtual Systems; each VS consumes one license; adding a VS beyond the licensed count is blocked until the license is upgraded.

Management VS (VS0)

The Virtual System with VS ID 0 that runs the VSX Gateway management processes; it must be reachable from SmartConsole before other VSs can be added or managed.

VSX Wizard (vsx_util)

The command-line utility on a VSX gateway used for initial VSX setup, reconfiguration, adding or deleting Virtual Systems, backup, restore, and upgrade operations.

VSX Gateway object

A SmartConsole Gateway object with platform set to VSX that represents the VSX Gateway; it is created before running the VSX Wizard and is used to manage all Virtual Systems.

Adding a Virtual System

In SmartConsole, go to VSX > Virtual Systems > New, assign a VS ID and name, map Virtual Interfaces to physical interfaces or VSWs, then install policy to the new VS.

vsx_util add_vs

A vsx_util command that adds a new Virtual System from the CLI on the VSX Gateway; it prompts for VS ID, name, and interface mapping, and updates the management database.

Virtual Interface mapping

The association of a VS Virtual Interface with a physical interface or bond and an optional VLAN ID; correct mapping is required for traffic to reach the VS and for policy installation to succeed.

VSX Cluster deployment

Creating a VSX Cluster object in SmartConsole, adding both member gateways, configuring ClusterXL, defining Virtual IPs per VS per interface, and synchronizing VS configuration across members.

Policy installation to a VS

Selecting a specific VS object in SmartConsole and installing policy to it; the policy is installed only to that VS, while the VSX Gateway management VS policy is installed separately.

VSX configuration backup

Using vsx_util backup or cpbackup to save VSX configuration; the management database stores VS definitions, and gateway-side files are in /etc/vsx and /var/opt/vsx.

VSX post-setup reboot

After completing the VSX Wizard, the VSX Gateway must be rebooted; the management VS (VS0) must then be reachable from SmartConsole before adding other Virtual Systems.

Per-VS Security Policy

Each Virtual System has its own independent Security Policy, NAT policy, and VPN community; policies are installed per VS and cannot be shared between VSs.

Global Policy in VSX

A policy assigned to the VSX Gateway object that applies to all Virtual Systems; a VS can also have a local policy, and global rules are typically evaluated before local rules.

VSX Administrator permissions

Administrators can be assigned per-VS permissions using VSX Administrator profiles, such as read-only access to a specific VS, while other VSs remain inaccessible.

Per-VS NAT

Each Virtual System has its own NAT rule base and performs NAT independently; the VSX Gateway management VS (VS0) can also perform NAT for management traffic.

Per-VS VPN

Each Virtual System can act as a VPN peer with its own VPN communities and IPsec settings; VPN routing and encryption are handled independently per VS.

VSX monitoring tools

Use SmartConsole VSX view, vsx_stat, cpstat vsx, and SmartView Monitor to check per-VS CPU, memory, connection counts, and status on the VSX Gateway.

VSX license management

Each VS consumes a VSX license; check license status in SmartConsole > VSX > Virtual Systems; license expiry affects all Virtual Systems on the gateway.

fw vsx stat

A command on the VSX Gateway that lists all Virtual Systems with their VS IDs, names, and status (up/down); options include -v for verbose and -l for VS IDs and names.

vsx_stat

A VSX troubleshooting command that displays per-VS status, CPU usage, memory usage, and connection statistics; used to identify performance issues on individual Virtual Systems.

VS fails to start

Check VSX license validity, VS ID conflicts, Virtual Interface mapping errors, and VSX Gateway status; use fw vsx stat to confirm the VS state is down.

Policy installation failure to VS

Verify the VS is up, VS0 is reachable, the VS has a valid policy, and the gateway has sufficient resources; check $FWDIR/log/fwm.elg on the management server for errors.

VSX Cluster failover

If a VS fails on one cluster member, ClusterXL moves that VS to the other member; failover is per VS, not per gateway; check cphaprob stat and fw vsx stat.

VSX performance troubleshooting

Use vsx_stat and cpstat vsx to find high-CPU VSs; each VS shares gateway CPU and memory; CoreXL and SecureXL are configured per VS to optimize performance.

VSX logging

Each VS sends logs to the management server tagged with the VS name; use SmartConsole Logs & Monitor and filter by VS; the VSX Gateway management VS logs separately.

VSX upgrade procedure

Back up the VSX configuration, upgrade the VSX Gateway management VS first, then upgrade individual VSs using vsx_util upgrade; ensure the VSX license supports the new version.