Check Point CCVS key terms

A software instance running on a Security Gateway that has its own security policy, administrators, and configuration, while sharing the underlying hardware and operating system with other virtual systems.

The runtime object created when a virtual system is installed and started on a specific gateway. It consumes resources from the host and appears as a distinct security domain to traffic.

A Check Point gateway role that hosts multiple virtual systems plus a management-side virtual switch and router, enabling many independent security domains on one appliance or cluster.

The special virtual system on a VSX gateway that handles management traffic, routing between virtual systems, and gateway-level services such as logging and synchronization.

An isolated execution environment identified by a numeric ID that groups a virtual system's interfaces, routing table, and policy. Each VS instance runs in its own context.

The numeric identifier assigned to a virtual system or management context. It must be unique on the gateway and is used in commands and logs to distinguish one context from another.

A Layer 2 forwarding component inside a VSX gateway that connects virtual systems and external interfaces, allowing traffic to move between contexts without leaving the appliance.

A routing instance owned by a virtual system or the management context. Each has its own routing table, so overlapping IP ranges can exist in different virtual systems.

A Layer 2 segmentation tag used to separate traffic on a shared link. On VSX, VLANs can map traffic to specific virtual systems or bridge segments.

A physical or virtual link that carries multiple VLANs, usually tagged. On VSX it commonly connects a switch to the gateway so several virtual systems can share one port.

A network port or logical endpoint assigned to a virtual system. Its addressing and VLAN membership determine which context receives the traffic arriving on it.

The act of creating and allocating a virtual system on a gateway, including its context ID, interfaces, and resource limits, before policy is installed and traffic is allowed.

The management object representing a VSX gateway or cluster. It holds the virtual systems and their interfaces, and is where provisioning and topology are configured.

Two or more gateways configured for high availability or load sharing. In VSX, virtual systems are distributed across cluster members so each VS can fail over.

A deployment mode where one cluster member actively handles traffic while another stands by, taking over if the active member fails, preserving virtual system continuity.

The process of moving active traffic handling from a failed cluster member to a standby member, including the virtual systems and their state.

The exchange of state and configuration between cluster members so a standby can take over. VSX synchronizes per virtual system and the management context separately.

The ordered rule set that decides whether traffic is accepted, dropped, or inspected. Each virtual system has its own independent policy and rule base.

The collection of rules, objects, and settings belonging to one virtual system. Rule bases are separate per VS, so an administrator of one VS cannot see another's rules.

Compiling and pushing a security policy to a gateway. On VSX, installation targets a specific virtual system or the management context, not the whole gateway at once.

The management action that sends a compiled policy to a selected target. Choosing the correct target virtual system is essential to avoid installing to the wrong context.

A user account with defined permissions. VSX supports per-virtual-system administrators who can manage only their own VS, plus global administrators with wider rights.

A set of allowed management actions assigned to an administrator. It limits what a per-VS administrator can view or change within their virtual system.

A management architecture that separates policy and objects into domains. It is often paired with VSX so each virtual system is managed as its own domain.

A management container holding its own objects, policies, and administrators. In VSX deployments, each virtual system typically maps to one domain.

A record of traffic and system events. VSX logs include the virtual system or context identifier so events can be attributed to the correct security domain.

The graphical management client used to configure objects, policies, and virtual systems. Administrators use it to provision VSX and install policies.

A command-line utility that displays the state of virtual systems on a gateway, including whether each context is up, its ID, and its assigned interfaces.

A command-line tool for managing VSX configuration, such as adding or removing virtual systems and reassigning interfaces, often used during maintenance or migration.

The operational state of a virtual system's context, such as up or down. A down context cannot pass traffic even if its policy is installed.

Limits on CPU, memory, and connections assigned to a virtual system so one VS cannot starve others on the same gateway.

The core of the gateway operating system that enforces security policy and forwards packets. VSX extends it to keep virtual systems isolated.

The list of routes a virtual system uses to forward traffic. Each VS has its own table, so identical subnets may appear in different virtual systems.

The policy setting that controls whether an action is logged, and how. Per-VS tracking choices determine which events appear in which virtual system's logs.

Moving a virtual system between gateways or cluster members, including its configuration and interfaces, usually performed with management tools during maintenance windows.

The defined layout of interfaces, networks, and their roles on a virtual device. Correct topology is required for anti-spoofing and routing to work per virtual system.

A protection that drops packets whose source address does not match the interface's expected network. On VSX it is evaluated per interface and context.

Saving and recovering gateway or management configuration. For VSX, backups must capture per-virtual-system settings as well as the management context.