Perfect Foundation for 2013 Security Blueprint

Perfect Foundation for
2013 Security Blueprint

Erez Berkner
Infrastructures Group Manager

©2013 Check Point Software Technologies Ltd.

Agenda

1

The Challenge

2

Why Gaia?

3

How to Easily Migrate to Gaia

4

R76 Sneak Peek


2
2

Your Challenge
 Maintaining and
certifying multiple
operating systems

 Managing multiple
administrators

 Getting maximum
performance from
existing hardware

 Enabling new Software
Blades on your existing
install base

3
3

Agenda

1

The Challenge

2

Why Gaia?

3


4

R76 Sneak Peek


4
4

Operational Cost Reduction
Automatic Software Updates

Improved Backup/Restore

EmergenDisk

Easy and fast system cloning


5
5

Gaia is Better than SecurePlatform
 More Secure
– Role-Based Administration

 Better Performance
– 64-bit

 Easier to use
– Web UI provides all the features
of the CLI

 Dozens of features not available in SecurePlatform
–
–
–
–
–

SNMPv3
VRRP
Policy based routing
Enhanced Dynamic Routing engine
IPv6

6
6

Gaia is Better than IPSO
 More Secure
– Supports the entire software
blades portfolio

 Better Performance
– 64-bit

 Easier to use
– Clone your box via “show configuration”

 Native Virtual Systems support (VSX)
 Supports legacy hardware and 2012 models


7
7

64-bits Architecture
 Utilize your existing hardware to the max
 Gaia supports today up to 32GB of RAM
 Ready for larger memory sizes (up to 16,777,216 TB!)
 Easy to move to 64-bits:
– All Gaia deployments can support 64-bit
– No need to reinstall
– Easy revert to 32-bit


8
8

Changing the OS Edition


9
9

Connection Capacity with 64-bit

SecurePlatform/
IPSO
32-bit

64-bit

6GB

1.2M

2.4M

8GB

1.2M

3.3M

12GB

1.2M

5.0M

24GB

1.2M

10.0M

32GB

1.2M

13.0M


10
10

Creating Roles


11
11

Role Based Administration
 Create separate roles
 Employ the least privilege principle
 No need to give full “admin” privilege anymore
 Similar to IPSO


12
12

Setting the Upgrade Policy


13
13

Software Updates
 Enables automatic download of updates
 Get only the appropriate updates that fit you
– Identify HF collisions!

 x5 times faster
 Manage scheduled installation
and download

 Post update self-test
– Revert on failure

 Available starting R75.40
– Default is notifications only

Putting system updates on auto-pilot

14
14

Package Is Available for Download


15
15

Gaia Software Updates


16
16

Show Config

Demo for
Show Configuration


17
17

Show Configuration
 Show configuration functionality, similar to the one
available on network equipment, allows getting a script
for rebuilding the entire OS in seconds.

 Use Save/Load
configuration
to clone a
GAIA device


18
18

Gaia Has It All!
SecurePlatform

IPSO

64-bit

No

No

Yes!

2012 appliances

Yes

No

Yes!

VRRP

No

Yes

Yes!

ClusterXL

Yes

No

Yes!

Automatic software updates

No

No

Yes!

Show configuration

No

No

Yes!

Enhanced dynamic routing

No

Yes

Yes!

Automatic license download

No

No

Yes!

Policy based routing

No

Yes

Yes!

TACACS+

No

Yes

Yes!

Modern Web UI

No

No

Yes!

Full blade support

Yes

No

Yes!


19
19

Agenda

1

The Challenge

2

Why Gaia?

3


4

R76 Sneak Peek


20
20

Migration Is Easy!
 Migrating to Gaia from SecurePlatform or IPSO
is a piece of cake

 2 options
– Direct in-place upgrade
– Use export/import
of configuration
– Reduces the complexity
of migration
– Can try it on VMware!


21
21

Migration from IPSO

/config/active

 Copy the file /config/active from the IP appliance
to the 2012 appliance

 Run ipso-migrator (on any GAIA machine!)
– On target machine: Apply changes
– On other GAIA machine: Create a configuration file and load
it on the target machine via “load configuration myConfig”

 Reboot
 Done! IPSO configuration is converted to Gaia

22
22

Running the IPSO Migrator


23
23

Migration from SPLAT (sk68140)

SecurePlatform

SecurePlatform
Archive File

Gaia
Config File

Gaia
Converter

1. Export all SecurePlatform config files into one archive file
(“copyfiles” script)
2. Run the Gaia converter (“converter –o <myConfigFile>”) to create a
single database.

24
24

Agenda

1

The Challenge

2

Why Gaia?

3


4

R76 Sneak Peek


25
25

R76 is here
And now we do things…


26
26

IPv6 Features in Gaia R76
 OSPFv3 and BGPv4
 VRRPv3
 Ability to access Web UI via IPv6 address
 First Time Wizard supports IPv6 addresses
 IP smart field, allowing typing any IP address
(IPv4 or IPv6) anywhere in Web UI


27
27

IPv6 in First Time Wizard


28
28

IP Smart Fields


29
29

There’s More in R76!
 “show configuration” now includes dynamic routing and
VRRP configuration

 NetFlow v5 and v9
 Improved password expiration controls, as in IPSO
 User mode core dumps enabled by default,
with quota mechanism


30
30

Core Dumps


31
31

EmergenDisk


32
32

EmergenDisk
 Built-in generator for bootable USB key
 Create on any GAIA machine
 Includes a complete Gaia OS running directly from the
USB device

 Ability to reset administrator password
 Ability to wipe the appliance’s hard drive
 Many more tools to come


33
33

Proxy ARP


34
34

Proxy ARP
 Control Proxy ARP from Web UI
 Control Proxy ARP from Clish
 Supports ClusterXL and VRRP clusters


35
35

NetFlow


36
36

NetFLow


38
38

Performance Optimizations


39
39

Multi-Queue Benefits?
More Control

Extra Lane


40
40

Control Multi-Queue and Core XL
 Easy CoreXL control from Web UI and Clish
 Optimize for Software Blades, Session rate or throughput


41
41

Control Multi-Queue and Core XL
 Control the core split (instances/dispatchers)
 Enable Multi-Queue on select interfaces


42
42

Summing It Up
Your upgrade does not have to look like that:


43
43

It can looks like this:

Thank You!

44
44

Perfect Foundation for 2013 Security Blueprint

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Perfect Foundation for 2013 Security Blueprint

Similar to Perfect Foundation for 2013 Security Blueprint (20)

More from Group of company MUK

More from Group of company MUK (20)

Recently uploaded

Recently uploaded (20)

Perfect Foundation for 2013 Security Blueprint

Editor's Notes