156-551 Check Point Certified VSX Specialist - R81 (CCVS) Practice Questions

The VSX Provisioning Tool is the vsx_provisioning_tool command. It runs from the command line of the Security Management Server or Domain Management Server (or a SmartConsole computer with -s) and adds, modifies and removes Virtual Devices (VS, VS in bridge mode, VSW, VR), their interfaces and routes, from the -o option or from an input file (-f) of commands grouped in transactions. This allows automation of VSX provisioning. It is not a SmartConsole GUI feature and does not use templates.

This statement is true and describes the fundamental principle of Virtual System Load Sharing (VSLS). In VSLS mode, the cluster actively distributes the Virtual Systems among the physical members. This allows different VSs to be active on different members at the same time, effectively sharing the overall workload across the cluster's hardware.

'vsx_util upgrade' runs in Expert mode on the Security Management Server (or Main Domain Management Server) and upgrades the version of the VSX Gateway / VSX Cluster object in the management database; it does not touch the gateways or take snapshots. The gateways are upgraded separately, and the change can be reverted with 'vsx_util downgrade' only if no configuration changes were made after the upgrade (R81.10 VSX Admin Guide; Installation and Upgrade Guide).

After the initial Gaia configuration, the management server needs to be made aware of the cluster members. This is done by creating a new VSX Cluster object in SmartConsole. During this object creation wizard, the administrator must initialize Secure Internal Communication (SIC) with each physical member of the cluster. This establishes the trusted connection required for policy installation and management.

The standard and most secure way to replicate a physical DMZ in VSX is to create a dedicated Virtual System for the DMZ. This VS will have its own security policy, interfaces (physical or VLAN), and routing configuration. Another separate Virtual System would be created for the internal network. Communication between the zones (Internet, DMZ, Internal) can then be controlled via a Virtual Router or external routing, with security policies on each VS enforcing the access rules.

The Expert-mode command 'cphaprob syncstat' (Gaia Clish: 'show cluster statistics sync') shows the Delta Sync transport statistics (sent/received updates, lost/retransmitted packets, queue sizes), and 'cphaprob -reset syncstat' resets them (R81.10 ClusterXL Admin Guide). vsx_util has no sync sub-command; 'cphaprob -a if' shows interfaces and 'fw ctl multik stat' shows CoreXL instances.

To achieve Layer 3 routing between Virtual Systems within a single VSX Gateway, a Virtual Router (VR) is required. Each Virtual System then connects to this VR using a special virtual interface called a Warp Link. The VR handles the routing decisions to forward traffic between the networks associated with each VS. A Virtual Switch provides only Layer 2 connectivity. A shared physical interface or bridge mode are not used for this type of internal routing.

You need a Virtual System object (the new virtual firewall). In its Topology you add a Regular interface on eth3 with VLAN Tag 200 (VSX names it eth3.200). For more than one VLAN or Virtual System on the same port, eth3 is marked as a VLAN Trunk on the VSX Gateway object's Physical Interfaces page. A Bond, a Virtual Router or a Virtual Switch is not required for this scenario.

You need a Virtual System object (the new virtual firewall). In its Topology you add a Regular interface on eth3 with VLAN Tag 200 (VSX names it eth3.200). For more than one VLAN or Virtual System on the same port, eth3 is marked as a VLAN Trunk on the VSX Gateway object's Physical Interfaces page. A Bond, a Virtual Router or a Virtual Switch is not required for this scenario.

cpconfig is the primary command-line, menu-driven utility for initial and fundamental configuration of a Check Point gateway, including a VSX Gateway. It allows an administrator to enable or disable features like ClusterXL and CoreXL, and to set the number of firewall kernel instances for CoreXL. The other commands are used for different specific tasks: vsx_util for VSX maintenance, fwaccel for SecureXL, and cphaconf for clustering.

In a VSLS cluster each Virtual System is Active on exactly one member at a time (a single VS is not split across members). Load is spread by making different Virtual Systems Active on different members. A cluster that was upgraded to R81.10 in High Availability mode is converted with 'vsx_util convert_cluster' (after enabling Per Virtual System State and ClusterXL for Bridge Active/Standby in cpconfig on each member), and 'vsx_util vsls' option 'Manually set priority and weight' then sets priority 0 (Active) on member B for VS_Trading while the other Virtual Systems keep priority 0 on member A and priority 1 (Standby) on member B, so they still have an Active/Standby peer. There is no 'Per-VS High Availability' mixed mode; in High Availability mode all VSs are Active on the same member. (R81.10 VSX Administration Guide p161-162, p187-188, p192, p201)