Virtual Protection Only

By Cameron Sturdevant  |  Posted 2008-10-10 Print this article Print


The Check Point VPN-1 VE virtual appliance is used only inside the virtualized environment. It doesn't protect the physical VMware ESX host systems. An external firewall, which would likely be a Check Point VPN-1, is required for that duty.

The VPN-1 VE is a Check Point NGX R65 that provides identical security capabilities as are found in physical VPN-1 gateways. The VPN-1 VE enabled me to securely connect through the virtual gateways to shared resources inside my virtualized environment, including Web and application servers and other infrastructure, such as the DNS server. Using the VPN-1 VE, I was able to allow these resources to interact with each other and the outside Internet while maintaining standard security policies.

It was easy for me to manage the VPN-1 VE using the same SmartDashboard interface to create security rules and to carry out all administrative functions that are already used to manage physical VPN-1 gateways.

I used SmartDashboard to create and manage firewall rules that I then installed to my VPN-1 VE gateway. The SmartDashboard can be used to deploy policies to single VPN-1VE and physical gateways or to groups of firewalls.

What it does not do is associate VMs and VPN-1 VE gateways in such a way that if VMs move to a new host using VMotion, the VPN-1 VE gateways move, too. Check Point has started down the road of gaining a basis for this functionality by participating in VMware's VMsafe partner program. It's worth noting that the competitive products noted earlier are also participants in the VMsafe program. 

 Once the VPN-1 VE gateway was installed in my ESX environment, it was just a matter of implementing security policies as in any other firewall. There are no policies or rules for the virtual appliance that differ from the physical Check Point system.

Except for initial startup, when the virtual appliance spiked to 50 percent of CPU utilization, the VPN-1 VE was a well-behaved guest in my VMware ESX cluster. I'll keep the appliance around for the next several months to see how it affects performance with various workloads.

The VPN-1 VE basic resource requirements are quite modest. By default the system uses a Red Hat Enterprise Linux 3 for the OS (included in the license), one virtual CPU, 512MB of RAM and a 12GB hard disk.

eWEEK Labs Technical Director Cameron Sturdevant can be reached at


Cameron Sturdevant Cameron Sturdevant has been with the Labs since 1997, and before that paid his IT management dues at a software publishing firm working with several Fortune 100 companies. Cameron also spent two years with a database development firm, integrating applications with mainframe legacy programs. Cameron's areas of expertise include virtual and physical IT infrastructure, cloud computing, enterprise networking and mobility, with a focus on Android in the enterprise. In addition to reviews, Cameron has covered monolithic enterprise management systems throughout their lifecycles, providing the eWEEK reader with all-important history and context. Cameron takes special care in cultivating his IT manager contacts, to ensure that his reviews and analysis are grounded in real-world concern. Cameron is a regular speaker at Ziff-Davis Enterprise online and face-to-face events. Follow Cameron on Twitter at csturdevant, or reach him by email at

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel