vg_splat-lv_current 100%, Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

Published August 24, 2014 by john

7

Checkpoint Firewall Appliances are using Logical Volume Manager (LVM)

Sometimes, the logic volume do not have enough size to perform your operations. Checkpoint Expert Mode have some commands to modify the volume size while keeping your data on the disk.

1. Check volume size in the volume group vg_splat

[Expert@gw-a9533e:0]# lvs
  /dev/hdc: open failed: No medium found
  LV         VG       Attr   LSize Origin Snap%  Move Log Copy% 
  lv_current vg_splat -wi-ao 5.00G                              
  lv_log     vg_splat -wi-ao 3.00G

From dh -h command it shows 97% usage on the system volume vg_splat-lv_current. R77.10 will not allow you to operation the firewall if it found insufficient disk space with the warning “there is insufficient disk space to complete the operation’

[Expert@gw-a9533e:0]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                      4.9G  4.8G  52M  97% /
/dev/sda1             289M   24M  251M   9% /boot
tmpfs                 980M     0  980M   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                      3.0G  175M  2.6G   7% /var/log

2. Check free space on the disk

[Expert@gw-a9533e:0]# pvs
  /dev/hdc: open failed: No medium found
  PV         VG       Fmt  Attr PSize  PFree
  /dev/sda3  vg_splat lvm2 a-   14.69G 6.69G

3. Check how much space assigned to the logical volume

[Expert@gw-a9533e:0]# lvs
  /dev/hdc: open failed: No medium found
  LV         VG       Attr   LSize Origin Snap%  Move Log Copy% 
  lv_current vg_splat -wi-ao 5.00G                              
  lv_log     vg_splat -wi-ao 3.00G      

4. Resize the logic volume from 5G to 11G

[Expert@gw-a9533e:0]# lvresize -L 11G vg_splat/lv_current
  /dev/hdc: open failed: No medium found
  Extending logical volume lv_current to 11.00 GB
  Logical volume lv_current successfully resized

 Check the space again with pvs command, there is only 704M free space left
[Expert@gw-a9533e:0]# pvs
  /dev/hdc: open failed: No medium found
  PV         VG       Fmt  Attr PSize  PFree  
  /dev/sda3  vg_splat lvm2 a-   14.69G 704.00M

[Expert@gw-a9533e:0]# lvs
  /dev/hdc: open failed: No medium found
  LV         VG       Attr   LSize  Origin Snap%  Move Log Copy% 
  lv_current vg_splat -wi-ao 11.00G                              
  lv_log     vg_splat -wi-ao  3.00G  

5. Resize the file system                    

[Expert@gw-a9533e:0]# resize2fs /dev/vg_splat-lv_current
resize2fs 1.39 (29-May-2006)
Filesystem at /dev/vg_splat/lv_current is mounted on /; on-line resizing required
Performing an on-line resize of /dev/vg_splat/lv_current to 2883584 (4k) blocks.
The filesystem on /dev/vg_splat/lv_current is now 2883584 blocks long.

6. Verify with df command

[Expert@gw-a9533e:0]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                       11G  3.8G  6.4G  38% /
/dev/sda1             289M   24M  251M   9% /boot
tmpfs                 980M     0  980M   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                      3.0G  176M  2.6G   7% /var/log

References:

• http://blog.lachmann.org/wp-content/uploads/2010/09/2010-CPUG-CON-Tobias-Lachmann-Best-practices-for-the-Check-Point-UTM-1-appliances.pdf
• http://www.networkoc.net/check-point-gaia-extending-your-disk/

Fortigate FortiOS 5.6 Redundant Internet Connections without SD-WAN

The scenario:
ISP 1 is on wan1, your IP is 1.1.1.2, gateway is 1.1.1.1
ISP 2 is on wan2, your IP is 2.2.2.2, gateway is 2.2.2.1
This configuration will be set up in a primary/secondary failover mode, i will not be doing load balancing

1. Setup gateway detection on wan1

This section tells the firewall to ping an IP (in this case, our gateway) repeatedly to see if it's alive or not. For most cable and DSL type connections this will work fine, however if you are interfacing with another ISP's router that may continue responding to pings even if the circuit is down, then consider using an internet IP such as 4.2.2.2 or 8.8.8.8. You can do this on both wan interfaces if you want it to fail both directions.

config router gwdetect
    edit 1
        set interface "wan1"
        set server "1.1.1.1"
    next
end

On newer firmware, this is replaced with link monitoring:

config system link-monitor
    edit "wan1 check"
        set srcintf "wan1"
        set server "1.1.1.1"
        set gateway-ip 1.1.1.1
        set timeout 5
        set recoverytime 1
    next
end

2. Configure your interfaces

Most of this can be done in the web interface, the only critical piece here are the two fail-detect options on wan1. You can also turn on failure detection for wan2 (make sure you add a gwdetect for it as well), however i don't find it necessary here since if both wan1 and wan2 are down then i'm screwed anyways. Note that the fail-detect options are not necessary on newer firmware.

config system interface
    edit "wan1"
        set ip 1.1.1.2 255.255.255.248
        set fail-detect enable
        set fail-detect-option detectserver
    next
    edit "wan2"
        set ip 2.2.2.2 255.255.255.248
    next
end

3. Configure your static routes

These can be done in the web interface, the important piece is to set the distance on wan2 to a higher value than wan1 so that wan1 is always the preferred route

config router static
    edit 1
        set device "wan1"
        set gateway 1.1.1.1
    next
    edit 2
        set device "wan2"
        set distance 20
        set gateway 2.2.2.1
    next
end

4. Configure Policies

This doesn't need to be done in the CLI, you just need to have an internal to wan1 allow/NAT rule, as well as an internal to wan2 allow/NAT rule. It will choose the proper rule based on which port the traffic is being routed through (the active internet connection). In case you want to see it in CLI, here it is:

config firewall policy
    edit 1
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 2
        set srcintf "internal"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

5. Test and confirm

At this point you should be up and running. You can check the status of the gateway detection using get router info gwdetect. You can also check the routing table status using get router info routing-table all.

It is important that when you do your testing you simulate a logical failure of the circuit so your wan1 stays "up". The easy way to do this is to unplug the carrier side of the equipment (unplug the coax for cable, phone line for DSL, T1/loops for T1/EoC/EoDS1, etc.)

6. VPN setup

If you have IPSEC VPN tunnels and want them to also follow the redundancy here, then there is a little more work to do. This is assuming you already have the tunnel set up on wan1. You would just create the tunnel identically on wan2, selecting wan2 as the local interface. Make sure both tunnels have DPD (Dead Peer Detection) turned on.

After setting up the second tunnel, you will add an IPSEC policy from internal to wan2 using the new tunnel configuration. You will of course have to configure the secondary tunnel on the other end as well. After doing this, the VPN should follow the active interface

7. Using VIPs on backup links

One small quirk, if your default route points out wan1 for example, but you want to have servers using Virtual IPs on wan2 while wan1 is still active, you need to do this:

config system settings
  set asymroute enable
end

This is necessary because the Fortigate will think traffic coming in over wan2 is spoofed unless the default route is pointing there. It would be preferable to leave this feature disabled but this is really the only way to accomplish having both circuits live at the same time.