How Customers Use Check Point Firewalls Around the Globe
Ever wanted to know how Check Point firewallls are being used around the World? With indeni Insights, you can get a glimpse into that data 24/7. See how.
Notice: This blog post was originally published on Indeni before its acquisition by BlueCat.
The content reflects the expertise and perspectives of the Indeni team at the time of writing. While some references may be outdated, the insights remain valuable. For the latest updates and solutions, explore the rest of our blog
Key takeawaysThis key takeaway was generated through LLMs crawling the page and coming up with an overview of the content.This article describes Indeni Insight, part of the Indeni Automation Platform, which benchmarks Check Point firewall deployments against a third-party dataset to help network and security engineers follow ITIL best practices. It highlights early 2018 Check Point trends from Indeni customers, including platform distribution (Gaia 76.47%, Ipso 11.76%, SecurePlatform 11.76%) and common performance and configuration issues such as high CPU usage, interface throughput limits, VPN tunnels down, kernel table limits, DNS latency, and mismatched cluster configurations. The practical outcome is that customers can use these benchmarks to decide on upgrades, identify whether issues are common across environments, and inform appliance and software purchasing decisions by enabling Indeni Insight during setup.
What is Indeni Insight and how does it help Check Point customers?
Indeni Insight is a benchmarking capability within the Indeni Automation Platform that compares a customer’s Check Point environment to a third-party dataset. By aggregating adoption and user behavior data, it helps network and security engineers determine whether observed issues or configurations are common across other environments and aligns practices with ITIL best practices. This enables teams to make informed operational decisions—such as whether to upgrade software, investigate frequent issues, or influence future appliance and software purchases—by providing context and comparative metrics.
What are the top Check Point software platforms used by Indeni customers according to the report?
The early 2018 data in the report shows the distribution of Check Point software platforms among Indeni customers: Gaia accounts for 76.47% of deployments, while both Ipso and SecurePlatform represent 11.76% each. These platform shares come from the Indeni customer dataset and are presented as a sneak peek of the Check Point trends being compiled for the fuller report.
Which performance and configuration issues did Indeni find commonly in Check Point environments?
Indeni’s early findings list multiple common issues across performance and configuration domains. Performance and ongoing issues include high CPU usage per core, interfaces nearing maximum transmit throughput, firewall kernel table limits approaching, slow DNS server response times, VPN tunnels down, aggressive aging enabled, required interfaces down, next-hop router inaccessible, repeated failed login attempts, and core dump files. Configuration issues include some virtual systems (VSes) with high CPU usage, CoreXL cores handling both interface interrupts and firewall worker tasks, critical configuration file mismatches across cluster members, software nearing end of support, static routing table mismatches across cluster members, licenses nearing expiration, network interface duplex mismatches, configurations changed but not saved, certificate authority inaccessible, and expired certificates.
To keep your business online and ensure critical devices, such as Check Point firewalls, meet operational excellence standards it is helpful to compare your environment to a third party data set. As part of the Indeni Automation Platform, customers have access to Indeni Insight which benchmarks adoption of the Check Point capabilities and user behavior to adhere to ITIL best practices. Having a third party data set is extremely helpful for network and security engineers to answer questions such as:
- Should I consider upgrading to the latest version?
- Is this a common issue in other environments, or am I alone?
- Input into future appliance and software purchases
We recently published a report around the Palo Alto Networks Automation Trends, and the data is coming in for Check Point as well. See below for a few of the early takeaways. Please comment below with the questions you have around Check Point such as, should I upgrade to R80.10? Your feedback will help shape the final report!
Sneak Peak: 2018 Check Point Trends
Top Software Platforms used by Indeni Check Point Customers:
- Gaia – 76.47%
- Ipso – 11.76%
- Secureplatform – 11.76%
Top issues found from a performance and configuration standpoint:
Performance-related and ongoing issues:
- High CPU usage per core(s)
- Interface nearing maximum Tx throughput
- Firewall kernel table limit approaching
- DNS server response time slow
- VPN tunnel(s) down
- Aggressive Aging enabled
- Required interface(s) down
- Next hop (router) inaccessible
- Repeated failed login attempts by a user
- Core dump files found
Configuration related issues:
- Some VSes have high CPU usage
- In CoreXL a single core shouldn’t handle both interface interrupts and fw worker
- Critical configuration files mismatch across cluster members
- Software end of support nearing
- Static routing table does not match across cluster members
- License expiration nearing
- Network interface duplex does not match across cluster members
- Configuration changed but not saved
- Certificate authority not accessible
- Certificate(s) has expired
Check out the potential issues that could appear in Check Point GAiA, GAiA Embedded, IPSO and Secure Platform environments on the Indeni Check Point Solution Page.
Ready to benchmark your network ? Try Indeni today and enable Indeni Insight at set up.
Related content
Automate your DDI modernization path by migrating with Micetro
Automate cross-platform DNS and DHCP migration with Micetro to reduce risk, eliminate manual effort, and modernize infrastructure faster.
How to map your network with user-defined links in Integrity X
Map your network with user-defined links in Integrity X to define and manage custom relationships, such as dual-stack and NAT environments.
Your journey to intelligent NetOps begins at Cisco Live
Visit BlueCat’s booth or book a meeting now to learn more about how our solutions can help you build a network that supports constant change.
Replace BIND and ISC with Micetro DNS/DHCP Server (MDDS)
Tired of patching and manually configuring BIND DNS and ISC DHCP? Discover how Micetro MDDS appliances can replace them for modern DDI.