7.3 Managing ElasticXL via Gaia Portal & Gaia Clish

7.3 Managing ElasticXL via Gaia Portal & Gaia Clish

Administering Check Point R82 ElasticXL requires deep proficiency in both the graphical Gaia Portal web interface and the Gaia Clish command-line environment. Security administrators must master provisioning cluster nodes, binding physical and virtual interfaces, configuring high-performance synchronization backplanes, and verifying cluster topology via CLI syntax to ensure seamless deployment and exam success.

---

Dual Management Architecture: Portal vs. Clish

Check Point R82 provides two primary management interfaces for local security gateway administration: the web-based Gaia Portal (https://<gateway-ip>) and the command-line Gaia Clish shell accessed via SSH or local console.

While SmartConsole handles global security policy management and network object definitions across the entire enterprise, local gateway configurations—such as cluster member initialization, physical interface roles, MTU settings, and initial Secure Internal Communication (SIC) pairing—are executed directly on individual gateway nodes using Gaia Portal or Gaia Clish.

---

Gaia Clish Administration for ElasticXL

Gaia Clish (Command Line Shell) contains dedicated command trees specifically designed for configuring, managing, and inspecting ElasticXL cluster parameters without requiring a graphical web browser.

Essential Clish Configuration Commands (set elasticxl)

# 1. Set the operating mode of the local node (SMO Master vs Member Node)
set elasticxl mode {smo | member}

# 2. Configure cluster identification and shared secret authentication
set elasticxl cluster-name CCSE_ElasticXL_Cluster shared-secret MySecretPass123!

# 3. Assign interface roles (management, cluster traffic, or sync backplane)
set elasticxl interface eth0 type management
set elasticxl interface eth1 type cluster
set elasticxl interface eth2 type sync

# 4. Enable automatic Jumbo Frames MTU sizing on sync interface
set interface eth2 mtu 9000

# 5. Enable automatic package and policy synchronization from SMO
set elasticxl scale-out auto-sync enable

# 6. Save Gaia Clish configuration changes permanently to active database
save config

Essential Clish Monitoring Commands (show elasticxl)

# Display high-level ElasticXL operational summary and active member count
show elasticxl summary

# Display list of registered cluster member nodes, hostnames, IP addresses, and health states
show elasticxl members

# Display detailed health, SMO leader election state, and flow matrix allocations
show elasticxl status

# Display synchronization interface statistics, packet counts, and dropped sync frames
show elasticxl sync-stats

Comprehensive Clish Command Reference

---

Step-by-Step Node Provisioning & Join Workflow

Provisioning a new Check Point gateway appliance as an ElasticXL cluster member node requires a strict sequence of administrative actions. Following this standardized workflow ensures that new hardware joins the cluster without disrupting active state tables.

                     PROVISIONING WORKFLOW VIA GAIA CLISH

  +-----------------------------------------------------------------------+
  | Step 1: Initial Gaia OS Installation & Basic IP Setup                 |
  | Install R82 Gaia OS, configure management IP on eth0, set admin pass   |
  +-----------------------------------+-----------------------------------+
                                      |
                                      v
  +-----------------------------------------------------------------------+
  | Step 2: Configure Interface Sizing & MTU 9000                         |
  | Execute `set interface eth2 mtu 9000` and save configuration          |
  | Execute `set elasticxl interface eth2 type sync`                      |
  +-----------------------------------+-----------------------------------+
                                      |
                                      v
  +-----------------------------------------------------------------------+
  | Step 3: Define Cluster Parameters & Shared Secret                      |
  | Execute `set elasticxl mode member`                                   |
  | Execute `set elasticxl cluster-name CCSE_Cluster shared-secret Secret` |
  +-----------------------------------+-----------------------------------+
                                      |
                                      v
  +-----------------------------------------------------------------------+
  | Step 4: Initiate Join & Automated Package Synchronization             |
  | Node authenticates with SMO Master, pulls JHF patch level & policy,    |
  | synchronizes connection state tables, and transitions to Active Worker|
  +-----------------------------------------------------------------------+

Detailed Phase-by-Phase Provisioning Walkthrough

1. Phase 1: Basic Gaia OS Sizing and Network Setup Install Check Point Quantum R82 Gaia OS on the target appliance. Boot into Clish or the First Time Configuration Wizard to set the hostname, primary management IP address on eth0, default gateway, NTP server synchronization, and DNS resolvers. Ensure the system clock matches the active SMO Master within 5 seconds to prevent certificate validation errors during authentication.

2. Phase 2: Sync Interface Alignment & MTU Sizing Configure physical interface parameters prior to joining the cluster. Interface names must align with the cluster topology. Assign eth2 as the dedicated state synchronization interface and increase its MTU to 9000 (Jumbo Frames) to accommodate large state sync payloads:

   set interface eth2 mtu 9000
   set elasticxl interface eth2 type sync
   

3. Phase 3: Cluster Authentication and Passphrase Setup Define the operating mode as member and provide the exact cluster name and shared secret passphrase configured on the SMO Master Leader:

   set elasticxl mode member
   set elasticxl cluster-name CCSE_ElasticXL_Cluster shared-secret StrongClusterPass2026!
   save config
   

4. Phase 4: Join Execution and Automated Cloning Once saved, the local ElasticXL daemon (elxld) initiates an outbound connection to the SMO Master Leader over the management network. The SMO Master authenticates the candidate node using the shared secret, provisions SIC certificates, pushes the active Jumbo Hotfix Accumulator (JHA) build, clones the active security policy, and registers the node in the cluster state table. The node automatically enters the Active Worker state once state synchronization completes.

---

State Synchronization Network Setup & Interface Alignment Rules

Stateful connection synchronization across ElasticXL member nodes is the core foundation of high-availability packet processing. Because state sync traffic contains raw kernel connection table delta payloads, the network design must follow strict technical requirements:

1. Dedicated Non-Routable Layer 2 Backplane

Synchronization interfaces (type sync) must be connected to an isolated, non-routable Layer 2 switch segment or dedicated VLAN. State sync traffic must never traverse Layer 3 routers or shared corporate networks without VLAN isolation. Passing sync traffic through unsegmented networks exposes connection tokens to security risks and introduces variable latency that degrades cluster performance.

2. Jumbo Frames (MTU 9000) Sizing & Verification

High-velocity connection updates generate bursts of state synchronization packets. Standard 1500-byte MTU frames cause high packet counts and IP fragmentation during traffic spikes, leading to excessive CPU utilization on security gateways and switch ports. Configuring Jumbo Frames (MTU 9000) across all sync interfaces, bond interfaces, and intermediate switch ports eliminates fragmentation.

Verify Jumbo Frame end-to-end transport from Gaia Clish using unfragmented ping packets:

# Verify MTU 9000 connectivity to peer sync IP without fragmentation (-M do -s 8972)
ping -M do -s 8972 192.168.10.12

3. Interface Naming & Topology Alignment

Interface designations and physical roles must be strictly identical across all member nodes in an ElasticXL cluster. For example:

• If eth0 is designated as management on Node-01, eth0 must be management on all worker nodes.
• If eth1 is bound to the external client VIP on Node-01, eth1 must connect to the external VLAN on all worker nodes.
• If eth2 is designated as sync on Node-01, eth2 must connect to the dedicated sync VLAN on all worker nodes.

Mismatched interface mappings prevent SecureXL from building proper 5-tuple hash matrices and result in cluster member isolation.

4. Sync Link Aggregation (Bonding) for Redundancy

For maximum reliability, high-throughput production environments should configure dual physical interfaces into an active-active or active-backup Gaia Link Aggregation bond (e.g., bond1 comprised of eth2 and eth3) before assigning the ElasticXL sync role:

# Configure IEEE 802.3ad LACP bond interface in Clish
add bonding group 1 preference active-active
add bonding group 1 interface eth2
add bonding group 1 interface eth3
set interface bond1 mtu 9000
set elasticxl interface bond1 type sync
save config

---

Gaia Portal Graphical Configuration Guide

While Gaia Clish provides powerful CLI automation, the Gaia Portal offers a visual management interface ideal for real-time cluster topology monitoring and initial wizard-based configuration.

                    GAIA PORTAL ELASTICXL DASHBOARD
 +------------------------------------------------------------------------+
 | Check Point Gaia Portal - Gateway: GW-Node-01 (Active Master)          |
 +------------------------------------------------------------------------+
 | Navigation Tree           | ElasticXL Cluster Overview                 |
 |  - Network Interfaces     | Cluster Name: CCSE_ElasticXL_Cluster       |
 |  - Device Information     | Status: Healthy (4 / 4 Nodes Active)       |
 |  - High Availability &    | SMO Leader: GW-Node-01 (192.168.10.11)     |
 |    ElasticXL              |                                            |
 |  - System Configuration   | Active Nodes Canvas:                       |
 |  - Maintenance            |  [Node-01: Master (SMO)]  [Node-02: Worker] |
 |                           |  [Node-03: Worker]        [Node-04: Worker] |
 |                           |                                            |
 |                           | Quick Actions:                             |
 |                           |  [+ Add Member Node]   [Drain Node]        |
 |                           |  [Sync Status Check]   [Download Logs]     |
 +------------------------------------------------------------------------+

Visual Step-by-Step Portal Setup Workflow

1. Open a web browser and navigate to https://<gateway-ip> to access Gaia Portal.
2. Enter administrator credentials and log in.
3. In the left navigation menu under Network Management, click High Availability & ElasticXL.
4. Click Launch ElasticXL Setup Wizard.
5. Select the node role:
   • Choose Single Management Object (SMO) Master for the first cluster node.
   • Choose Cluster Member Node for subsequent expansion appliances.
6. Enter the Cluster Identification Name and Shared Secret Passphrase.
7. Review the Interface Mapping Table visually:
   • Set Management interface to eth0.
   • Set Traffic interface to eth1.
   • Set State Sync interface to eth2 and verify the MTU 9000 checkbox is enabled.
8. Click Finish & Apply. The portal establishes the cluster configuration and updates the real-time topology canvas with node status badges:
   • Green Badge: Active Member Node processing traffic normally.
   • Blue Badge: SMO Master Leader managing cluster state and package updates.
   • Yellow Badge: Node in process of syncing or joining cluster.
   • Red Badge: Member Node in Down state or experiencing interface failure.

---

Maintenance Workflows: Draining & Node Removal

Performing hardware upgrades or scheduled maintenance on an active ElasticXL member node requires isolating the node without dropping active customer connections.

Connection Draining Workflow (set elasticxl node drain)

Before taking a gateway node offline for physical maintenance, administrators should execute connection draining:

# 1. Enable connection draining on the local node via Clish
set elasticxl node drain enable

# 2. Monitor remaining active connections until count reaches zero
show elasticxl status

# 3. Once connections drain completely, stop cluster services safely
cpstop

When connection draining is enabled:

• SecureXL stops forwarding new connection establishment requests to the draining node.
• Existing active TCP connections on the node continue to process normally until closed by clients.
• Once active connection counters reach zero, the node can be safely stopped (cpstop) or rebooted without impacting user sessions.