CPUSE Requirements
CPUSE Requirements
License and Contract File
- Valid license must be installed on the target Gaia server.
- Valid Software Subscription or Technical Support Contract must be associated with the license.
- The Contract File must be installed on the target Gaia server.
| Notes: 1. There is a 30-day grace period upon first installation / activation of the Deployment Agent, during which no license is needed at all. 2. Evaluation License is not enough to enable Gaia Software Updates. Access to Check Point Download Server is available via subscription only. A real valid support license is required. An Evaluation License is not sufficient. |
Connection to the Internet
Gaia server should be connected to the Internet for these purposes:
- To perform online self-update of the CPUSE Deployment Agent.
- To obtain Gaia Software Updates from the Check Point cloud.
| Important - We recommend to enable the corresponding Consent Flag to download the Contract File: - In R81.20 and higher: Enable the Consent Flag " Download Security" as described in sk175504 - How to configure Check Point software to upload data to Check Point / download data from Check Point in versions R81.20 and higher - In R81.10 and lower: Enable the Consent Flag " Allow Download" as described in sk111080 - How to configure Check Point software to upload data to Check Point / download data from Check Point in versions R81.10 and lower |
For additional information, see sk94508 > section "Blade Contracts".
CPUSE Communication with the Check Point Cloud
To allow the CPUSE Deployment Agent to communicate with the Check Point cloud, follow the steps below in SmartConsole.
You must create an explicit allow-rule in these scenarios:
| Item | Scenario 1 | Scenario 2 | Scenario 3 |
|---|---|---|---|
| Scenario Description | Check Point Security Gateway running on Gaia OS, which must connect to Check Point cloud. The implied rule "Accept outgoing packets originating from Gateway" is disabled in SmartConsole > Menu > Global properties > on the FireWall page. |
Perimeter Check Point Security Gateway that protects internal Check Point server running on Gaia OS, which must connect to Check Point cloud. | Perimeter non-Check Point Firewall that protects Check Point server running on Gaia OS, which must connect to Check Point cloud. |
| Which explicit allow-rule rule to configure? | Create an explicit Access Control rule for this Check Point Security Gateway (see the procedure below) to allow the communication between the CPUSE Deployment Agent on this Check Point Security Gateway and the Check Point cloud. | Create an explicit Access Control rule for the Perimeter Check Point Security Gateway (see the procedure below) to allow the communication between the CPUSE Deployment Agent on the internal Check Point Gaia server and the Check Point cloud. | Create an explicit Firewall rule (for reference, see procedure below) for this non-Check Point Firewall to allow the communication between the CPUSE Deployment Agent on the internal Check Point Gaia server and the Check Point cloud. |
| Traffic Source | Check Point Security Gateway | Internal Check Point Gaia server | Internal Check Point Gaia server |
| Traffic Destination | Check Point domains | Check Point domains | Check Point domains |
| Traffic Protocol / Ports | The required HTTP / HTTPS / DNS traffic | The required HTTP / HTTPS / DNS traffic | The required HTTP / HTTPS / DNS traffic |
| Where to install / apply the explicit allow-rule? | Check Point Security Gateway | Perimeter Check Point Security Gateway | Perimeter non-Check Point Firewall |
Procedure for Check Point Security Gateway:
| Note - For a non-Check Point Firewall, you must create the equivalent allow-rule. See sk83520. |
- Create these Domain objects for the required Check Point domains and for the AKAMAI domain (note the period character in the beginning of the FQDN):
.updates.checkpoint.com.updates.g01.checkpoint.com.gwevents.checkpoint.com.gwevents.us.checkpoint.com.deploy.static.akamaitechnologies.com
For instructions, see the Quantum Security Management Administration Guide for your version.
- Create this Access Control security rule for the involved Security Gateway (use predefined services):
| Important - Rules with Domain Objects should be located as low as possible in the rulebase. |
For Scenario #1 - Check Point Security Gateway running on Gaia OS (and the implied rule "Accept outgoing packets originating from Gateway" is disabled)
| Source | Destination | VPN | Services & Applications | Action | Install On |
|---|---|---|---|---|---|
| Check Point Security Gateway / Cluster |
.updates.checkpoint.com.updates.g01.checkpoint.com.gwevents.checkpoint.com.gwevents.us.checkpoint.com.deploy.static.akamaitechnologies.com |
Any |
httphttpsHTTP_and_HTTPS_proxydomain-udp |
Accept |
Check Point Security Gateway / Cluster |
For Scenario #2 - Perimeter Check Point Security Gateway that protects internal Check Point server
| Source | Destination | VPN | Services & Applications | Action | Install On |
|---|---|---|---|---|---|
| Internal Check Point Gaia Server |
.updates.checkpoint.com.updates.g01.checkpoint.com.gwevents.checkpoint.com.gwevents.us.checkpoint.com.deploy.static.akamaitechnologies.com |
Any |
httphttpsHTTP_and_HTTPS_proxydomain-udp |
Accept |
Perimeter Check Point Security Gateway / Cluster |
- Install the Access Control policy on the involved Security Gateway / Cluster object.
Update of the CPUSE Deployment Agent to the Latest Version
- On an online Gaia server (that is connected to the Internet):
- The CPUSE Deployment Agent must always be updated to the latest available version before being able to perform any action.
- We recommend to leave the default CPUSE Deployment Agent setting "Automatically update Deployment Agent (recommended)" enabled. See CPUSE Update Settings.
- On an offline Gaia server (that is disconnected from the Internet), we strongly recommended to always update the CPUSE Deployment Agent manually to the latest available build. See sk92449.
| Important - Scalable Platforms (Maestro and Chassis) R81.20 and lower require a dedicated Deployment Agent package that is available in the relevant Home Page SK articles (Known Limitation MBS-2372). |
Free Disk Space
- To import a CPUSE package, the /var/log/ partition on the Gaia server must have enough free disk space - at least twice the size of the package you want to import. To see the amount of available disk space in /var/log/ partition, run this command in the Expert mode:
| `df -h |
Example output:
```
[Expert@Gaia:0]# df -h
- To upgrade to a higher Major Version, or to perform Clean Installation using CPUSE, server must have enough unallocated (unpartitioned) disk space - at least as the size of the root partition.
- Examine the size of the "root" partition:
| |
| --- |
| df -h | grep -E "Avail|\/" |
Example output:
```
[Expert@Gaia:0]# df -h
- Examine the amount of unallocated (unpartitioned) disk space:
| |
| --- |
| pvs |
Example output:
<br>[Expert@Gaia:0]# pvs<br> PV VG Fmt Attr PSize PFree<br> /dev/sda3 vg_splat lvm2 a- 57.81G 29.81G<br>[Expert@Gaia]#<br>
Management Data Plane Separation (MDPS)
When you enable MDPS (sk138672) on a Security Gateway / Cluster Members / Security Group, the CPUSE service runs in the Management Plane. Therefore, you must run all CPUSE commands only in the Management Plane.
- The Gaia Clish / Gaia gClish commands are described in CPUSE Syntax in Gaia Clish / Gaia gClish.
To go to the Management Plane in Gaia Clish / Gaia gClish, run:
set mdps environment mplane |
- The Expert mode commands are "
DAClient" and "da_cli".
To go to the Management Plane in the Expert mode, run:
mplane |
20 August 2025