> Source: [sk179752](https://support.checkpoint.com/results/sk/sk179752)
# sk179752 - Check Point Cloud Firewall - How to configure cloud-init automation
| Property | Value |
|----------|-------|
| Solution ID | sk179752 |
| Date Created | 2022-07-31 |
| Last Modified | 2026-09-07 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| OS | Gaia |
## Solution
CorvusCorax8928!
Introduction
------------
The cloud-init automation lets you provision your Check Point Cloud Firewall instances with a defined configuration and start serving customers right after the instance boots.
It is necessary to provide a cloud-config configuration file (denoted by #cloud-config in the first line) in the User Data field of your selected cloud/virtualization platform.
FAQ
---
Click Here to Show this Section
* "Your cloud-init configuration is corrupt or contains error"
> This message means that your configuration did not pass one of the validations. Repair the stated errors and provision a new instance. Even if you can connect to the server, the instance status is INVALID.
* How to provide userdata in VMware images?
> Follow [sk180334](https://support.checkpoint.com/results/sk/sk180334) to unpack your ova (if needed) and [sk180335](https://support.checkpoint.com/results/sk/sk180335) to update the userdata.
> **Note:** Providing userdata only works in vCenter deployments. Simple vSphere / ESXi deployments don't work due to VMware limitations on OVF templates.
* How to provide userdata in KVM environment?
> Follow [sk180452](https://support.checkpoint.com/results/sk/sk180452).
Modules {#cloudinittop}
-----------------------
|-------------------------------------------------|--------------------------------------|------------------------------------------------------|-----------------------------------------------|
| * blink_config * config_system * clish * runcmd | * bootcmd * hostname * motd * banner | * ntp * ssh_authorized_keys * password * sshd_config | * write_files * growpart * network * timezone |
Examples for Cloud-Init YAML
----------------------------
* Gateway
* Management
blink_config {#blink_config}
----------------------------
**Summary:**
This setting lets you run a First-time Wizard on a blinked image (an image with a defined role - a Cloud Firewall Gateway or a Security Management Server).
The `blink_config` Expert command has all the available parameters.
**Note:** Before using this setting, first run `blink_config --dry-run` on your configuration to make sure it passes validation.
**Config Schema:** **blink_config:** (object)
|----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **gateway_cluster_member** (bool) | Enable/Disable ClusterXL. This option requires a reboot. |
| **install_mds_primary** (bool) | TBD |
| **install_mds_secondary** (bool) | TBD |
| **install_mds_interface** (string) | TBD |
| **mgmt_admin_radio** (enum - gaia_admin/new_admin) | Management administrator configuration. Set to "*gaia_admin* " if you wish to use the Gaia 'admin' account. Set to "*new_admin* " if you wish to configure a new admin account. You must provide it if Security Management is installed. |
| **mgmt_admin_name** (string) | Management administrator username. If you select to configure a new management admin account (*new_admin*), you must fill in the credentials. |
| **mgmt_admin_passwd** (string) | Management administrator password. If you select to configure a new management admin account (new_admin), you must fill in the credentials. |
| **ftw_sic_key**(string) | Secure Internal Communication key. |
| **admin_hash**(string) | Optional parameter. Interchangeable with admin_password_regular. |
| **admin_password_regular** (string) | Optional parameter. Interchangeable with admin_hash. |
| **maintenance_hash**(string) | **Version specific: R81.20 and higher** Default maintenance password (to generate use grub2-mkpasswd-pbkdf2). Interchangeable with maintenance_password_regular. |
| **maintenance_password_regular** (string) | **Version specific: R81.20 and higher.** Default maintenance password. Interchangeable with maintenance_hash. |
| **hostname**(string) | Optional parameter. |
| **iface**(string) | Optional parameter. Specify management interface name. |
| **ipstat_v4**(enum - manually/off) | TBD Specify if to change IP address settings. |
| **ipaddr_v4**(string - ipv4) | Optional parameters. Require "iface" to be specified. Specify interface IPv4 address. |
| **masklen_v4**(integer - \[0-32\]) | Optional parameters, require "iface" to be specified. Specify interface IPv4 mask length. |
| **default_gw_v4 (string - ipv4)** | Optional parameters, require "iface" to be specified. Specify interface default gateway. |
| **download_from_checkpoint_non_security** (bool) | Automatically download software updates and new features (highly recommended). See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **download_info** (bool) | Mandatory parameter. Automatically download and install Software Blade Contracts, security updates, and other important data (very recommended). See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **upload_info**(bool) | Mandatory parameter. Help Check Point improve the product by sending anonymous information. See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **upload_crash_data**(bool) | Help Check Point improve the product by sending core dump files and other relevant crash data. See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **reboot_if_required**(bool) | Optional parameter. |
| **install_mgmt_primary**(bool) | Only one of these parameters (install_mgmt_primary/install_mgmt_secondary) can be "true" (the validator enforces mutual exclusion). If no primary or secondary is specified, log server is installed. Requires that a Security Management is installed. |
| **install_mgmt_secondary**(bool) | Only one of these parameters (install_mgmt_primary/install_mgmt_secondary) can be "true" (the validator enforces mutual exclusion). If no primary or secondary is specified, log server is installed. Requires that a Security Management is installed. |
| **install_log_server** (bool) | TBD |
| **primary** (string - ipv4) | Optional parameters, IP address of primary DNS server. |
| **secondary** (string - ipv4) | Optional parameters, IP address of secondary DNS server. |
| **tertiary** (string - ipv4) | Optional parameters, IP address of tertiary DNS server. |
| **ntp_primary** (string) | Optional parameter, primary NTP server. |
| **ntp_primary_version** (integer - \[1-4\]) | Optional parameter, the primary NTP server version. |
| **ntp_secondary** (string) | Optional parameter, secondary NTP server. |
| **ntp_secondary_version** (integer - \[1-4\]) | Optional parameter, the secondary NTP server version. |
| **proxy_address** (string - ipv4) | Optional parameters, the proxy server IP address. |
| **proxy_port**(integer - \[1-65535\]) | Optional parameters, the proxy server port. |
| **domainname** (string) | Optional parameters, Domain Name (for example, "checkpoint.com"). |
| **timezone**(string) | Time Zone in format Area/Region (for example, America/New_York or ETC/GMT-5). |
| **ipstat_v6** (enum - manually/off) | Specify if to change IP address settings. |
| **ipaddr_v6** (string - ipv6) | Optional parameters. Require "iface" to be specified. Specify interface IPv6 address. |
| **masklen_v6** (integer - \[0-32\]) | Optional parameters, require "iface" to be specified. Specify interface IPv6 mask length. |
| **default_gw_v6** (string - ipv6) | Optional parameters, require "iface" to be specified. Specify interface default gateway. |
**Example:**
**Cloud Firewall Gateway configuration:**
`blink_config:`
` admin_password_regular: "MyRegularPassword"`
` maintenance_password_regular: "MyRegularMaintenancePassword"`
` mgmt_admin_radio: gaia_admin`
` download_info: true`
` upload_info: true`
` upload_crash_data: true`
` ftw_sic_key: "aaaa"`
` gateway_cluster_member: false`
**Security Management Server configuration:**
`blink_config:`
` hostname: "MyManagementHost"`
` mgmt_admin_radio: gaia_admin`
` install_mgmt_primary: true`
` DNS/NTP: true`
` ftw_sic_key: "aaaa"`
` admin_password_regular: "MyRegularPassword"`
` admin_hash: "MyRegularMaintenancePassword"`
Back to Top
*** ** * ** ***
config_system {#config_system}
------------------------------
**Summary:**
This setting lets you run the First-time Wizard (usually, for images defined as Standalone/Security Management).
The config_system expert command has all the available parameters.
**Note:** Before using this setting, first run `config_system --dry-run` on your configuration to make sure it passes validation.
**Config Schema:** **config_system:** (object)
|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **install_security_gw** (bool) | Install Security Gateway. Not supported in blink_config. |
| **gateway_cluster_member** (bool) | Enable/Disable ClusterXL. This option requires a reboot. |
| **gateway_daip** (bool) | Enable DAIP (dynamic IP) gateway. |
| **install_security_managment** (bool) | Install Security Management. Not supported in blink_config. |
| **install_mgmt_primary** (bool) | Optional parameters, only one of the parameters (install_mgmt_primary/install_mgmt_secondary) can be "true". If no primary or secondary is specified, log server is installed. Requires that a Security Management is installed. |
| **install_mgmt_secondary** (bool) | Optional parameters, only one of the parameters (install_mgmt_primary/install_mgmt_secondary) can be "true". If no primary or secondary is specified, log server is installed. Requires that a Security Management is installed. |
| **install_mds_primary** (bool) | TBD |
| **install_mds_secondary** (bool) | TBD |
| **install_mlm** (bool) | Not supported in blink_config. |
| **install_mds_interface** (string) | TBD |
| **mgmt_admin_radio**(enum - gaia_admin/new_admin) | Management administrator configuration. Set to "gaia_admin" if you use the Gaia 'admin' account. Set to "new_admin" if you want to configure a new admin account. Must be provided, if Security Management installed. |
| **mgmt_admin_name** (string) | If you chose to configure a new management admin account (new_admin), you must fill in the credentials. Management administrator username. |
| **mgmt_admin_passwd**(string) | If you chose to configure a new management admin account (new_admin), you must fill in the credentials. Management administrator password. |
| **mgmt_gui_clients_radio**(enum - any/range/network/this) | Management GUI clients - select which GUI clients can log into the Security Management. Set to "any" if any host is allowed to connect to the management. Set to "range" if a range of IP addresses is allowed to connect to the management. Set to "network" if IP addresses from a specific network are allowed to connect to the management. Set to "this" if one IP address is allowed to connect to the management. You must provide it if Security Management is installed. Not supported in blink_config. |
| **mgmt_gui_clients_first_ip_field**(string - ipv4) | In case of "range", provide the first IP address in dotted format. Not supported in blink_config. |
| **mgmt_gui_clients_last_ip_field** (string - ipv4) | In case of "range", provide the last IP address in dotted format. Not supported in blink_config. |
| **mgmt_gui_clients_ip_field** (string - ipv4) | In case of "network", provide IP address in dotted format. Not supported in blink_config. |
| **mgmt_gui_clients_subnet_field** (integer - \[1-32\]) | In case of "network", provide netmask length in range 1-32. Not supported in blink_config. |
| **mgmt_gui_clients_hostname**(string) | In case of a single IP address. Not supported in blink_config. |
| **ftw_sic_key**(string) | Secure Internal Communication key. |
| **maas_authentication_key**(string) | Management as a Service - optional parameter for Security Gateway only. |
| **admin_hash**(string) | Optional parameter. |
| **maintenance_hash**(string) | **Version: R81.20 and higher.** Default maintenance password (to generate, use grub2-mkpasswd-pbkdf2). |
| **hostname**(string) | Optional parameter. |
| **iface**(string) | Optional parameter. Specifies management interface name. |
| **ipstat_v4**(enum - manually/off) | TBD. Specifies if to change IP address settings. |
| **ipaddr_v4**(string - ipv4) | Optional parameter, requires "iface" to be specified. Specifies interface IPv4 address. |
| **masklen_v4**(integer - \[0-32\]) | Optional parameter, requires "iface" to be specified Specifies interface IPv4 mask length. |
| **default_gw_v4**(string - ipv4) | Optional parameter, requires "iface" to be specified Specifies interface default gateway. |
| **ntp_primary**(string) | Optional parameter, primary NTP server. |
| **ntp_primary_version**(integer - \[1-4\]) | Optional parameter, the primary NTP server version. |
| **ntp_secondary**(string) | Optional parameter, secondary NTP server. |
| **ntp_secondary_version** (integer - \[1-4\]) | Optional parameter, the secondary NTP server version. |
| **primary**(string - ipv4) | Optional parameters, IP address of primary DNS server. |
| **secondary**(string - ipv4) | Optional parameters, IP address of secondary DNS server. |
| **tertiary**(string - ipv4) | Optional parameters, IP address of tertiary DNS server. |
| **proxy_address**(string - ipv4) | Optional parameters, the proxy server IP address. |
| **proxy_port**(integer - \[1-65535\]) | Optional parameters, the proxy server port. |
| **domainname**(string) | Optional parameters, Domain Name (for example, "checkpoint.com"). |
| **timezone**(string) | Time Zone in format Area/Region (for example, America/New_York or Etc/GMT-5). |
| **download_from_checkpoint_non_security** (bool) | Automatically download software updates and new features (highly recommended). See [sk175504.](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504) |
| **download_info**(bool) | Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended). See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **upload_info**(bool) | Help Check Point improve the product by sending anonymous information. See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **upload_crash_data**(bool) | Help Check Point improve the product by sending core dump files and other relevant crash data. See [sk175504](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175504). |
| **reboot_if_required**(bool) | Optional parameter. |
**Example:**
**Management configuration:**
`config_system:`
` hostname: "MyHost"`
` domainname: "MyDomain.com"`
` timezone: "America/Indiana/Indianapolis"`
` ftw_sic_key: "aaaa"`
` install_security_managment: true`
` mgmt_gui_clients_radio: any`
` download_info: true`
` upload_info: true`
` upload_crash_data: true`
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Back to Top
*** ** * ** ***
banner
------
**Summary:**
This setting lets you set a banner for users. It is displayed to all users with the password prompt.
**Config Schema:** **banner:** (string)
**Example:**
`banner: |`
` ** CloudGuard Network Security **`
` This machine is accessible to authorized personnel only`
Back to Top
*** ** * ** ***
password
--------
**Summary:**
This setting lets you change the default admin password.
**IMPORTANT:** Change the password set by this section as this data is always available and is not correctly secured by the hypervisor. Use it ONLY for first provisioning purposes.
**Config Schema:** **password:** (string)
**Example:**
`password: "myinitialpass"`
Back to Top
*** ** * ** ***
motd {#motd}
------------
**Summary:**
This setting lets you set a message of the day for users. The message is displayed to all users when they log in.
**Config Schema:** **motd:** (string)
**Example:**
`motd: |`
` You have logged into the system.`
` By using this product you agree to the terms and conditions`
` as specified in https://www.checkpoint.com/download_agreement.html`
Back to Top
*** ** * ** ***
hostname {#hostname}
--------------------
**Summary:**
This setting lets you set a hostname for the machine.
**Config Schema:** **hostname:** (string)
**Example:**
`hostname: "evilcorp-gw"`
Back to Top
*** ** * ** ***
ssh_authorized_keys {#ssh_authorized_keys}
------------------------------------------
**Summary:**
This setting lets you set a list of public SSH keys for the admin account.
**Config Schema:** **ssh_authorized_keys:** (string array)
A list of public SSH keys commands.
**Example:**
`ssh_authorized_keys:`
` - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCLTbws....sQcXX1TDqOaj5COO7ZVKimIWYozN9g3U+g92TIACrtzYJ george@evilcorp.com`
` - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAnzjkTb3l....HiYANP6hivd3wVYtmrrZ0zfmzYZWDw4NHG/ftwwnHgr+b john@goodcorp.com`
` - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdaQwGNgsYXcRTi3JelfJ9pdJtm4Olbn9q7ohdzjnRW bob@goodcorp.com `
Back to Top
*** ** * ** ***
clish {#clish}
--------------
**Summary:**
This setting lets you run a Clish command during the boot process.
**Note:** Clish commands will be executed as a single transaction, therefore you should not add transactions by yourself.
**Config Schema:** **clish:** (string array)
A list of clish commands
**Example:**
`clish:`
` - set user admin shell /bin/bash`
` - set user admin password-hash $1$Vy/Wsdqg$gBmdx0qStKpYFX0PitsTC1`
Back to Top
*** ** * ** ***
runcmd {#runcmd}
----------------
**Summary:**
This setting lets you run an arbitrary command during the end of the boot process.
**Config Schema:** **runcmd:** (string array)
A list of shell commands
**Example:**
`runcmd:`
` - rm -rf /tmp/*`
` - echo "Hello World" > /var/log/ilovecp`
Back to Top
*** ** * ** ***
bootcmd {#bootcmd}
------------------
**Summary:**
This setting lets you run an arbitrary command during the start of the boot process. Be careful: not all OS functionality is available at this stage.
**Config Schema:** **bootcmd:** (string array)
A list of shell commands
**Example:**
`runcmd:`
` - rm -rf /tmp/*`
` - echo "Hello World" > /var/log/ilovecp`
Back to Top
*** ** * ** ***
sshd_config {#sshd_config}
--------------------------
**Summary:**
This setting lets you set your Gaia SSHD configuration. The configuration is a gateway to the allowed values by OpenSSL-server.
**Config Schema:** **sshd_config:** (object)
|---------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **usedns** (enum - yes/no) | Specifies if SSHD should look up the remote hostname and examine that the resolved hostname for the remote IP address maps back to the same IP address. |
| **clientaliveinterval** (integer) | Sets a timeout interval in seconds, after which if no data is received from the client, SSHD sends a message through the encrypted channel to request a response from the client. |
| **passwordauthentication** (enum - yes/no) | Specifies if password authentication is allowed. |
| **permitrootlogin** (enum - yes/no/without-password/forced-commands-only) (enum - yes/no/without-password/forced-commands-only) | Specifies if root can log in using SSH. |
**Example:**
`sshd_config:`
` usedns: no`
` clientaliveinterval: 180`
` passwordauthentication: yes`
` permitrootlogin: yes`
Back to Top
*** ** * ** ***
write_files {#write_files}
--------------------------
**Summary:**
This setting lets you set your Gaia SSHD configuration.
The configuration is a gateway to the allowed values by the OpenSSL server.
**Config Schema:** **write_files:** (object array)
|----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| **path** (string) | Path to the file with the decoded content. |
| **encoding** (enum - gz/gzip/gz+base64/gzip+base64/gz+b64/ gzip+b64/b64/base64/"text/plain") | Optional encoding type of the content. Default is text/plain, and no content decoding is performed. |
| **permissions**(string) | Optional file permissions to set. Represented as an octal string '0###'. Default: 0644 |
| **append** (bool) | Whether to append content to the existing file if the path exists. Default: false. |
| **defer** (bool) | Defer writing the file until the end of, after users are created and packages are installed. Default: false. |
| **content**(string) | Optional content to write to the provided path. When content is present, and encoding is not 'text/plain,' decode the content before writing. Default: '' |
**Example:**
`write_files:`
` - path: /tmp/script1`
` content: !!str |`
` #bin/bash`
` echo "CloudGuard Network Security"`
` permissions: '0755'`
` - encoding: b64`
` content: SSBMb3ZlIENoZWNrIFBvaW50`
` path: /var/log/mylog.log`
` permissions: '0644'`
` append: true`
` defer: true`
Back to Top
*** ** * ** ***
ntp {#ntp}
----------
**Summary:**
This setting lets you enable and configure NTP.
**Config Schema:** **ntp:** (object)
|----------------------------|------------------------------------------------------|
| **enabled** (bool) | |
| **servers** (string array) | List of NTP servers to configure. Maximum 2 servers. |
**Example:**
`ntp:`
` enabled: true`
` servers:`
` - il.pool.ntp.org`
` - 178.33.101.145`
Back to Top
*** ** * ** ***
growpart {#growpart}
--------------------
**Summary:**
This setting lets you grow Gaia partitions with more disks or change the allocation of the preinstalled Gaia OS partitions provided by the image file.
**Config Schema:** **growpart:** (object)
|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **root_size_gib** (integer) | Desired size for the root partition in GiB units. It is deducted from the first disk (disk1) only. |
| **log_size_gib** (integer) | Desired size for the log partition in GiB units. It is deducted from *the first disk (disk1)* only. Note: r*oot_size_gib + log_size_gib* must be smaller than the size of disk1. |
| **additional_drives**(object array) | Settings for drives other than disk1 (disk2+). Each index is a setting for a drive ordered by the order presented by the hypervisor. |
| **root_size_percent** (integer) | Desired percentage from diskX to be allocated to the root partition. Must be a number between 0 and 100. |
| **log_size_percent** (integer) | Desired percentage from diskX to be allocated to the log partition. Must be a number between 0 and 100. |
**Example:**
`growpart:`
` root_size_gib: 20`
` log_size_gib: 45`
` additional_drives:`
` - root_percent: 5`
` log_percent: 50`
` - root_percent: 10`
` log_percent: 60`
Back to Top
*** ** * ** ***
network {#network}
------------------
**Summary:**
This setting lets users customize the network configuration of their instance's networking interfaces by assigning subnet configuration, virtual device creation (bonds, bridges, VLANs) routes, and DNS configuration. Both IPv4 and IPv6 are supported, including **dual-stack** (an interface with both IPv4 and IPv6 subnets) and **IPv6-only** (an interface with only an IPv6 subnet) configurations.
**Notes:** 1) Default Gateway: Only one default IPv4 gateway is used. If specified more than once, only the last occurrence is considered valid.
2) Management Interface: The interface with the default gateway set, will be used as management interface. To override this, use Clish commands.
3) IPv6 Default Gateway: The same rule that applies to IPv4 default gateways also applies to IPv6. Only one default IPv6 gateway is used. If more than one default IPv6 gateway is present in the configuration, the system uses the last one. A gateway value of `0::0` means "no default gateway".
**Config Schema:** **network:** (object)
|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **version** (integer - 1) | Must be set to 1. |
| **config** (object) | Within the network config portion, users include a list of configuration types. The current list of support type values is as follows: physical, bond, bridge, VLAN, nameserver \& route. |
| **gateway** (string - ipv4) | IPv4 address of the default gateway (for example, 10.0.0.1). Note: Can only set one default gateway. First is caught, and this interface is set as a management interface. |
| **dns_nameservers** (string array - ipv4) | List of IPv4 address of nameservers. Maximum 3 items. |
| **routes** (object array) | Specifies a list of routes for a given interface. This is a `route` object. |
| **ipv6_enabled** (bool) | Optional. Enables the IPv6 stack on the system, even when no static IPv6 subnet is configured. Use this field when IPv6 addressing is provided by DHCPv6 or another automatic IPv6 configuration mechanism. |
|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---|
| Object Type | Schema |
| physical | **name** (string) Name of the desired device (for example, eth0). |
| physical | **mac_address** (string - `mac address`) Optional parameter, overrides the device MAC address (for example, 00:11:22:33:44:55:66). |
| physical | **mtu** (integer - `[68-16000]`) Optional parameter, overrides the device MTU (for example, 9000). |
| physical | **rx_ringsize** (integer - `[0-4096]`) Optional parameter, overrides device rx ring size. Maximum and minimum values can change depending on the machine hardware and specification. |
| physical | **tx_ringsize** (integer - `[0-4096]`)Optional parameter, overrides device tx ring size. Maximum and minimum values can change depending on the machine hardware and specification. |
| physical | **comments** (string)Optional parameter, sets the free text comment. The text must be up to 100 characters. |
| physical | **auto-negotiation** (boolean) Optional parameter, configures automatic negotiation of interface link speed and duplex settings. True - Enabled, False- Disabled. |
| physical | **subnets** (object array) Optional parameter, specifies IP configuration for this interface. Multiple subnet entries will create interface alias allowing a single interface to use different IP configurations. |
| bond | **name** (string) Name of the desired device (for example, bond0). |
| bond | **mac_address** (string - `mac address`) Optional parameter, overrides the device MAC address (for example, 00:11:22:33:44:55:66). |
| bond | **mtu** (integer - `[68-16000]`) Optional parameter, overrides the device MTU (for example, 9000). |
| bond | **bond_interfaces** (string array) Optional parameter, a list of device names to bond. |
| bond | **params** (dictionary array) The params key in a bond holds a dictionary of bonding parameters. This dictionary may be empty. **mode** enum - `round-robin`/`active-backup`/`xor`/`8023AD` **min_links** integer - `[0-8]` **miimon** integer - `[1-1500]` **updelay** integer - `[0-5000]` **downdelay** integer - `[0-5000]` **lacp_rate** enum - `slow`/`fast` **xmit_hash_policy** enum - `layer2`/`layer3+4` |
| bond | **subnets** (object array) Optional parameter, specifies IP configuration for this interface. Multiple subnet entries will create interface alias allowing a single interface to use different IP configurations. |
| bridge | **name** (string) Name of the desired device (for example, br0). |
| bridge | **mtu** (integer - `[68-16000]`) Optional parameter, overrides the device MTU (for example, 9000). |
| bridge | **bridge_interfaces** (string array) Optional parameter, a list of device names to bridge. |
| bridge | **rx_ringsize** (integer - `[0-4096]`)Optional parameter, overrides device rx ring size. Maximum and minimum values can change depending on the machine hardware and specification. |
| bridge | **tx_ringsize** (integer - `[0-4096]`)Optional parameter, overrides device tx ring size. Maximum and minimum values can change depending on the machine hardware and specification. |
| bridge | **comments** (string) Optional parameter, sets free text comment. The text must be up to 100 characters. |
| bridge | **subnets** (object array) Optional parameter, specifies IP configuration for this interface. Multiple subnet entries will create interface alias allowing a single interface to use different IP configurations. |
| vlan | **name** (string) Name of the desired device (for example, eth0.1000). |
| vlan | **mtu** (integer - `[68-16000]`) Optional parameter, overrides the device MTU (for example, 9000). |
| vlan | **vlan_link** (string) Specifies the underlying link via its `name` (for example, eth0). |
| vlan | **vlan_id** (integer - `[2-4094]`) Specifies the VLAN numeric id (for example, 1000). |
| vlan | **subnets** (object array) Optional parameter, specifies IP configuration for this interface. Multiple subnet entries will create interface alias allowing a single interface to use different IP configurations. |
| nameserver | **address** (string array - ipv4) List of IPv4 address of nameservers. Maximum 3 items. |
| nameserver | **search** (string array) List of hostnames to include in the search path (domain name). Maximum 1 item. |
| route | **destination** (string - ipv4) IPv4 address of the destination network (for example, 10.0.0.0). |
| route | **netmask** (string - ipv4) IPv4 mask of the destination network (for example, 255.255.255.0). |
| route | **gateway** (string - ipv4) IPv4 address of the gateway (for example, 10.0.0.1). |
| subnet | **type** (enum - `static`) Address allocation type. Currently, only `static` is supported. |
| subnet | **address** (string - ipv4 with mask length) IPv4 address - can be in plain form (for example, 10.0.0.1, with a separate netmask field) or CIDR (for example, 10.0.0.1/24) |
| subnet | **netmask** (string - ipv4) IPv4 netmask (for example, 255.255.255.0). Not used for IPv6 |
| subnet | **gateway** (string - ipv4 **or** ipv6) Default gateway for this subnet (for example, 10.0.0.1 for IPv4 or 2001:db8::1 for IPv6). Only one default gateway per address family is honored. |
| subnet | **dns_search** (string array) List of hostnames to include in the search path (domain name). Maximum 1 item. |
| subnet (IPv6) | **type** (enum - `static`) Address allocation type. Currently, only `static` is supported. |
| subnet (IPv6) | **address** (string - ipv6 address with mask length) IPv6 address with prefix length in CIDR notation. The prefix length is part of the address string (for example, `2001:db8::10/64`). | |
| subnet (IPv6) | **gateway** (string - ipv6) Optional. IPv6 default gateway address (for example, `2001:db8::1`). | |
`Example - IPv4:`
`network:`
` version: 1`
` config:`
` - id: eth0`
` type: physical`
` name: eth0`
` subnets:`
` - type: static`
` address: 192.168.1.1/24`
` gateway: 192.168.1.254`
`Example - Dual-stack (IPv4 + IPv6):`
`network:`
` version: 1`
` config:`
` - type: physical`
` name: eth0`
` subnets:`
` - type: static`
` address: 192.168.1.10`
` netmask: 255.255.255.0`
` gateway: 192.168.1.254`
` - type: static`
` address: 2001:db8::10/64`
` gateway: 2001:db8::1`
`Example - IPv6-only:`
`network:`
` version: 1`
` config:`
` - type: physical`
` name: eth0`
` subnets:`
` - type: static`
` address: 2001:db8::10/64`
` gateway: 2001:db8::1`
Back to Top
*** ** * ** ***
timezone {#timezone}
--------------------
**Summary:**
This setting lets you set the time zone on the machine.
**Notes:**
The timezone string identifier is based on the time zone database.
**Config Schema: timezone:** (string)
**Example:**
`timezone: "America/Puerto_Rico"`
Back to Top
*** ** * ** ***
Examples for Cloud-Init YAML
----------------------------
### Security Gateway R81.20 and higher: {#gateway_example}
`#cloud-config`
`hostname: MyHostName`
`ssh_authorized_keys:`
` - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdaQwGNgsYXcRTi3JelfJ9pdJtm4Olbn9q7ohdzjnRW john@goodcorp.com`
`clish:`
` - set user admin shell /bin/bash`
`blink_config:`
` admin_password_regular: MyRegularPassword`
` maintenance_password_regular: MyRegularMaintenancePassword`
` mgmt_admin_radio: gaia_admin`
` download_info: true`
` upload_info: true`
` upload_crash_data: true`
` ftw_sic_key: mysickey`
`network:`
` version: 1`
` config: `
` - type: physical`
` name: eth0`
` mtu: 1500`
` subnets:`
` - type: static`
` address: 192.168.1.10`
` netmask: 255.255.255.0`
` gateway: 192.168.0.1`
` dns_nameservers: [8.8.8.8, 8.8.4.4]`
` routes:`
` - destination: 192.168.11.0`
` netmask: 255.255.255.0`
` gateway: 192.168.1.11`
` - type: physical`
` name: eth1`
` mtu: 1500`
` subnets:`
` - type: static`
` address: 192.168.2.10`
` netmask: 255.255.255.0`
` gateway: 192.168.2.1`
` - type: route`
` destination: 192.168.12.0`
` netmask: 255.255.255.0`
` gateway: 192.168.2.11`
**Note:** In R81.20 and higher, either the parameter `maintenance_hash` or `maintenance_password_regular` must be provided to `blink_config`.
Back to Top
*** ** * ** ***
### Security Management (R81.10 and previous versions): {#management_example}
`#cloud-config`
`hostname: MyHostName`
`ssh_authorized_keys:`
` - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOdaQwGNgsYXcRTi3JelfJ9pdJtm4Olbn9q7ohdzjnRW john@goodcorp.com`
`clish:`
` - set syslog cplogs on`
` - set syslog mgmtauditlogs`
`config_system:`
` domainname: MyDomain.com`
` timezone: America/Indiana/Indianapolis`
` ftw_sic_key: MySicKey`
` install_security_managment: true`
` mgmt_gui_clients_radio: any`
` mgmt_admin_radio: new_admin`
` mgmt_admin_name: NewAdmin`
` mgmt_admin_passwd: MyAdminPassword`
` download_info: true`
` upload_info: true`
` upload_crash_data: true`
`network:`
` version: 1`
` config: `
` - type: physical`
` name: eth0`
` mtu: 1500`
` subnets:`
` - type: static`
` address: 192.168.1.10`
` netmask: 255.255.255.0`
` gateway: 192.168.0.1`
` dns_nameservers: [8.8.8.8, 8.8.4.4]`
` routes:`
` - destination: 192.168.11.0`
` netmask: 255.255.255.0`
` gateway: 192.168.1.11`
` - type: physical`
` name: eth1`
` mtu: 1500`
` subnets:`
` - type: static`
` address: 192.168.2.10`
` netmask: 255.255.255.0`
` gateway: 192.168.2.1`
` - type: route`
` destination: 192.168.12.0`
` netmask: 255.255.255.0`
` gateway: 192.168.2.11`
**Note:** **In R81.20 and highe** r, the parameter `maintenance_hash` is **mandatory** for config_system.
Back to Top
*** ** * ** ***
**Note:** For information about Check Point Cloud Firewall automation for KVM-based platforms in versions R81.10 and lower, refer to [sk165476](https://support.checkpoint.com/results/sk/sk165476).
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content