T Techclick ← All lessons
Check Point · Quantum R81.20 / R82 · Lesson 2 of 17

Gaia first day: the OS under the blades

The ISO is on the VM. You have a console password. Before SmartConsole, before SIC, Gaia must have interfaces, a default route, DNS, and a backup. This lesson is only that first day — clish vs expert, and the five commands that stop “gateway unreachable.”

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

The ticket

New lab VM cp-gw-01. You can console in. SmartConsole on the admin laptop cannot see 10.10.10.2. SIC was never the problem — there is no route and eth1 is still off.

Quick interview answer

Gaia is the operating system. Blades (Firewall, IPS, VPN) run on top. First day is interfaces, routes, DNS, NTP, backup — then SIC. Do not initialize SIC on a box that cannot ping the SMS.

Hero · first console
First-day Gaia console with interface and route
If the OS cannot ping 10.10.10.5, SmartConsole will never finish SIC.
Lab data · dummy only

SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.

What Gaia is

Gaia is Check Point’s OS (Linux-based). You meet it as:

First boot wizard (or set commands) asks hostname, password, management interface, and often whether this box is Security Gateway, Management, or Standalone.

clish vs expert vs Portal

ToolUse forDo not use for
clishIP, route, DNS, NTP, user, backupPacket capture of INSPECT
Gaia PortalSame as clish if you prefer GUISIC reset (use cpconfig / cp_conf)
expertfw monitor, tcpdump, cpwd_adminifconfig as the source of truth
https://10.10.10.2:443
Training mock · not live
Gateways & ServersSecurity PoliciesLogs & MonitorManage & Settings
Network Management → Network Interfaces

Physical interface eth1

eth1
10.10.10.2 / 24
Mgmt + cluster member
Up
Gaia Administration Guide — Network Management → Network Interfaces. Training mock.

First-day runbook

  1. Side A — console

    Set password. Enter clish (default). Hostname cp-gw-01.

  2. Side B — network

    Mgmt/cluster IP, external IP, default route to the upstream router, DNS, NTP.

  3. Side C — prove + backup

    Ping SMS and default gateway. Gaia backup to SCP/TFTP or local. Then — and only then — SIC.

clish · dummy first day
set hostname cp-gw-01
set interface eth1 ipv4-address 10.10.10.2 mask-length 24
set interface eth1 state on
set interface eth0 ipv4-address 203.0.113.25 mask-length 24
set interface eth0 state on
set static-route default nexthop gateway address 203.0.113.1 on
set dns primary 10.20.30.10
set ntp server primary in.pool.ntp.org
save config

show interface eth1
show route
ping 10.10.10.5
add backup local

Exact set interface / set static-route verbs live in the Gaia Admin Guide for your train (R81 / R81.20 / R82). Syntax is stable; always save config.

Four first-day failures

1 · Interface on, no route

You can ping the connected LAN. SMS on another subnet fails. show route has no default.

2 · Expert ifconfig, forgot save

Reboot and IPs vanish. clish + save config is the contract.

3 · DNS missing, SIC hostname fails later

Objects use names. First day without DNS looks fine until Identity Awareness and updates break.

4 · SIC before backup

Wrong activation key, you reset SIC twice, then you have no known-good Gaia snapshot.

How to prove it

Close first day only when

1) show interface matches the design. 2) Default route present. 3) Ping SMS and 203.0.113.1. 4) Gaia Portal opens on 10.10.10.2. 5) Local backup exists. 6) Then go to the SIC lesson.

Traps

SymptomLikely causeFirst proofWrong fix
Cannot ping SMSNo default / wrong maskshow routeReset SIC
IPs gone after rebootNo save configCompare clish vs expertReinstall ISO
Portal timeoutMgmt on wrong NIC / anti-spoof laterBrowse to the Mgmt IP from the same VLANDisable firewall blade

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

What is Gaia?

Correct: b. Concept section.
Q2

Where should you set the default route on first day?

Correct: b. Runbook Side B.
Q3

You can ping 10.20.30.41 but not 10.10.10.5 on another subnet. First check?

Correct: b. Failure 1.
Q4

Why not initialize SIC before a Gaia backup?

Correct: b. Failure 4.
Q5

expert mode is for…

Correct: a. clish vs expert table.
Q6

Which command persists clish network changes?

Correct: b. Gaia Admin Guide.

Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview

Sources

Related: Check Point evidence desk · session factory · next lesson in the series above.