topic Re: update aws route table issue with AWS Cluster deployment in Cloud Firewall

update aws route table issue with AWS Cluster deployment

Bill_wang — Tue, 21 Apr 2020 04:37:18 GMT

Hi Body

I deployed two GW with cluster mode in the aws...the server subnet's default geteway point to active gw eni.

my question is "if the swirtchover happened, how to automatically replace server subnet's nexthop to new active member eni ??? "

i don't find like this script ....

Re: update aws route table issue with AWS Cluster deployment

PhoneBoy — Tue, 21 Apr 2020 18:16:42 GMT

Did you follow the instructions here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104418

Re: update aws route table issue with AWS Cluster deployment

Bill_wang — Wed, 22 Apr 2020 01:47:03 GMT

Hi PhoneBoy
thank your reply...i not find any helpful information from this sk about update route table....
now, HA work is fine, and the failover has no any problem. only the route table of server's subnet have not been replace to new active eni....

Re: update aws route table issue with AWS Cluster deployment

PhoneBoy — Wed, 22 Apr 2020 02:34:05 GMT

If you set up the cluster per the SK, then this should happen automatically, as the SK states.
If it's not, then use the troubleshooting steps provided in the same SK. to help understand why.

Re: update aws route table issue with AWS Cluster deployment

Bill_wang — Wed, 22 Apr 2020 02:42:05 GMT

my environment have a little different with sk....server's subnet and gw internal subnet is same one in the sk.
and then , server's sbunet is a another subent in my environment.
like gw internal subnet is 10.1.1.0/24....server subnet is 10.1.2.0/24...

Re: update aws route table issue with AWS Cluster deployment

Bill_wang — Sun, 28 Jun 2020 02:57:23 GMT

anybody have any idear ?

Re: update aws route table issue with AWS Cluster deployment

nullform — Sun, 28 Jun 2020 22:25:19 GMT

Can you explain your topology, the layout and what have you done that's not according to the deployment guide.

Re: update aws route table issue with AWS Cluster deployment

Kurt_Abela — Fri, 11 Jun 2021 06:48:05 GMT

Hi,

was this ever solved? We have a similar setup and we are struggling to find a way to change routes/interfaces on subnets not created directly by Checkpoint

Re: update aws route table issue with AWS Cluster deployment

Roman_Kats — Sun, 13 Jun 2021 06:09:31 GMT

Hi Kurt
Can you please share your topology and how exactly have you created cluster?
Thanks,
Roman

Re: update aws route table issue with AWS Cluster deployment

Nir_Shamir — Sun, 13 Jun 2021 06:12:51 GMT

Hi,

The deployment is based on the fact that the Cluster is installed in its own VPC with no other servers.

so any other Spoke VPCs should be Peered to it with Regular Peering or TGW etc.

The Server VPC routing should take him to the Cluster VPC and there it will have a route directed to the Cluster Active member ENI.

Re: update aws route table issue with AWS Cluster deployment

Kurt_Abela — Sun, 13 Jun 2021 07:31:25 GMT

Hi,

This is an existing AWS setup and customer asked us to fit in a Checkpoint Cluster (same AZ). The problem is that they have existing servers directly on the current existing gateway backend interface, as well as a number of Transit Gateways and other pre-existing route tables.

When we deploy a cluster in the existing VPC, the cluster can only change the route tables it created during the deployment. My question is if we can force the new cluster to modify the existing route tables.

I know this is the recommended design from CP, but this is an existing customer topology and they want to deploy CP cluster in the Same VPC.

Thanks,

Kurt

Re: update aws route table issue with AWS Cluster deployment

Nir_Shamir — Sun, 13 Jun 2021 09:34:13 GMT

As I remember and tested again , you can associate any Route table to the Cluster's internal Subnet , or other Subnets in That VPC , add routes to the currently ACTIVE member's ENI and that's it.

the failover changes the routes to the ACTIVE member's ENI