topic New option on cloud deployments for "Use Geo Mode in a Cloud" when on R81.20 in Cloud Firewall

New option on cloud deployments for "Use Geo Mode in a Cloud" when on R81.20

thomascripps — Fri, 19 Apr 2024 09:31:42 GMT

I have noticed on the cloud deployment guides for a HA deployment that it's now recommended to Use Geo Mode in a Cloud when on R81.20. Does anyone know what this option does at all?

Re: New option on cloud deployments for "Use Geo Mode in a Cloud" when on R81.20

Roman_Kats — Sun, 21 Apr 2024 12:31:20 GMT

Hi @thomascripps
This option aimed for cluster members that are located in different networks (subnets). Enabling Geo Mode allows configuring cluster network topology for members in different networks.
Particular use case is CloudGuard for AWS Cross Availability Zone Cluster. Each cluster member located in different availability zone hence in different subnets.
https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_for_AWS_Cross_AZ_Cluster/Content/Topics-AWS-CrossAZ-Cluster-DG/Getting_Started_with_CloudGuard_Network_for_AWS.htm

Re: New option on cloud deployments for "Use Geo Mode in a Cloud" when on R81.20

almogar — Sun, 21 Apr 2024 14:51:01 GMT

Hi there,
Check Point clusters typically need sync interfaces on the same subnet - 0 hops between them. But in Cloud Clusters, spreading members across availability zones increases availability as availability zones are designed to self-contain availability issues.
Geo Mode allow CloudGuard Public Cloud Clusters to support topologies where the sync interfaces are not on the same subnet, overcoming the limitations imposed by cloud providers.
In addition, it automatically config IPSec VPN setup.