topic Re: Cluster with two subnets on single vlan in Cloud Firewall

Cluster with two subnets on single vlan

Strongiukas — Wed, 24 May 2023 07:25:15 GMT

Hello,

I'm not sure how I should cope with this problem.

Now we have couple of subnets on the same vlan. Lets say 192.168.1.0/24 and 192.168.2.0/24. I need to create Cluster of two members.

I'm thinking of doing next:

1. Create Allias IPs on that interface (GW1:192.168.1.1 GW1:192.168.2.1 and GW2:192.168.1.2 GW2:192.168.2.2) on web console,

2. Create new interfaces via smart console with network type: Cluster.

3. Create virtual IPs as 192.168.1.254 and 192.168.2.254

4. Add cluster members as GW1:192.168.1.1 GW2:192.168.1.2 and GW1:192.168.2.1 GW2:192.168.2.2

5. Set topology to Internal and disable Anti-Spoofing.

Will it work or I should do something else?

P.S. I know that is bad to have two or more subnets on same vlan, but I need to stay on same logic as it was before.

Re: Cluster with two subnets on single vlan

the_rock — Wed, 24 May 2023 13:10:44 GMT

I really hope below will be useful.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ClusterXL_AdminGuide/Content/Topics-CXLG/Cluster-IP-addresses-on-different-subnets.htm?tocpath=Advanced%20Features%20and%20Procedures%7CCluster%20IP%20Addresses%20on%20Different%20Subnets%7C_____0

https://community.checkpoint.com/t5/Security-Gateways/ClusterXL-Different-Subnet-Configuration/td-p/8020

https://community.checkpoint.com/t5/General-Topics/Configuring-Cluster-Addresses-on-Different-Subnets/td-p/29555

Re: Cluster with two subnets on single vlan

Chris_Atkinson — Wed, 24 May 2023 15:43:46 GMT

Use of aliases with ClusterXL is not supported per sk89980 / sk31821

Re: Cluster with two subnets on single vlan

the_rock — Wed, 24 May 2023 13:20:43 GMT

Thanks for pointing that out Chris 👍

Re: Cluster with two subnets on single vlan

Strongiukas — Wed, 24 May 2023 13:34:42 GMT

Hi, thanks for pointing out. But maybe you have any suggestions then?

It is not possible to separate those subnet through vlan's, because of lack of managed switches.

Maybe it is possible to move those aliases to different interfaces and then connect everything to one switch?

Re: Cluster with two subnets on single vlan

the_rock — Wed, 24 May 2023 13:40:44 GMT

That might be a bit tricky, since sk clearly states its not supported...maybe you can get an official response from TAC about it.

Andy

Re: Cluster with two subnets on single vlan

PhoneBoy — Wed, 24 May 2023 22:00:26 GMT

Interface aliases are not supported with clustering.
The only other way to do this is with physical interfaces connected to the same switch.
I haven't heard of any issues with doing this, but that doesn't mean there won't be.