topic management interface of gateway in different subnets? in Firewall and Security Management

management interface of gateway in different subnets?

Vincent_Bacher — Tue, 14 Jul 2020 14:30:25 GMT

Hi mates,

customer plans to deploy a CP cluster at two different sites, where all vlans are same but management interface, they are planned to be in different subets. They are asking if this would work.
This topology view of a demo session shows what i would do

Questions:

does that really work?
is this a supported setup?

Did not find anything int the kb or here.
Anyone configured this already in the past and can tell? Or any sk appreciated as well.

Cheers
Vincent

Re: management interface of gateway in different subnets?

HeikoAnkenbrand — Tue, 14 Jul 2020 15:15:52 GMT

In a ClusterXL all cluster interfaces with a VIP must be in the same L2 subnet. Why should the management interface be deployed in different L2 and L3 networks? That doesn't make any sense.

In theory, it should work. In Azure and AWS the management interface also have different L3 IP addresses / networks. The question is, is this supported.

Re: management interface of gateway in different subnets?

PhoneBoy — Tue, 14 Jul 2020 15:40:01 GMT

The management interface doesn't have a shared IP and isn't relevant as far as clustering goes, provided you mark the interface as private.
R80.40 allows for clusters where the members are in different subnets entirely (even the "clustered" interfaces) but there is no shared IP in this situation.