topic Change the VSX internal communication network in Firewall and Security Management

Change the VSX internal communication network

Mattia_Varone — Sat, 16 Mar 2019 14:27:38 GMT

Hi guys,

I have to setup 4 VSX cluster in HA mode, and I would like to modify the internal dedicated communication network for each one VSX cluster. The default network is 192.168.196.0/255.255.252.0, and is a very large subnet. Could be ok dedicate a /26 network for each cluster, or is it advisable configure networks with the same dimensions of the default internal communication network?

Thanks in advance.
Mattia

Re: Change the VSX internal communication network

PhoneBoy — Sun, 17 Mar 2019 02:24:27 GMT

Refer to Changing the VSX Cluster Internal Communication Network.

Re: Change the VSX internal communication network

PhoneBoy — Sun, 17 Mar 2019 15:46:23 GMT

Kinda misread the question 😬

I think you probably want to keep the network size the same. Since it should be only routable within a given cluster, this begs the question why you want to make it unique on each cluster.

Re: Change the VSX internal communication network

Wolfgang — Sun, 17 Mar 2019 19:49:52 GMT

You can change it only to a larger subnet mask.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk99121 sk99121 described this a little bit more.

Re: Change the VSX internal communication network

Mattia_Varone — Tue, 19 Mar 2019 10:39:39 GMT

Hi,

thanks for your suggestion, so is better reserve a network at least a /22 mask.

Regards

Mattia

Re: Change the VSX internal communication network

Mattia_Varone — Wed, 20 Mar 2019 09:08:27 GMT

Hi,

customer has the subnet 192.168.196.0/22 in his network, and I prefere to change from the defaul network to a new one. But following this discussion I'm going to choice a new /22 subnet, that I'll configure on all my VSX cluster, and not a dedicated subnet to each one VSX cluster.

Thanks for the suggestion

Mattia