topic Re: clusterxl with 1 public ip in Firewall and Security Management

clusterxl with 1 public ip

lior_me1 — Wed, 27 Mar 2019 10:21:08 GMT

i'm settings up a cluster for an internet connection with 1 public ip

so how should i set the cluster members in terms of routing?

how can i get them to go out to the internet?

Re: clusterxl with 1 public ip

G_W_Albrecht — Wed, 27 Mar 2019 12:09:25 GMT

I first would suggest a good read: R80.20 ClusterXL Administration Guide and later to use the 1 public IP for Cluster Virtual IP address.

Re: clusterxl with 1 public ip

Chinmaya_Naik — Wed, 27 Mar 2019 12:14:10 GMT

Refer sk32073 (Configuring Cluster Addresses on Different Subnets)

@Chinmaya

Re: clusterxl with 1 public ip

Terry — Wed, 27 Mar 2019 14:21:15 GMT

I agree with the others. Read up on clusterXL. It is a component of the firewalls but has little to do with the routing. I would consider them separate. Also, are you connecting this directly to your router or core switch? You will probably need to utilize trunking.

A lot of different ways to set it up.

Re: clusterxl with 1 public ip

Jerry — Wed, 27 Mar 2019 16:29:35 GMT

if your ClusterXL devices uses internet directly and your public IPs are on the External side of the Cluster you need at least 3 IPs.
One won't work as you need PRI/SEC and if using VMAC - VIP IP address that makes you actually having at least /29 subnet from your IPS. Period.

Re: clusterxl with 1 public ip

AlekseiShelepov — Wed, 27 Mar 2019 17:10:20 GMT

@Jerry, but that is not true. As mentioned previously, explanation on how to configure one public IP address for VIP and local addresses for each gateway provided in sk32073: Configuring Cluster Addresses on Different Subnets

One limitation here is when you need to manage a remote location and you have only 1 public IP, which is mentioned in the SK:

It is not possible to manage over the Internet the Cluster when IP addresses Addresses of its members and the VIP address are configured on different subnets.

But if you have the management server somewhere behind the inside interface of that cluster, it will work.

Re: clusterxl with 1 public ip

Jerry — Wed, 27 Mar 2019 17:23:08 GMT

@AleksiShalepov

fair enough my apologize, I have never seen ClusterXL with single Public IP on the External side. Sorry. I was always under an impression that this is not possible. Will get through this soon and revise what I know about it. Again my sincere SORRY.

Re: clusterxl with 1 public ip

lior_me1 — Thu, 28 Mar 2019 08:15:29 GMT

can you point me to the reference? i can't find it

Re: clusterxl with 1 public ip

lior_me1 — Thu, 28 Mar 2019 08:18:18 GMT

is my case "different subnets?"
i have 1 public ip from the isp, and of course 1 gateway ip from the isp

so how should i set the cluster topology? i actually need to get the "world" to think that the ip that's trying to communicate with it is always the same public ip from the isp, even if a failover occurs

Re: clusterxl with 1 public ip

lior_me1 — Mon, 01 Apr 2019 05:47:57 GMT

require advanced access, i dont have it 😞

Re: clusterxl with 1 public ip

PhoneBoy — Mon, 01 Apr 2019 12:25:58 GMT

It's described in the R80.20 ClusterXL Admin Guide in a section called Cluster IP Addresses on Different Subnets.
No Advanced Access required.

Re: clusterxl with 1 public ip

Jeroen_Demets — Tue, 07 Jan 2020 14:11:21 GMT

will that work with gaia embedded devices such as 1400 appliances?

Re: clusterxl with 1 public ip

PhoneBoy — Tue, 07 Jan 2020 20:21:31 GMT

From reading the SK, I don't believe this applies to the 1400 series.