topic Re: Shutting Down Checkpoint ClusterXL in Firewall and Security Management

Shutting Down Checkpoint ClusterXL

jwmac — Fri, 20 Apr 2018 14:59:29 GMT

I have a couple of simple questions regarding the shut down procedure for a checkpoint cluster. I have a 2 node Cluster running in HA new mode (not legacy) in active/standby non bridge mode.

1. If I need to move the hardware or rerack, etc, and need to completely power off the gateways/cluster. What is the proper process to gracefully shutdown all nodes in a cluster?

2. If I am moving the internal interfaces to a new core switch on both checkpoint gateways in the cluster and thereby need to physically disconnect all interfaces on both gateways at the same time, what is the proper way to do this without causing an unwanted failover? Should I completely power off the gateways or just shutdown the cluster software via some method? Something else? How would I do this?

Thanks

Re: Shutting Down Checkpoint ClusterXL

PhoneBoy — Fri, 20 Apr 2018 17:24:12 GMT

For temporarily shutting down individual nodes of a cluster, there is no special procedure.

Make sure the unit is halted using the "halt" command on the CLI or similar using the Gaia WebUI.

I'm curious why you think you need to disconnect ALL interfaces rather than, say, the ones you're changing.

Also, how long will it take to physically swap the cables?

That will probably determine the best approach to take.

Re: Shutting Down Checkpoint ClusterXL

jwmac — Fri, 20 Apr 2018 22:09:24 GMT

I have both nodes connected via 802.3ad LAG to the core switches that will be replaced. These bonds are what handle all internal traffic. What I mean by ALL interfaces is I will be disconnecting these bonded interfaces which connect to the core. It will probably take at least a minute to move the interfaces to the new core switches.

I don't want to cause an inadvertent failover when I move the interfaces on the Master gateway which is why I ask question 2. Ideally I would like to temporarily stop/disable the cluster to prevent a failover from happening when moving the interfaces on the master, not sure how to do this. Should I halt the standby node? Would cphastop work and then run cphastart after moving interfaces? I want to make sure I have the safest procedure..

Re: Shutting Down Checkpoint ClusterXL

PhoneBoy — Sat, 21 Apr 2018 04:24:49 GMT

If you check out the ClusterXL Admin guide, it suggests that cphastop should only be run by cpstop.

As such, a cpstop would probably be safer as it stops all related processes/sync and a bit quicker than a reboot.

After you've swapped the cables, you can do a cpstart.

Re: Shutting Down Checkpoint ClusterXL

Victor_MR — Sat, 21 Apr 2018 08:50:58 GMT

I'm also curious about this:

...need to physically disconnect all interfaces on both gateways at the same time, what is the proper way to do this without causing an unwanted failover?

I see you're worried about preventing fail-overs in the cluster. However, if you're going to shutdown all the members, and also to disconnect the interfaces from both at the same time, why worring about fail-overs? I just want to be sure I'm understanding the situation 🙂