topic Re: Can you have a cluster, but 1 of them with a lacp bundle to the LAN in Firewall and Security Management

Can you have a cluster, but 1 of them with a lacp bundle to the LAN

carl_t — Mon, 25 Jan 2021 08:51:03 GMT

Hi All,

Is it possible to have a checkpoint firewall cluster, but on one of them have 2 ports connected to the LAN running LACP and the other firewall 2 would have a single interface not running LACP?

Cheers

Re: Can you have a cluster, but 1 of them with a lacp bundle to the LAN

G_W_Albrecht — Mon, 25 Jan 2021 10:40:44 GMT

According to the R80.40 ClusterXL Admin Guide this is not supported: All Cluster Members must run on identically configured hardware platforms.

Re: Can you have a cluster, but 1 of them with a lacp bundle to the LAN

Chris_Atkinson — Mon, 25 Jan 2021 15:24:17 GMT

Out of interest why can't you run LACP at one of the sites?

It should be possible to form a bond even to a single switch.

Re: Can you have a cluster, but 1 of them with a lacp bundle to the LAN

carl_t — Mon, 25 Jan 2021 16:19:23 GMT

We can, It just means an outage window thats all.

Cheers

Re: Can you have a cluster, but 1 of them with a lacp bundle to the LAN

Bob_Zimmerman — Mon, 25 Jan 2021 19:19:15 GMT

Absolutely. There are a few ways to do this.

You can add the interface as non-clustered. This probably isn't what you want to do, but I mention it because it is possible. Cluster members can have "non-monitored private" interfaces which are unique to the member.

You can also make a clustered interface as long as both firewalls see it as a bond. Bonds can be composed of a single interface, and the member with only one interface in the bond can do "round robin" with a single bonded interface. That will cause it to do no special negotiation on the interface (specifically, no LACP), it will just send traffic out directly. I deploy some of my firewalls' interfaces as single-member bonds simply because it makes it so easy to rearrange the traffic on the physical interfaces.

If you are particularly unaverse to risk, you can also run a cluster interface with differently-named interfaces on the different members (bond0 on one member, eth7 on the other). This is allowed by the UI and should work, but I guarantee it hasn't been tested to the degree I would feel even remotely comfortable using in production.