topic Re: Clustering Information in Firewall and Security Management

Clustering Information

Karan0587 — Tue, 16 Feb 2021 00:20:13 GMT

Hi,

I information for clustering of the checkpoint in the below scenario

2 separate internet tails coming into 2 Checkpoint firewalls.

I am reading through the Cluserting XL document and it says it should be in the same network for extern Interfaces as well, but in the above scenario what is the best solution?

Re: Clustering Information

PhoneBoy — Tue, 16 Feb 2021 05:41:48 GMT

A better question might be: what is your precise goal.
If each firewall is connected to a separate Internet connection, then a cluster is probably the wrong solution.
Also, you probably have different IP space with each ISP, making “transparent” failover while maintaining active connections not really possible.

A network diagram could be useful.

Re: Clustering Information

Karan0587 — Tue, 16 Feb 2021 06:08:42 GMT

Thanks for the reply.

Basically, we are migrating customer from the existing network to Checkpoint Solution.

Currently they have 2 separate Internet tails coming in to 2 separate routers(connected through vrrp), we are basically in planning phase.

So as per your comment we cannot have clustering when WAN IP is in different segment ( from diff providers) ?

I am new to checkpoint so if there is any stupid question feel free to correct me

Re: Clustering Information

Chris_Atkinson — Tue, 16 Feb 2021 09:38:51 GMT

If the firewalls will be located downstream from the VRRP routers I don't see an issue, it's a given that you'll need a switch for the plumbing of the cluster here which shouldn't be unexpected.