topic Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov in Firewall and Security Management

Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are moved?

kanishkaw — Sat, 01 May 2021 10:58:05 GMT

We have Cloudguard R80.10 gws [48 of them] running on a VMWARE NSX-V Cluster 's hosts.

These Cloud guard gws are managed by R80.40 manager.

When VMs are moved between hosts in the VMWARE cluster, all connections drop, and we were of the understanding that all individual Cloudguard gateways are in sync, so that when VMs are moved, traffic will flow without drops [ie... without seeing First packet is no syn].

When I looked at fw tab -t connections -s in individual gateways, I can see the numbers are very different, meaning, Cloud guard gateways are not in sync so it is obvious that when VMs move between hosts in the VMWARE cluster, Is there any fix or workaround that we can apply? This must be a common issue for many out there.

I dont see there is any mechanism that runs among these Cloud guard gateways to do tcp/ udp state synchronisation like Cluster XL, so I can guess the answer. I am bit confused because at the time of selling the product, we questioned the same feature and the answer was it does keep "in sync" the statetable among Cloud gurads, not sure whether we tried that indeed in a lab and took the word on its own merit.

So your expert reply is very much appreciated with any tips and tricks.

Thank you and Kind regards,

Kanishka

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

_Val_ — Mon, 03 May 2021 11:21:24 GMT

Did you configure your group of CloudGuard gateways as a cluster object (CloudGuard NSX Admin Guide, page 34 and below)?

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

kanishkaw — Mon, 03 May 2021 11:34:26 GMT

Thank you _Val_.

Please see below. Yes we have a cluster defined and the same policy is applied to all members.

How do I verify state sync is happening and all the members have the same tcp state info, (and udp state info as well if applicable for udp).

Appreciate your reply with thanks.

Kanishka

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

_Val_ — Mon, 03 May 2021 12:02:45 GMT

cphaprob stat on any of the cluster members should show you the cluster status.

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

kanishkaw — Mon, 03 May 2021 17:25:27 GMT

Hi _Val_

It says "HA module not started". What steps can I take to enable HA among members?

Thank you

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

_Val_ — Tue, 04 May 2021 06:14:14 GMT

"cpconfig", look for clusterxl settings. Also, policy push is required again.

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

kanishkaw — Tue, 04 May 2021 07:45:05 GMT

Thank you _Val_.

Did you mean this option (as attached) in the Cloudguard R80.10 gateway?

Is this service impacting to enable it? Do I want a maintenance window?

Many Thanks

Kanishka

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

_Val_ — Tue, 04 May 2021 07:59:59 GMT

yes and yes

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

_Val_ — Tue, 04 May 2021 08:02:20 GMT

Also, the cluster object itself should have dedicated sync network. Considering the nature of your question, I would advise looking for professional services engagement with Check Point or a third party having some experience in this kind of deployment.

If not, build a lab environment, study the guide and make it work in the lab first, to build up expertise.

Re: Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are mov

kanishkaw — Fri, 07 May 2021 07:01:32 GMT

Thanks _Val_. We are going to enable Sync link and ClusterXL in a maint window. Thanks for the replies which clarified what should be done.