topic Re: Function of cluster interface monitoring off in Firewall and Security Management

Function of cluster interface monitoring off

taeho_chang — Wed, 29 Aug 2018 01:51:38 GMT

Hi All.

I have requested some function from customer about clusterXL monitoring interface.

ex)

There is a clusterXL environment > one External , two internal cluster group.

if one internal interface down on Active member, Active status dosen't have to take over to Standby machine.

It means ..this function is to disable cluster interface monitoring on specific interface?

( it's not a private interface)

Other vender like Fortinet or Juniper has this function to disable monitoring.

Re: Function of cluster interface monitoring off

Kaspars_Zibarts — Wed, 29 Aug 2018 05:36:29 GMT

It's hard to understand your setup with two interfaces towards internal core. But the easiest would be to have a bond (port channel) and allow threshold of only one link required to be active for bond to be considered up.

If you are using trunk and VLANs, then you can select which VLAN's you want to monitor ClusterXL VLAN monitoring

Re: Function of cluster interface monitoring off

taeho_chang — Wed, 29 Aug 2018 07:13:26 GMT

Sorry for little confuse. Each interfaces have their own network like one external, one internal, one DMZ and each interfaces are configured cluster mode with virtual IP address.(not private mode)

but if there is function to disable cluster monitoring on a specific port. Even if some cluster interface going down on active member, cluster status has to keep Active-standby status without fail-over.

Re: Function of cluster interface monitoring off

Kaspars_Zibarts — Wed, 29 Aug 2018 07:59:51 GMT

We used this file for VSX bond physical interfaces to tell cluster not to monitor them for failvers but I'm not 100% sure if it would work with regular gateways and interfaces

$FWDIR/conf/discntd.if

Someone from Checkpoint could confirm probably

Re: Function of cluster interface monitoring off

G_W_Albrecht — Wed, 29 Aug 2018 08:16:33 GMT

Nevermore, see sk93306 ATRG: ClusterXL :

30 Mar 2015

Added a note that starting from Gaia R75.47, R77.20, the file $FWDIR/conf/discntd.if is not needed anymore. .Please note that this is also true for Embedded Gaia R77.20.X

Re: Function of cluster interface monitoring off

Kaspars_Zibarts — Wed, 29 Aug 2018 09:06:09 GMT

we still don't know what SW these GWs are running so might work hah

Re: Function of cluster interface monitoring off

G_W_Albrecht — Wed, 29 Aug 2018 09:40:52 GMT

Yes, e.g. for R75.40...

Re: Function of cluster interface monitoring off

taeho_chang — Thu, 30 Aug 2018 00:08:34 GMT

Thank you for reply. I tested what you say. but It didn't work properly. because my environment is normal clusterXL not VSX.

Re: Function of cluster interface monitoring off

Kaspars_Zibarts — Thu, 30 Aug 2018 08:14:41 GMT

Then you probably will have to make interface private in order to disable cluster monitoring