topic Re: HA in single VLAN of L2 switch in Firewall and Security Management

HA in single VLAN of L2 switch

RioAung — Thu, 18 Nov 2021 15:39:31 GMT

Hi ,

I am newbie in checkpoint .I would like to know can i deploy two HA in one single VLAN ?

Let me know technically issue for CCP ? if we are using VRRP we only need to change VRRP priority or group right?

CCP can do like below ?

Re: HA in single VLAN of L2 switch

PhoneBoy — Thu, 18 Nov 2021 17:35:38 GMT

Yes.
Depending on the version you may need to take some additional configuration steps (specifically changing the Cluster_ID).
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk25977&partition=Basic&product=ClusterXL,

Re: HA in single VLAN of L2 switch

Marcel_Gramalla — Thu, 18 Nov 2021 20:13:20 GMT

Since R80.40 this is no problem att all withour any modifications as the CCP changed to unicast by default. See the sk from PhoneBoy and:

This article is no longer relevant to versions R80.40 and higher.
This article is not relevant for Gaia Security Gateway with kernel version 3.10.

Re: HA in single VLAN of L2 switch

RioAung — Fri, 19 Nov 2021 01:12:59 GMT

Hi,

let me know it is also support on SMB appliance ?

Re: HA in single VLAN of L2 switch

PhoneBoy — Fri, 19 Nov 2021 01:22:58 GMT

If the SMB appliances are managed by an external manager, then the SK still applies, I believe.
For locally managed SMB appliances, not entirely sure and you may have to manually tweak the fwha_mac_magic and
fwha_mac_forward_magic variables.
Might need to engage TAC for this.

Re: HA in single VLAN of L2 switch

RioAung — Fri, 19 Nov 2021 03:44:20 GMT

Hi ,

This mean R80.40 and above is no issue in same vlan ,correct ?

Re: HA in single VLAN of L2 switch

Marcel_Gramalla — Fri, 19 Nov 2021 07:16:06 GMT

Correct. I'm currently writing you through such a setup 😁 To be sure just check the first cluster with "cphaprob -a if" and on the top you will see the current CCP mode.