topic Re: L3 mode and bridge mode together in ha configuration in Firewall and Security Management

L3 mode and bridge mode together in ha configuration

Amir_Arama — Thu, 02 Dec 2021 11:21:08 GMT

Hi,

i have checkpoint cluster working as active/standby HA.

i need to connect bridge interface from each of these cluster members between internet and another device.

my question is:

1. is it supported to Combine layer 3 interfaces with bridge interfaces on the same GWs while working as a cluster?

2. do i need to configure the cluster as bridge mode via cpconfig? (because it's both)

3. how exactly does it behave? is the active member only will forward layer 2 on bridge interface, and the standby will not pass layer2 on the bridge interface? or can i make both of them process traffic on layer 2 bridge interface ?

thx

Re: L3 mode and bridge mode together in ha configuration

Amir_Arama — Sat, 04 Dec 2021 16:47:45 GMT

Anyone?

Re: L3 mode and bridge mode together in ha configuration

the_rock — Sat, 04 Dec 2021 21:50:17 GMT

I will let other way more experienced in this answer you, but maybe below can help in the meantime:

https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia_AdminGuide/html_frameset.htm?topic=documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_Gaia_AdminGuide/214705

I will, however, take a "stab" at your questions:

1) I believe so

2) yes

3) I dont think it matters what type of interface it is, because if its HA config, passive member should never pass any traffic at all

Re: L3 mode and bridge mode together in ha configuration

PhoneBoy — Sun, 05 Dec 2021 03:22:40 GMT

The clustering for Bridge Mode actually requires Active/Active, as I recall.
Recommend reading through the limitations here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101371&partition=Advanced&product=Quantum