topic Re: Failure Test Methodology in Firewall and Security Management

Failure Test Methodology

Hllrdm — Wed, 08 Dec 2021 11:46:41 GMT

Does the company have any manual on how to test the failover of a security gateway cluster?
For example, when the link load is high, when network availability is down, when the first node is down, etc.
Different variations on the testing methodology are of interest.

Re: Failure Test Methodology

Chris_Atkinson — Wed, 08 Dec 2021 13:29:13 GMT

The ClusterXL admin guide will cover the commands for initiating a graceful failover.

Link load itself is not a failover criteria, but depending on the scenario could lead to CCP loss which if significant enough _might_ appear similar to a link failure (disconnecting cable).

Rebooting / powering off a member is also a valid test.

Re: Failure Test Methodology

Hllrdm — Wed, 08 Dec 2021 13:36:46 GMT

Could you please clarify the section in the admin manual where I could see the Failure testing methodology.

Re: Failure Test Methodology

Amogha_Chandras — Wed, 08 Dec 2021 14:05:59 GMT

Hello In the admin guide, look for "How to Initiate Cluster Failover"

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ClusterXL_AdminGuide/html_frameset.htm

Run the command clusterXL_admin down should failover the device

The sk55081 Best Practices - Manual fail-over in ClusterXL might also help - it explains how to perform a manual (controlled) failover in Check Point cluster while maintaining full connectivity with each cluster member, keeping interference with cluster's operations at a minimum.

Re: Failure Test Methodology

Bob_Zimmerman — Wed, 08 Dec 2021 15:19:32 GMT

Worth noting: if you use 'clusterXL_admin down' to force a failover, remember to run 'clusterXL_admin up' afterwards. The admin_down status sticks around until you manually clear it (or reboot the member). I've seen people forget to clear it before, only to take an outage when they have a real failure on the other member.

I always run it as 'clusterXL_admin down;clusterXL_admin up'.