topic Re: Checkpoint 3800 SMB ClusterXL in Firewall and Security Management

Checkpoint 3800 SMB ClusterXL

superd — Fri, 18 Feb 2022 12:59:23 GMT

Hi all,

Im trying to deploy two Checkpoint 3800s with ClusterXL.

Ive enabled clusterXL using cpconfig. And its telling me I need a policy pushed in order to start the HA module.

FW02:0]# cphastart
cphastart: Policy should be installed to run the command

I understand the clusterXL settings will be primarily deployed from SMS server. But from the local firewall point of view theres no HA sync interface, so Im trying to understand how the firewalls physically connect for HA sync. Is it just a matter of enabling HA sync on one of the ETH ports, and connecting back to back?

Im running R80.40, and ultimately they will be managed by an Azure SMS server.

Note, the boxes are not licensed yet. Ideally this will be deployed from the Azure SMS centrally.

One other question as an aside, when managing on prem FWs from an Azure SMS server, how does the licensing work, in terms of the central IP address - does it make more sense to do local licensing?

Cheers.

Re: Checkpoint 3800 SMB ClusterXL

_Val_ — Fri, 18 Feb 2022 13:07:18 GMT

Can you please explain what you mean by saying: "But from the local firewall point of view theres no HA sync interface, so Im trying to understand how the firewalls physically connect for HA sync"

When you will be configuring the cluster in SmarConsole, you will have to chose one of NICs to be a sync. What do you mean "by local firewall point of view"?

Re: Checkpoint 3800 SMB ClusterXL

superd — Fri, 18 Feb 2022 13:12:52 GMT

Ah ok, so the actual sync interface is defined on SMS?

From a previous firewall deployment, I had a physical HA interface for sync. I guess that was throwing me off.

So essentially, should I just select an unused ETH port and connect it back to back, and then configure the sync IP addressing on the SMS server?

Re: Checkpoint 3800 SMB ClusterXL

Chris_Atkinson — Fri, 18 Feb 2022 13:17:53 GMT

That's pretty much it, in SMS you fetch/configure the Gateway interface topology as you've configured on the appliance via Web UI/CLI.

It's here you also define the VIP for each non Sync interface.

Re: Checkpoint 3800 SMB ClusterXL

superd — Fri, 18 Feb 2022 13:26:51 GMT

Thanks Val and Chris - appreciate the prompt respones.

Would you have any thoughts on my licensing query?

One other question as an aside, when managing on prem FWs from an Azure SMS server, how does the licensing work, in terms of the central IP address - does it make more sense to do local licensing?

For central licensing of the SMB GW, do I need a static IP for the SMS server?

Re: Checkpoint 3800 SMB ClusterXL

Chris_Atkinson — Fri, 18 Feb 2022 14:10:58 GMT

For reference sk155632 talks to some of the caveats of your choice of IP/License mapping during upgrades.

Re: Checkpoint 3800 SMB ClusterXL

Bob_Zimmerman — Fri, 18 Feb 2022 14:46:08 GMT

The interface which is labeled "Sync" on other boxes is just an interface with a weird name. There's nothing at all special about it. Any interface (or set of interfaces bonded together) can be used for state sync.

Sync should always be run through a switch. Direct-wired sync can cause the remaining member to refuse to take over the cluster if a member fails.