topic Firewall cluster interface design question in Firewall and Security Management

Firewall cluster interface design question

PIAndre — Wed, 16 Mar 2022 19:40:56 GMT

Hi. Ive got the opportunity to replace an old existing appliance cluster with another new appliance cluster (way faster hardware). The old cluster has a configuration that looks like this:

fw1

bond1 on switch 1 -> internal vlans, cluster sync vlans

bond2 on switch 1 -> external vlans/interfaces

fw2

bond1 on switch 2 -> internal vlans, cluster sync vlans

bond2 on switch 2 -> external vlans/interfaces

Performance has been fine and we dont come close to saturating a gig. The load on this cluster is low and the projected growth of the traffic in the next few years is low as well. Anyone have suggestions on a different design or am I good?

Re: Firewall cluster interface design question

Chris_Atkinson — Fri, 18 Mar 2022 14:08:41 GMT

Different design would depend partly on the switch capabilities, are they fully independent or clustered / stacked in some way?

Most importantly it comes down to requirements... maybe Sync / DMZ on separate ports etc but would depend on hardware constraints.

Re: Firewall cluster interface design question

PIAndre — Thu, 17 Mar 2022 16:26:14 GMT

Its a modern switch stack. If there arent any issues with how the old cluster is configured I guess Ill continue to do the same thing.

Re: Firewall cluster interface design question

Vladimir — Thu, 17 Mar 2022 17:39:54 GMT

So long as you are using multiple bonds in a cluster, I'd recommend keeping Sync on a separate one, if there are ports available on a switch stack to accommodate it. That said, I am prone to over-engineering for redundancy to cover even for low-probability events.

Re: Firewall cluster interface design question

Chris_Atkinson — Thu, 17 Mar 2022 23:19:23 GMT

Do you want things deterministic i.e. switch 1 fails then firewall 1 fails ?

Otherwise some might mesh the bond slaves to try and protect against switch failure.

Re: Firewall cluster interface design question

S_E_ — Fri, 18 Mar 2022 09:01:51 GMT

fully agree, also our preferred setup:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ClusterXL_AdminGuide/Topics-CXLG/Working-with-VLANs-in-Cluster.htm

fw1

bond1 on switch 1 -> internal vlans

bond2 on switch 1 -> external vlans/interfaces

bond3 -> cluster sync vlan

fw2

bond1 on switch 2 -> internal vlans

bond2 on switch 2 -> external vlans/interfaces

bond3 -> cluster sync vlan

Best regards