topic Re: clusterXL failover and dynamique routing in Firewall and Security Management

clusterXL failover and dynamique routing

DZ_KB — Wed, 20 Apr 2022 05:43:25 GMT

Hi all,

I'm doing ebgp with a cisco router and gateway clusterXL; And that works fine. It uses the clusterXL VIP of the gateway to establish the ebgp session with the cisco router.
But when i do a clusterxl failover, the eBGP session on the standby member (newly master) takes about 40sec for passing from "idle state" to "established state" while clusterxl switch was done imediately..
The problem is that this switchover makes a blackhole trafic during 40sec.
Do you know if there is a way to tune the switchover ? for exemple to synchronize clusterXL switchover with ebgp session ?
or something else ton decrease this outage time ?

Nb: I use r81 version on security gateway

Thank you for your reply.

kind regards

Re: clusterXL failover and dynamique routing

Chris_Atkinson — Wed, 20 Apr 2022 13:53:16 GMT

Is graceful restart configured in this scenario? Please see sk100499.

Re: clusterXL failover and dynamique routing

DZ_KB — Wed, 20 Apr 2022 12:27:24 GMT

Hi @Chris_Atkinson ,

GR is not enabled.

Does it means that if i enable it, the newly master will forward packet even if the bgp session is not yet bring up ?

Re: clusterXL failover and dynamique routing

Chris_Atkinson — Wed, 20 Apr 2022 13:10:02 GMT

Yes it's recommended in such scenarios.

Sets the Check Point system to maintain the forwarding state advertised by peer routers even when they restart.

This minimizes the negative effects caused by the restart of peer routers.

Re: clusterXL failover and dynamique routing

DZ_KB — Wed, 20 Apr 2022 13:14:48 GMT

Ok. Thank you very much for your lights @Chris_Atkinson .

Re: clusterXL failover and dynamique routing

Chris_Atkinson — Wed, 20 Apr 2022 14:01:28 GMT

Not a problem.

Also Note - In a cluster, you must select a Router ID and make sure that it is the same on all cluster members.