topic Re: VSX Failover Logic in Firewall and Security Management

VSX Failover Logic

Malik1 — Thu, 29 Sep 2022 14:59:45 GMT

Hi Experts, We plan to deploy two 26000- gateways in VSX . I wanted to understand the failover logic when Chassis HA mode. In case a VS fails , lets say that the interface that is assigned to the VS that connects to as distribution switch fails . Does the failover only happen for that VS or ALL VSes will fail over, not just one. If case the answer is YES . can we have individual VS failover in HA mode . Dont want to use VSLS. Regards, Sijeel

Re: VSX Failover Logic

Chris_Atkinson — Fri, 30 Sep 2022 07:50:17 GMT

R81.10 JHF T75 fixed a related issue with Bond interface failure.

HA is actually facilitated with VSLS now days.

Note:

The only mode available for a VSX Cluster that was installed as R81.10 and higher is Virtual System Load Sharing (VSLS).

The High Availability mode is available only if you upgrade a VSX Cluster from R81 or lower to R81.10.

Re: VSX Failover Logic

_Val_ — Thu, 29 Sep 2022 15:48:30 GMT

First, let me say, VSLS is the preferred mode for everything, regardless.

Classic HA mode means that you run all VSs active on one member, and they all fail over if there is something wrong, event with only one of them.

If you want a failover per VS, this is VSLS. And with manual distribution, you can have all VSs active on your preferred cluster member. VSLS allows that too while keeping per VS failover if something goes wrong.

Re: VSX Failover Logic

Malik1 — Fri, 30 Sep 2022 07:27:07 GMT

Chris,

So if i do a fresh installation with r81.10 or high the only option i have is VSLS. Do u have any documentation or SK that i can refer to.

Thanks

Re: VSX Failover Logic

Malik1 — Fri, 30 Sep 2022 07:29:25 GMT

Thanks Val , that sound like a good idea to setup the VSX in VSLS mode and manually make all the VS's active on one cluster member. And that way i can have failover per VS.

Re: VSX Failover Logic

_Val_ — Fri, 30 Sep 2022 07:32:08 GMT

Correct.

Re: VSX Failover Logic

Chris_Atkinson — Fri, 30 Sep 2022 07:35:57 GMT

The source for the above statements is the R81.10 VSX admin guide, please refer:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_VSX_AdminGuide/Topics-VSXG/VSX-Cluster-in-HA-Mode.htm

Re: VSX Failover Logic

_Val_ — Fri, 30 Sep 2022 07:40:39 GMT

Would R81.10 VSX Administration Guide be enough?

Quoting from there:

Virtual System Load Sharing (VSLS):

Ensures continuous operation by means of transparent VSX Cluster Member failover.
Enhances system performance by distributing Active Virtual Systems amongst VSX Cluster Members.
Efficiently balances network traffic load by distributing active Virtual Systems between VSX Cluster Members.
All VSX Cluster Members and Virtual Systems are continuously synchronized.

Note - This is the only mode available for a VSX Cluster that was installed as R81.10 or higher.

Re: VSX Failover Logic

_Val_ — Fri, 30 Sep 2022 07:42:16 GMT

@Chris_Atkinson Just to clarify, if a cluster was in HA mode and then upgraded, it will still be able to run HA, also in the guide. I just do not see the point of keeping it that way 🙂

Re: VSX Failover Logic

Chris_Atkinson — Fri, 30 Sep 2022 07:46:00 GMT

@_Val_ Don't worry I 100% agree, HA is now a subset config of VSLS exactly as you describe. 🙂