topic Re: GRE in Cluster environment in Firewall and Security Management

GRE in Cluster environment

D_W — Mon, 17 Oct 2022 15:30:06 GMT

Hi Mates,

target: establish GRE Tunnel between a R81.10 Cluster and a Linux Server by following sk169794

Issue: in the underlay traffic (local IPs) always the cluster members IP is answering and not the Cluster IP!
In the screenshot you can see the remote peer 192.168.2.1 tries to reach the CP Cluster IP with 192.168.1.1 but the CP Member IP with 192.168.1.2 is answering. Is this by design?

With this the GRE is not working because we assume the Remote System doesn't know what to do with the cluster members IP. When we set it up like a single GRE it works!

KR
David

Re: GRE in Cluster environment

PhoneBoy — Mon, 17 Oct 2022 18:43:25 GMT

I believe this is supposed to NAT behind the cluster address, as you can see here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169672&partition=Advanced&product=ClusterXL
In any case, I suspect this is a bug and the TAC will be needed to assist with this.

Re: GRE in Cluster environment

D_W — Thu, 23 Mar 2023 14:41:27 GMT

Just wanted to give an update about the TAC case... TAC is still in research 🤧

Re: GRE in Cluster environment

D_W — Wed, 19 Apr 2023 11:57:28 GMT

Just wanted to update:
We needed an own NAT Rule so that the response from the ClusterMembers are changed to the ClusterVIP.
That was the first we tried but however the NAT rule took a few hours till it matched/become active 😖