topic Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30? in Firewall and Security Management

When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Sarm_Chanatip — Fri, 19 Jul 2019 08:49:45 GMT

Dear Check Point Team,

Regarding the known issue with ClusterXL R80.20 and above does not support Load Sharing mode. Therefore, SmartConsole blocks such a configuration with a warning message.

I would like to know when it will be fixed and become to support like an R80.10.

Regards,

Sarm

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

HeikoAnkenbrand — Fri, 19 Jul 2019 13:31:55 GMT

It's been discussed here.

I once copied a passage from @PhoneBoy answer:

CUT>>>

Load Sharing has a few limitations, see:

ClusterXL Load Sharing mode limitations and important notes
Security features do not work in Asymmetric Routing scenario (which can come up in a Load Sharing scenario)

The amount of sync traffic required for ClusterXL Load Sharing significantly limits its scalability, particularly as you get into 3 and 4 node clusters.

It also reduces overall cluster resiliency in the case where one member fails, particularly if you are utilizing the load sharing cluster at or near capacity.

Given the above, I usually advocate for buying right-sized appliances for an HA configuration versus buying smaller appliances using load sharing.

And, in fact, this is what the vast majority of our customers do.

Maestro solves a lot of these limitations and improves scalability dramatically over ClusterXL Load Sharing.

<<<CUT

I also think Maestro is the future technology.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Fri, 19 Jul 2019 14:33:14 GMT

In r80.20 /.30 we introduced new limitation on load sharing with VPN (Due to maestro code main train unification, we took the maestro side and broken the main train side. Since the usage is low, it was the best tradeoff among the alternatives).

Due to the type of limitation, we decided to block the whole feature temporarily till we will make it clearer (so user can understand what is working). We are now in the process of enabling the large part of load sharing that does work, on r80.30. If you need this more urgently, contact our solution center to get assistance till we complete the publication of it (as its artificially blocked).

Load sharing with vpn is still blocked (this requires development) and we will bring it back but in future release (most cases i saw that did use load sharing, didnt need the vpn aspect so the above should cover the vast majority).

Dorit

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Sarm_Chanatip — Tue, 23 Jul 2019 04:46:11 GMT

@Heiko

I link to the hyperlink you provided "It's been discussed here"
And found some comment from PhoneBoy, he said that checkpoint plan to bring it back later this year. Not sure if this true!

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Sarm_Chanatip — Tue, 23 Jul 2019 04:51:39 GMT

Hi @Dorti,

You mean the Load sharing with vpn is still blocking or as whole Load sharing configuration.

Thank you in advance.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Tue, 23 Jul 2019 05:02:33 GMT

today: all load sharing is blocked except maestro

working to certify: enabling load sharing without vpn on R80.30 (can be done now if urgent contact us)

later after more development: load sharing with vpn

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Sarm_Chanatip — Tue, 23 Jul 2019 05:08:40 GMT

Hi Dorit,

Thank you for clarification.

However, can you estimate the time that the Load Sharing mode will be back in R80.20 and R80.30?

As I know if the customer wants to use this functionality they need to implement with R80.10, right?

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Tue, 23 Jul 2019 05:27:10 GMT

I am quite implicit above: if you need non-vpn load sharing, you can get it now over r80.30 if you can contact us or wait to get it published publicly

If you need vpn load sharing, we still need to develop so it will be on later release

If you are not clear, i recommend you will work w our local sales to further understand

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Sarm_Chanatip — Tue, 23 Jul 2019 05:56:59 GMT

Hi Dorit,

I got it now. Thanks for clarification again.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Guy_Elyashiv — Mon, 07 Oct 2019 15:18:21 GMT

Hi,

Please refer to sk162637 regarding the support of ClusterXL Load Sharing mode in R80.20 and above.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Timothy_Hall — Mon, 07 Oct 2019 22:24:04 GMT

Thanks for the new and informative SK, is there some reason that the lifting of the ClusterXL Load Sharing restriction is not shown in the "list of resolved issues" for the R80.20 and R80.30 Jumbo HFA takes?

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Mon, 07 Oct 2019 22:39:46 GMT

Technically, load sharing vpn is still limited, ... so in order to avoid mistakes and the ui is technically still blocked (unless you open it).

Therefore you need to read the sk to open the ui and the release notes direct you to the sk

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

An_Nguyen — Thu, 05 Dec 2019 16:33:37 GMT

We have been waiting for a supported release that works with Cluster Load Sharing.

This is a major reason while we are evaluating other Firewall Solutions. I have been told many times by support that load sharing is not a recommended solution.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Mon, 19 Oct 2020 05:58:42 GMT

Scroll up in this checkmates post and see response from the R&D leader from October. The solution is available already part of GA jumbo's and you can read all about it in sk162637

Version	Take
R80.20	Jumbo HF take 117 and above
R80.30 kernel 2.6.18/3.10	Jumbo HF take 76 and above

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

An_Nguyen — Thu, 05 Dec 2019 19:04:35 GMT

It still doesn't solve the problem because it supports ClusterXL Load Sharing WITHOUT Ipsec VPN.

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

Dorit_Dor — Thu, 05 Dec 2019 19:39:20 GMT

Indeed

(1) Very small percentage used VPN w load sharing which is why we allowed this limitation in the first place

(2) This part (the VPN w load sharing) required more complicated resolution vs the Maestro / scalable platform VPN. Therefore we gave priority to integrating the high end into the maintrain at the cost of not supporting load sharing w VPN in the short term

(3) We have a function called solution center that helps us resolve such missing pieces when they impact the business, by driving formal commitment to complete certain functionality by a certain date (they will deliver a formal commitment). Please leverage your local sales team or contact @PhoneBoy off line to get assistance

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

G_W_Albrecht — Mon, 19 Oct 2020 10:33:58 GMT

As mentionend before, you currently can use either VSX VSLS or Maestro to overcome this limitation !

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

PhoneBoy — Tue, 20 Oct 2020 01:58:34 GMT

As for support for Load Sharing + VPN, it is available in a customer release for R80.40.
Please engage your local Check Point office to obtain this release.
It's planned to include this functionality in a future release (after R81).

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

tech_guy — Mon, 24 Oct 2022 12:27:29 GMT

Hi All,

It seems load sharing has been disabled and i have checked with R80.40, R81 and R81.10 with HFA installed

Re: When will checkpoint support the Load Sharing mode in either R80.20 and R80.30?

PhoneBoy — Thu, 27 Oct 2022 16:53:23 GMT

Even with the correct version/JHF, you must apply the steps in sk162637 to enable the functionality in SmartConsole.
This includes the steps for enabling it on a specific SmartConsole installation.