topic Re: Create ClusterXL from Single Firewall - Step in Firewall and Security Management

Create ClusterXL from Single Firewall - Step

MtxMan — Thu, 17 Nov 2022 16:38:39 GMT

Hi Checkmates,

i have an use case in my customer environment, so currently they use 5200 single for Perimeter and External firewall + smart-1 410.

and in this month, they will buy a new 2 firewall using 6200 for perimeter. so 5200 would use as clusterXL for external firewall.

does anyone has idea in the easiest way how to create clusterxl on 5200 when running single firewall at beginning? do i need to scratch/fresh install to do that? thanks!

Re: Create ClusterXL from Single Firewall - Step

the_rock — Thu, 17 Nov 2022 17:55:30 GMT

I believe below is an official process:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk61681

Andy

Re: Create ClusterXL from Single Firewall - Step

PhoneBoy — Thu, 17 Nov 2022 23:49:35 GMT

Sounds like they already have external management.
You build the second gateway object, then create the cluster using the two existing gateways.
If you want to make the ClusterXL VIPs use the same IPs as the first gateway, then you should probably change it before creating the cluster object.

Re: Create ClusterXL from Single Firewall - Step

Chris_Atkinson — Thu, 17 Nov 2022 23:55:03 GMT

If the firewall is changing role from external / internal this sounds like it would require changes & down time - what is the concern about starting from scratch here?

Re: Create ClusterXL from Single Firewall - Step

_Val_ — Fri, 18 Nov 2022 08:06:56 GMT

Nope, this one is to break StandAlone config and make it a distributed implementation. The topic starter is asking about how to replace a single GW with a cluster.

Re: Create ClusterXL from Single Firewall - Step

the_rock — Fri, 18 Nov 2022 08:35:43 GMT

Yup, my bad. I think what @PhoneBoy wrote makes sense. I will see if I can find what TAC guy gave me last year for that for a customer who wanted to do the same.

Re: Create ClusterXL from Single Firewall - Step

the_rock — Fri, 18 Nov 2022 13:03:57 GMT

Hey @MtxMan ,

As promised in my last reply, Im sending you steps TAC gave me almost 2 years ago when customer needed this done. Since it does not let me attach a file here, I pasted the actual link he sent us a reference (Version is R80.30, as thats what customer was on back then, but Im positive process is exactly the same for any version)

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_ClusterXL_AdminGuide/html_frameset.htm

https://dl3.checkpoint.com/paid/48/4808360334cfd91e38eb192da36ea686/CP_R80.30_ClusterXL_AdminGuide.pdf?HashKey=1668783673_3b18bc01df1f70808798acefeb08c025&xtn=.pdf (same doc, just in pdf format)

Below is exactly what TAC guy sent us and we followed it and worked fine. Its pretty much boils what @PhoneBoy described in layman terms.

Andy

Process:

The documentation mentions the Standalone deployment for those who have a Standalone firewall and would like to convert it to ClusterXL. In your situation, you can go straight to page 151. "Creating the ClusterXL Object"

Computer B refers to your new firewall and Computer A is your current firewall.

Basically here are the steps:

Install and configure the new cluster member. (Computer B)

make sure that the new firewall can talk to the old firewall and vice versa.
Configure the local configuration such as authentication server, hostname, static route, dynamic route etc.

In the policy, remove any references to the old firewall.
Create a new cluster object in SmartConsole.

Configure the interfaces, Antispoofing, Office mode etc.

The cluster VIP will be the old firewall local IP

Open the Cluster object and in the "Cluster Members" page, click Add, and select New Cluster Member.

Establish SIC
Get interface without topology
Define a Sync interface

Install the policy on the cluster currently including member B only.
On the old firewall.

Disconnect all proposed cluster and Synchronization interfaces. New connections now open
through the cluster, instead of through computer 'A'.
Change the addresses of these interfaces to some other unique IP address which is on the
same subnet as computer B.
Connect each pair of interfaces of the same subnet using a dedicated network. Any hosts or
Security Gateways previously connected to the Security Gateway must now be connected to
both members, using a hub/switch.

Update the topology of the Security Gateway that you just added by clicking Get Topology without interface.
In the Cluster Members page, click Add and select "Add Security Gateway to Cluster"

Select the old firewall
In the "Edit Topology" page, determine the interface type.

Configure the Policy base. (VPN domain, rule base, NAT if needed)
Install the policy.