topic Re: Cluster behaviour in Firewall and Security Management

Cluster behaviour

ZakMeadows — Wed, 31 May 2023 14:32:48 GMT

I have a couple of questions that need answering:

So if the 6600 cluster firewalls aren't able to reach the management server on the other datacentre. What will happen will they still be able to route traffic and essentially just become a router without cluster configuration and Firewall policy? I pushed the policy when I was building the Firewall's for the policy that will be used, so if the management server isn't contactable will this policy still be active and usable?

Another scenario; if we are able to get the Firewall to communicate to the management server so that it can install all the policy and form the cluster. If the server was to go down for some unknown reason what will happen to the HA cluster, will the cluster not be formed anymore? Will the Firewall's not be able to transit data? What would be the impact of that scenario? Or would live traffic not be affected?

Jim

Re: Cluster behaviour

PhoneBoy — Thu, 01 Jun 2023 00:31:12 GMT

A gateway, whether or not it’s a cluster, will use the last successfully installed policy UNLESS you don’t have a valid license.
Clustering works on the same principle: it’s generally unaffected by the management not being available.
Two notable exceptions:

Logs will be stored in the relevant gateway until the management or log server comes back online.
If you are doing any VPNs using certificate-based authentication with the Internal CA, expect these VPNs to fail after about 24 hours as the CRL points to the management server.

Re: Cluster behaviour

just13pro — Thu, 01 Jun 2023 01:36:29 GMT

To answer your other question about Firewall HA.

If one of the FW is down, the other member will take over, that is the reason of HA and live traffic will be not affected unless both devices are down.

Re: Cluster behaviour

ZakMeadows — Thu, 01 Jun 2023 08:37:37 GMT

Hi,

I am asking if the Management server was to goes down, will this affect anything to do with how the cluster acts?

Kind Regards,
Zak

Re: Cluster behaviour

just13pro — Thu, 01 Jun 2023 08:39:33 GMT

Nope, it will not