topic Re: Deploying new VLANs in production in Firewall and Security Management

Deploying new VLANs in production

Matlu — Wed, 07 Jun 2023 19:54:06 GMT

Hello, world.

A query, I currently have a ClusterXL which has configured in its interface Eth2 of each Firewall:

FW 01 -> 10.20.20.1
FW 02 -> 10.20.20.2
VIP -> 10.20.20.254

What we need, is to put a new segment in that same interface, (10.100.100.0/22)

In this scenario, it is ideal to leave configured the segment that currently already has the interface, and add the new segment as a VLAN?

Or is it necessary to leave the interface blank by default and configure the 2 segments as different VLANs?

What is the best practice in your experience?

This type of configuration, it is advisable to always start it in the passive member, and then in the active, and all this, in a working window, right ????

Thanks for your comments.

Re: Deploying new VLANs in production

PhoneBoy — Wed, 07 Jun 2023 21:51:33 GMT

In general, changes of this nature should be done on the passive member first, OS level changes first, then update the configuration in SmartConsole.
And yes, this will definitely need to be done in a maintenance window.

Re: Deploying new VLANs in production

Matlu — Wed, 07 Jun 2023 22:02:28 GMT

Thank you for your response.

For this type of configuration that I have exposed.

Do you think it is necessary, to break the ClusterXL????

In your experience, is it feasible to leave the interface as it is now configured, with one IP, and add the new segment as a VLAN?
Or is it better to "leave the interface blank" and configure the 2 segments as distinct VLANs? ????

Greetings.

Re: Deploying new VLANs in production

PhoneBoy — Wed, 07 Jun 2023 22:10:02 GMT

Note that ClusterXL requires the interface configuration to be the same on both cluster members.
Generally interfaces with VLANs should only have VLANs configured on it (i.e. no IP on the physical interface).
That implies "leave the interface blank" as you put it.
Not sure if that's a hard requirement or just best practice.