topic Re: ClusterXL Load Sharing Design Best Practice Questions in Firewall and Security Management

ClusterXL Load Sharing Design Best Practice Questions

Fabz — Sun, 18 Jun 2023 15:02:05 GMT

Hi Checkmates,

Im designing gateway with ClusterXL Load Sharing + VSX. The design would be approximately:

3 VS (A,B,X)
VS A+B would connect to same switch with trunking sub interface
A have a heavy traffic, so it will mapping on GW1 and B+X on GW2

my question is:

eventhough A and B have same interface, is it possible in CheckPoint divide the traffic according to the requirement above? I'm afraid because it uses the same interface for both VS(A+B) so both VS can only run on the same GW (can't do Load Sharing)
For design like above, does anyone has idea or best practice for the design?
With LS, if GW1 has 60% utilization and GW2 has 50% means 110% utilization. What is the impact if one of the GW down?

Thankyou Checkmates!

Re: ClusterXL Load Sharing Design Best Practice Questions

Chris_Atkinson — Sun, 18 Jun 2023 23:46:16 GMT

Legacy ClusterXL load-sharing is not used with VSX in this way.

VSLS allows you to distribute VS between VSX cluster members primarily/typically to balance resource utilisation but not to split the same traffic flow.

Where VS share an interface we have the virtual switch concept but again this is not a load-sharing application.

What is possible with dynamic routing also doesn't constitute load-sharing in a Cluster XL / VSX operating mode context.

Re: ClusterXL Load Sharing Design Best Practice Questions

PhoneBoy — Mon, 19 Jun 2023 17:18:26 GMT

The Load Sharing in VSX refers to the fact the VSes can be distributed among all cluster members.
The VSes themselves are HA (active on one physical gateway, standby on another).
You can assign the VSes to specific hosts, so A is one gateway, B+X are on the other.

If your expected utilization of both gateways is ~50% and one fails over, you'll be left with a single overloaded gateway.
Performance will most certainly be degraded at the very least.