topic Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig in Firewall and Security Management

7000 gateway cluster moving from 1 Gig interface to 10 Gig

aboo008 — Thu, 19 Jan 2023 18:18:17 GMT

Hi team.

I am sure similar questions have been asked under different scenarios, and I apologize for repeating it again.

We are planning to move our Core to FW link from 1 Gig (RJ45) to 10 Gig (SFP). We have a cluster of 2 gateways in active/standby scenarios. They are configured with static IP's on the FW and on the core are part of a vlan. Our internal routes points to the gateway IP connected to the inside interface. What will be the best approach to getting this moved over with minimal downtime.

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

the_rock — Fri, 20 Jan 2023 00:59:56 GMT

I cant really speak to your specific scenario, but I can tell you that every time I dealt with this sort of scenarion, as long as below things are in check, you will be fine, 100% (not necessarily in this order):

1) cabling

2) speed/duplex matching

3) IP addressing

4) VLAN config

5) routing

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

Chris_Atkinson — Fri, 20 Jan 2023 08:20:36 GMT

Perform the change on the standby member first.

Are the existing connections part of a bond/etherchannel at all?

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

CheckPointerXL — Sun, 29 Jan 2023 09:15:43 GMT

Hey Cris, which plan in case of LACP bond interface?

if a remember correctly LACP bond is not possible with mismatched interface speed. With Active/Backup bond it should be possible, so the trick "first standby member then the active" is good, am i right?

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

Chris_Atkinson — Mon, 30 Jan 2023 09:56:32 GMT

If there are existing bonds and you are working with a cluster in theory there isn't a need to mix speeds.

On the standby you simply remove the old slaves and add new, failover and repeat (from memory).

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

aboo008 — Tue, 18 Jul 2023 16:33:51 GMT

Sorry for this late response but no they are not part of a etherchannel. The firewalls working in HA as a Active/Standby.

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

Scottc98 — Tue, 18 Jul 2023 19:27:50 GMT

one thing to to consider here is whether you should set it up as a bond (LACP) with only one 10G link to start. That way, if you find in the future you need more, its just adding another 10G to your bond.

Avoid the same issue you ran into in the first place 😉

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

the_rock — Tue, 18 Jul 2023 19:36:57 GMT

Great point @Scottc98

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

aboo008 — Tue, 18 Jul 2023 19:43:03 GMT

Thank you for that info, will do that with this move form 1 Gig to 10 Gig.

Re: 7000 gateway cluster moving from 1 Gig interface to 10 Gig

aboo008 — Tue, 18 Jul 2023 19:44:55 GMT

Still waiting to see a clear step by step instructions to move from 1 Gig interface to 10 Gig. We want to keep the IP's the same and configuration. Static routes which are not point to the 1 Gig interface should be fine and only those are pointing to the interface will need to be changed. Any other caveats tips. Thanks.