topic Re: VRRP between VSs on different VSX clusters in Firewall and Security Management

VRRP between VSs on different VSX clusters

Marko_Keca — Thu, 28 Sep 2023 10:59:47 GMT

Hello all,

Is it possible to use VRRP on Check Point between VSs on different VSX clusters?

Reason:

We have 2 datacenters. Each has its own VSX cluster, managed from different CMA. Behind Check Point is NSX stretched deployment, and NSX management VLAN is L3 terminated on one of VSs. We would like to use VRRP address for default gateway in NSX management, so if one cluster/DC fails, we will not lose management connectivity to other site, and other site will be able to communicate with witness server (on separate location).

So basically we don't want to use it as clustering method. We want only benefit of sharing Virtual IP between two separate VSs for default gateway.

Thanks in advance!

Regards
--
Marko

Re: VRRP between VSs on different VSX clusters

Bob_Zimmerman — Thu, 28 Sep 2023 14:58:39 GMT

This is not possible.

Separately, spanning a layer 2 domain between datacenters is a really bad idea from an availability design perspective. Complicated low levels lead to problems which are extremely hard to debug at higher levels.

Re: VRRP between VSs on different VSX clusters

PhoneBoy — Thu, 28 Sep 2023 19:16:37 GMT

VRRP is not supported on VSX.

Re: VRRP between VSs on different VSX clusters

Chris_Atkinson — Thu, 28 Sep 2023 23:31:32 GMT

For a list of supported features on VSX please refer sk79700

Re: VRRP between VSs on different VSX clusters

Marko_Keca — Thu, 28 Sep 2023 23:44:16 GMT

Thank you all for the answers!

Would it be possible if we have two non-VSX clusters?

Regards,
--
Marko

Re: VRRP between VSs on different VSX clusters

PhoneBoy — Fri, 29 Sep 2023 02:16:11 GMT

Gaia supports VRRP for non-VSX, but it's primarily tied to ClusterXL.
Not sure this will work the way you expect.
It's definitely not a good design, as @Bob_Zimmerman pointed out.