Additional Cluster in same VLAN R80.40 / R80.10

YC_SEC — Sun, 18 Aug 2024 11:48:38 GMT

Hi Mates,

we plan to add a second Check Point Cluster to VLANs where already a Check Point cluster is establised.
old Cluster (VSX Cluster) in production are in R80.10, and the New on R80.40 (not VSX).

According sk25977 this can be an issue with <R80.30 and some tweaks are necessary.
It's stated that this SK is not relevant to Gateways R80.40 and higher but no info is given what changes where made or if we have to do something else.

When we connect the new interfaces for the new cluster on the Switchs (same For eth1 ( Vlan 81 ), and the second interface eth2 same Trunk/ but when we make the new cluster on production, all network are impacted (eth1 and eth2 pluuged = network issue).

We need to migrate to the new Cluster , with the same Vlan and segment, juste changing the adressing interface beetween the clusters,

Which verification we need to make , to lookup the the root cause, and remediate it.

Thanks a lot.

Re: Additional Cluster in same VLAN R80.40 / R80.10

_Val_ — Mon, 19 Aug 2024 06:54:36 GMT

sk25977 is indeed no longer relevant for R80.40 and up. Since that version, ClusterXL uses new encrypted CCP unicast traffic for all cluster-related purposes, allowing multiple cluster members in the same broadcast domain without collision or manual tuning.

For your case it means that your old cluster should not interfere wit the new one. I hope you are NOT using the same VIPs on both clusters though.

On another subject, R80.40 is out of support since April 2024. Why would you implement a "new" version already unsupported?

topic Re: Additional Cluster in same VLAN R80.40 / R80.10 in Firewall and Security Management

Additional Cluster in same VLAN R80.40 / R80.10

Re: Additional Cluster in same VLAN R80.40 / R80.10