topic LACP rate change in Firewall and Security Management

LACP rate change

MartinKy — Tue, 26 Nov 2024 15:30:47 GMT

Hello,

we have a cluster of two firewall nodes in production use.
Towards Cisco switches, we have LACP configured, but it seems that there is a mismatch in LACP rate.

Unfortunately we are unable to change it on Cisco side, where we have slow LACP rate.
On CheckPoint box we have Fast LACP rate configured.

To make the configuration consistent, we would like to configure the LACP slow rate on the Check Point FW as well.

As the firewalls are in productive use, does changing LACP rate impose any risk or drop?
Like interface up/down and so on

Thanks and Regards
Martin

Re: LACP rate change

Chris_Atkinson — Wed, 27 Nov 2024 00:31:24 GMT

Commonly such a change might be applied to the standby member first and then after some time traffic failed across (which is stateful using ClusterXL_admin cmds) to this member and the change repeated on the new standby member.

Depending on your choice of cluster mode some customers may opt to go a step further and force the standby member down during the activity and manually bring it up again after as an additional measure of 'control', but it depends on the operating environment.

Re: LACP rate change

Lesley — Wed, 27 Nov 2024 05:45:42 GMT

These are good tips from Chris. Just do the change first on standby member. After that some testing and failover after that other member