topic Re: R82 – Install ElasticXL Cluster in Firewall and Security Management

R82 – Install ElasticXL Cluster

HeikoAnkenbrand — Fri, 16 Feb 2024 06:53:45 GMT

Overview

ElasticXL is a new cluster technology that enables simplified operation with a single management object with automatic configuration and software synchronisation between all cluster members.

ElasticXL is expected to be delivered with R82 or later versions. ElasticXL is based on similar technology to Maestro, but without MHOs. It is based on Check Point's SP versions for a scalable platform that allows you to increase the performance of the security gateways almost linearly.

I have tested it with the R82 EA version.

You can find more information about ElasticXL in this article: R82 ElasticXL

Install first ElasticXL gateway

1) Run the GAIA installation wizard on the appliance and select "ElasticXL" for clustering.
If you want to use VSNext (replacement for the classic VSX), click the checkbox "Install as VSNext".

2) Assign a SIC one-time password.

3) After installation, you will find the ElasticXL Gateway under the "Cluster Management" menu item.

4) Create a new gateway object (not CLusterXL object) in the SmartConsole.
5) Now establish a SIC connection to the ElasticXL gateway IP from the SmartDashboard.
6) Afterwards, install a policy on the gateway.

Add more ElasticXL gateways to the cluster.

1) Wire the next appliances via the switch infrastructure so that all sync interfaces are connected to same network.
Normally the ElasticXl sync interface is the eth1 interface.

2) Start the appliance and do not run the installation wizard.

3) Log in to the appliance via console cable or via LOM interface.
You are now in the gclish (global clish). Execute the following command:
g> show cluster member info

Copy the "Request ID" to the clipboard or to a text file.

4) Open a SSH session to the previously installed appliance and add the appliance with the following command in the gclish:
g> add cluster member method request-id identifier 5aac9e10de7cd0e34cdf7fa368076b37 site-id 1 format json

5) The appliance should be installed automatically after approx. 5 minutes.
The access policy is automatically synchronised by the first ElasticXL gateway (SMO).

6) Both gateways should now be shown in the GAIA portal under the side 1.

7) Open an SSH session on the first gateway and check if the ElasticXL cluster is working.
You can check this with the following command in the expert mode:
# asg monitor

Re: R82 – Install ElasticXL Cluster

the_rock — Thu, 15 Feb 2024 21:00:25 GMT

Nice! 👍

Re: R82 – Install ElasticXL Cluster

PhoneBoy — Fri, 16 Feb 2024 02:51:06 GMT

Possible the final instructions may differ once R82 is released as undoubtedly this was done based on EA code.
Even so, it gives people an idea of what to expect. 👍🏻

Re: R82 – Install ElasticXL Cluster

the_rock — Fri, 16 Feb 2024 02:58:17 GMT

Just curious...will this be available for regular Gaia appliances or only maestro?

Best,

Andy

Re: R82 – Install ElasticXL Cluster

HeikoAnkenbrand — Fri, 16 Feb 2024 06:52:38 GMT

@the_rock

Should be possible on the regular appliances.
But we should wait for the GA version.

Best,
Heiko

Re: R82 – Install ElasticXL Cluster

_Val_ — Fri, 16 Feb 2024 08:55:52 GMT

@the_rock ElasticXl is for physical clusters only, not Maestro.

Re: R82 – Install ElasticXL Cluster

the_rock — Fri, 16 Feb 2024 12:22:56 GMT

Great news.

Best,

Andy

Re: R82 – Install ElasticXL Cluster

the_rock — Fri, 16 Feb 2024 12:23:29 GMT

Thanks @_Val_ , really looking forward to it.

Best,

Andy

Re: R82 – Install ElasticXL Cluster

PhoneBoy — Fri, 16 Feb 2024 15:30:02 GMT

Just to be clear, the only major difference hardware-wise between Maestro and non-Maestro are:

The addition of the hardware orchestrator
The installation image used (though the underlying software is the same for Maestro and non-Maestro)
Some functionality differences between Maestro and non-Maestro configurations: https://support.checkpoint.com/results/sk/sk148074

ElasticXL brings a lot of the functionality of Maestro without the hardware orchestrator.
It is designed to replace ClusterXL for HA/Load Sharing configurations and will use a lot of the same commands and concepts as Maestro (including the Single Management Object).

Re: R82 – Install ElasticXL Cluster

the_rock — Fri, 16 Feb 2024 15:49:47 GMT

Thats @PhoneBoy , super helpful.

Best,

Andy

Re: R82 – Install ElasticXL Cluster

OTWal — Sat, 17 Feb 2024 16:15:05 GMT

Will R82 and ElasticXL be presented at the CPX in Vienna?

Re: R82 – Install ElasticXL Cluster

HeikoAnkenbrand — Mon, 19 Feb 2024 07:39:54 GMT

There will be a presentation in Vienna at the CPX:
Wednesday 15:20-16:20 --> R82 - ElasticXL and VSNext Generation Under the Hood

Re: R82 – Install ElasticXL Cluster

the_rock — Mon, 19 Feb 2024 14:45:01 GMT

Hope the video of it is posted here, would be awesome.

Best,

Andy

Re: R82 – Install ElasticXL Cluster

_Val_ — Tue, 20 Feb 2024 12:30:38 GMT

Aren't you coming to Vegas?

Re: R82 – Install ElasticXL Cluster

the_rock — Tue, 20 Feb 2024 13:16:22 GMT

No buddy, not coming.

Best,

Andy

Re: R82 – Install ElasticXL Cluster

RamGuy239 — Wed, 21 Feb 2024 12:22:31 GMT

This is going to remove the need for 3 IP addresses per subnet I suppose? No need for 1x IP per cluster members + 1x VIP? This will make it very attractive for remote locations with restricted access to WAN subnets larger than /30 address space.

Does it have to run in active-active mode? I understand why active-active might be ideal for throughput, but there might be scenarios where you'd want it to be active-standby to have less complexity, and to avoid having the orchestration of traffic. When deploying virtual, like on "private cloud" solutions such as VMware ESXi, Nutanix AHV, etc. If both members are running on the same host, there isn't much benefit to have both members active at the same time.

ElasticXL seems like a no-brainer compared to clusterXL, both for HA and for Load Sharing. Have to see if there is any known limitations, and most customers will avoid using new technology for some time. But this all sounds like a great solution over clusterXL to me.

Re: R82 – Install ElasticXL Cluster

Oliver_Fink — Thu, 22 Feb 2024 09:55:09 GMT

And it was a really good presentation. Thanks for that.

Re: R82 – Install ElasticXL Cluster

HeikoAnkenbrand — Sat, 24 Feb 2024 13:24:57 GMT

@RamGuy239

CUT>>>

<<<CUT

We are talking about a connection HA. This means that it is not a gateway HA or LS.
The advantage is that in the event of a hardware error, the connections are distributed to the remaining gateways.

PS:
VMWare is currently not supported.

Re: R82 – Install ElasticXL Cluster

PhoneBoy — Fri, 01 Mar 2024 21:17:33 GMT

Videos of CPX sessions will be posted after Las Vegas next week.
I can assure you we will also cover this topic in future CheckMates sessions 🙂

Re: R82 – Install ElasticXL Cluster

RamGuy239 — Fri, 08 Mar 2024 16:36:13 GMT

@HeikoAnkenbrand

ElasticXL and VSnext (requires ElasticXL) is not supported on VMware ESXi? I guess this means hypervisors in general? Is this from a support point-of-view, meaning it won't be officially supported by Check Point, thus no help from TAC, or won't it work as a result of something in the current R82 software is simply not compatible with VMware and/or other hypervisors?

Asking because I have access to R82 EA and was going to play with it in on my home network (VMware ESXi 8.0) and LAB at work (also VMware ESXi 8.0). But my biggest attraction towards R82 is all related to ElasticXL, and some VSnext. So I won't waste my time if it's not supposed to work at all.