topic Re: bringing new appliances into a cluster in Firewall and Security Management

bringing new appliances into a cluster

Daniel_Kavan — Fri, 31 Jan 2025 14:58:33 GMT

Hi mates,

We have a cluster of 6900s and we are bringing in 9300s to replace them. My understanding is to just add the 9300s into the existing cluster, fail over then remove/delete the older 6900s. Does everyone agree that's the best approach? Instead of sync cable, I'm planning on either using a run of the mill hub or a few switch ports. I assume its ok to have a mix of 6900s and 9300s for a small amout of time the active node may be a 6900 and the standby running on a 9300.

Re: bringing new appliances into a cluster

the_rock — Fri, 31 Jan 2025 15:08:43 GMT

I always follow below process for that and never an issue.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Replace-Upgrade-Cluster/m-p/157228#M27268

Re: bringing new appliances into a cluster

Daniel_Kavan — Mon, 03 Feb 2025 14:25:43 GMT

Yes, that's one way.

I kind of like bringing in a 3rd cluster member better, just so the working HA is still there.

Re: bringing new appliances into a cluster

the_rock — Mon, 03 Feb 2025 14:29:27 GMT

I believe same process would apply, except you are simply adding another member.

Andy

Re: bringing new appliances into a cluster

Daniel_Kavan — Mon, 03 Feb 2025 14:32:27 GMT

Yeah, except for using a sync cable you'd need a standard hub or switch ports.

Re: bringing new appliances into a cluster

the_rock — Mon, 03 Feb 2025 14:37:32 GMT

Ah, yes, thats true.

Andy

Re: bringing new appliances into a cluster

Bob_Zimmerman — Mon, 03 Feb 2025 21:33:53 GMT

Last I checked, Check Point does not support clusters with different member hardware for any length of time, no matter how small. The official answer is you MUST take an outage to swap.

That said, this is one of the combinations which could actually work, since the 6900 uses an i9-9900KF (8c16t) and the 9300 uses an i5-13400E (10c16t), so the OS sees 16 cores on both. Both run 14 workers by default. The big concern is the 9300 wants to have UPPAK enabled, while the 6900 does not. I'm not 100% sure that configuration can successfully sync.