topic Re: Question about Sync Interface Routing in Check Point Cluster in Firewall and Security Management

Question about Sync Interface Routing in Check Point Cluster

Solitude — Fri, 22 Aug 2025 09:23:28 GMT

Hello team,

I'm new with Checkpoint, and I have a question about the feature in Cluster, hope you can help me answer.

I would like to ask about the possibility of routing through the Sync interface in a Check Point Cluster running in Active-Active mode.

Is there any feature in the cluster_XL that allows data traffic to be transferred via the Sync port between the two appliances?

For example, in the case below:

If the two uplinks (marked with red X) are down, can the host on the lower side still reach the Internet by rerouting traffic through the Sync interface between the two firewalls?

I'm tried to search for a solution but still no luck.

Best Regards.

Re: Question about Sync Interface Routing in Check Point Cluster

Danny — Fri, 22 Aug 2025 09:38:00 GMT

Rerouting traffic is not required if a cluster member fails.
The host always talks to the Virtual Cluster IP (VIP) 192.168.1.1.

Re: Question about Sync Interface Routing in Check Point Cluster

Solitude — Fri, 22 Aug 2025 10:04:52 GMT

I’m aware of the Virtual IP mechanism but If LAN2 goes down (On the right), is there any way for users to still reach the Internet via the Sync interface (the cluster sync link) as a fallback path?

Re: Question about Sync Interface Routing in Check Point Cluster

Chris_Atkinson — Fri, 22 Aug 2025 10:19:23 GMT

The topology is not valid, all segments should have a VIP hence this shouldn't be a requirement.

In your example the healthiest member will be active-attention.

Utilize bonds for link protection where needed.

Re: Question about Sync Interface Routing in Check Point Cluster

emmap — Mon, 25 Aug 2025 02:41:04 GMT

There is no mechanism to allow data traffic to traverse the Sync link. This is by design to isolate critical sync traffic from the rest of the network and to eliminate a possible bottleneck on that link.