https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/66234#M5046 <P>Thanks for the response.</P><P>Can I just clarify where you said there is no tracking mechanism, that you're referring to both 80.10 and 80.30 and not just 80.10 which I'm running now?</P> Wed, 30 Oct 2019 12:01:23 GMT ken_networks 2019-10-30T12:01:23Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65683#M5011 <P>Standalone Full HA deployment currently running 80.10 but soon to be upgraded to 80.30 before the gateways are deployed into Production.</P><P>Looking to find out how to configure the gateways to failover to the backup gateway if the following conditions occur:</P><P>1.&nbsp; WAN or LAN interface go down</P><P>2.&nbsp; If the WAN or LAN interface remain up but a switch or upstream/downstream device fails which effectively result in the gateway being able to access the internet or internal network; the gateway fails over to the backup</P><P>Thanks&nbsp;</P> Wed, 23 Oct 2019 15:12:28 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65683#M5011 ken_networks 2019-10-23T15:12:28Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65694#M5012 1 works by default on cluster interfaces. <BR />2 is not possible, there is no tracking to see if a nexthop or beyond is available or not. Wed, 23 Oct 2019 17:12:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65694#M5012 Maarten_Sjouw 2019-10-23T17:12:06Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65713#M5013 <P>My 2 cents regarding point 2: Any important up- or downstream device that is not directly connected to the firewall should itself be clustered. Also, since both nodes are connected to the same vlans, a failure further up- or downstream cant be solved by switching to the backup member.<BR /><BR />In my experience distributed setups generally work better than standalone full HA deployments, have you consided migrating the management to a seperate server?<BR /><BR />Edit: I've found a way to implement this using sk35780 and the clusterXL_monitor_ips script</P> Wed, 30 Oct 2019 17:39:51 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/65713#M5013 Benedikt_Weissl 2019-10-30T17:39:51Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/66234#M5046 <P>Thanks for the response.</P><P>Can I just clarify where you said there is no tracking mechanism, that you're referring to both 80.10 and 80.30 and not just 80.10 which I'm running now?</P> Wed, 30 Oct 2019 12:01:23 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/66234#M5046 ken_networks 2019-10-30T12:01:23Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/66236#M5047 Tracking is, to my knowledge, not on the scope of Check Point.<BR />I have not heard of any plans or requests on implementation of tracking. Wed, 30 Oct 2019 12:08:40 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/How-to-configure-gateway-failover-if-interface-goes-down/m-p/66236#M5047 Maarten_Sjouw 2019-10-30T12:08:40Z