topic Re: Creating an HA cluster with multiple gateways in Firewall and Security Management

Creating an HA cluster with multiple gateways

JayTee-Hove — Tue, 28 Jan 2020 23:05:03 GMT

Good Day

I have a customer who is doing a hardware refresher by replacing two 4800s with four 6500 turbos and requires a new HA cluster configuration with 4 gateways in active/standby. Two of the gateways will be in a remote location. What I am gathering is that the customer will need to extend the current VLAN where existing gateways are. Could someone kindly guide me on how to set this up? I have only configured a two gateway cluster before.

Re: Creating an HA cluster with multiple gateways

mdjmcnally — Wed, 29 Jan 2020 07:33:35 GMT

You are going to need R80.40 for more then 2 Gateways in High Availability.

The new Active-Active Mode that allows to run on different IP for each location apparently is limited to 1 Member per location, so don't believe is going to work for you.

In terms of spanning the VLANs then

A) need a Layer 2 connectivity from a provider between the two locations, which will allow the spanning of the VLAN.

B) Possibly use Network Equipment to do this yourself but configuration going to be vendor specific.

Neither of these involves any configuration on the Check Point side.

Check Point installation no different to other ClusterXL installations, during the wizard simply repeat for all Cluster Members based on what is in the Installation Guide for R80.40

Re: Creating an HA cluster with multiple gateways

Chris_Atkinson — Wed, 29 Jan 2020 07:49:49 GMT

Per the Cluster XL admin guide:

The configuration is similar if you're opting for a stretched Layer-2 design.
Attention should be paid to the configured gateway priorities:

Re: Creating an HA cluster with multiple gateways

JayTee-Hove — Thu, 30 Jan 2020 11:56:40 GMT

So in this configuration, if there is only one cluster then that means only one gateway will be active and the rest will be on standby?