topic Re: New Check Point Manager implementation. in Firewall and Security Management

New Check Point Manager implementation.

surajshinde — Mon, 12 Jul 2021 09:08:11 GMT

Dear Team,

We have purchased new VM based check point Manager to achieve CP management server redundancy . Currently we have one CP Manager in production at one location (Mumbai City , in Maharashtra State) whereas we want to place or new CP Manager in another location(Chennai City, TamilNadu State).

How we can achieve this?

Current CP Manager manages around 20 GWs and connect with it ILL.

Please suggest best.

Re: New Check Point Manager implementation.

Ruan_Kotze — Mon, 12 Jul 2021 10:33:19 GMT

The management HA documentation would be a good starting point.

This video also gives a nice overview.

Re: New Check Point Manager implementation.

surajshinde — Mon, 12 Jul 2021 11:09:53 GMT

Thank you Ruan_Kotze,

Both CP Managers are different location and different subnet.

Re: New Check Point Manager implementation.

_Val_ — Mon, 12 Jul 2021 11:15:18 GMT

It does not matter. Make sure the connectivity between them works, follow the documentation above.

Re: New Check Point Manager implementation.

genisis__ — Mon, 12 Jul 2021 12:07:27 GMT

I would also add, ensure there is enough bandwidth and the latency not high.

Re: New Check Point Manager implementation.

_Val_ — Mon, 12 Jul 2021 12:15:58 GMT

Not critical, but nice to have.

Re: New Check Point Manager implementation.

genisis__ — Mon, 12 Jul 2021 12:21:56 GMT

Agreed.

Re: New Check Point Manager implementation.

PhoneBoy — Mon, 12 Jul 2021 15:57:43 GMT

Worth noting a couple things: Management HA requires a second management license and Management HA is no substitute for proper backups.
Provided you’ve taken appropriate backups, you can rebuild your management server if necessary.

See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902&partition=Basic&product=All
And: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk156072&partition=Basic&product=Multi-Domain

Re: New Check Point Manager implementation.

surajshinde — Fri, 23 Jul 2021 04:07:29 GMT

Thank you All. It works fine.

But one challenge i am facing, We have test failover and when primary Check Point Manager down in that case we need to manual Active secondary Check Point manager then it act with read/write permission.

Once primary came UP in that case both act as Active-Active. Is there any way to do this automatic.

Re: New Check Point Manager implementation.

genisis__ — Sat, 24 Jul 2021 10:24:38 GMT

I think what you talking about is when you get a collision message, in this case you have to do a full sync manually ie. from Secondary to Primary (assuming the secondary was made active, and you have actually made changes).

Re: New Check Point Manager implementation.

surajshinde — Mon, 26 Jul 2021 10:50:22 GMT

Is there any way to achieve automatic switch the mode Active to standby and Standby to Active between both Manager.

Re: New Check Point Manager implementation.

PhoneBoy — Mon, 26 Jul 2021 17:31:06 GMT

By design, failover for Management HA is designed to be a manual process.
It's not like ClusterXL where failover happens automatically.