topic Re: FULL HA cluster support in Firewall and Security Management

FULL HA cluster support

Martin_Raska — Fri, 28 Feb 2020 10:17:34 GMT

Hello mates,

Question:

Is FULL HA Cluster supported on vmware? This sk60443 says yes. Installation a Upgrade guide R80.40 says only CP appliances, page 134.

Re: FULL HA cluster support

G_W_Albrecht — Fri, 28 Feb 2020 11:57:44 GMT

You did not read sk60443 correctly: These guidelines apply to all Check Point appliances running on Gaia OS / SecurePlatform OS, as well as Virtual Appliances running vSEC Virtual Edition on Gaia OS
(Note: this article does not apply to vSEC for Amazon Web Services, vSEC for Microsoft Azure, vSEC for Google Cloud Platform, vSEC for VMware NSX, vSEC for VMware vCloud Air, vSEC for Cisco ACI, vSEC for OpenStack).

Historically, this had never been supported on OpenServer at all, only on (also virtual) appliances.

But i would put my answer like this: On VMWare, Full HA Cluster does make no sense at all !

Gateway clustering = Cluster XL HA should be used
SMS on VM is easily cloned, different ways of backup are possible, so we do not need Management HA in most cases we could think of
Full HA is the solution with many features for less money very often giving big trouble 😞
So out of long experience, i always have suggested to keep the hands from fool management haha...

Re: FULL HA cluster support

Martin_Raska — Fri, 28 Feb 2020 12:27:44 GMT

I read it many times but admin guide says different. It makes sense, the answer is as always money, therefore you have to build FULL HA without separate management. That's it.

Re: FULL HA cluster support

G_W_Albrecht — Fri, 28 Feb 2020 13:09:26 GMT

Which Admin Guide says differently ? The sk39345 (from 03-Okt-2019) says:

Additional restrictions for ClusterXL Full High Availability configuration:

Supported only between appliances with the identical Operating Systems (cluster requirement).

Again: For me it makes no sense to have two small appliances with NPM licenses in Fool HA configuration - it turned to be a PITA much too often...

Re: FULL HA cluster support

PhoneBoy — Sat, 29 Feb 2020 04:23:54 GMT

This has only ever been supported on physical Check Point appliances, not VMs.
At least as far as I know.
Clearly the SK needs to be updated if for no other reason than to remove the references to vSEC. 😬
Will ask them to clarify this point and update.

Re: FULL HA cluster support

HeikoAnkenbrand — Sat, 29 Feb 2020 21:40:23 GMT

There are several ways to install a ClusterXL for R80.30 or R80.40:

Open Server and Appliance:

- sk144293 - Check Point R80.30 or sk160736 - Check Point R80.40

CloudGuard Virtual Edition (VE) OpenStack, KVM, ESXi

- sk158292 - CloudGuard for Private Cloud images

CloudGuard for VMware NSX

- sk114518: CloudGuard for NSX

Re: FULL HA cluster support

Martin_Raska — Mon, 02 Mar 2020 08:18:49 GMT

PhoneBoy
"Will ask them to clarify this point and update."

please do.

and others stop flame, my question was not about ClusterXL active/passive, but about FULL HA standalone cluster and what is /not supported.

Re: FULL HA cluster support

G_W_Albrecht — Mon, 02 Mar 2020 11:20:12 GMT

I did not notice any flaming here, neither in mine nor someone elses posts, and at least my posts were about fool mgmt ha only 8) - can you please elaborate your last sentence ?

Re: FULL HA cluster support

Martin_Raska — Mon, 02 Mar 2020 11:42:35 GMT

Guys, I am not new to CP, I know this solution very well, I don't like it either but the project will be FULL HA standalone setup or different vendor. That's it. I don't need a lection about this solution, I just need correct if it's supported on vmware nothing more.

Thanks

Re: FULL HA cluster support

PhoneBoy — Mon, 02 Mar 2020 16:30:08 GMT

Not to fan any flames here, but is the decision to do Full HA a function of cost (i.e. separate management requires another license) versus functionality?

Re: FULL HA cluster support

Uri_Lewitus — Tue, 03 Mar 2020 07:30:37 GMT

Hi Martin

Where in the SK does it state that VMWare is supported for SA? Couldn't find such a statement - can you please point it out.

Thanks

Uri

Re: FULL HA cluster support

Wolfgang — Tue, 03 Mar 2020 07:57:18 GMT

Martin,

we too had this requirements from one of our customers end of last year and answer from local Check Point team was "It's not supported with VMware" only CheckkPoint appliances.

Wolfgang

Re: FULL HA cluster support

Martin_Raska — Tue, 03 Mar 2020 08:25:37 GMT

the second sentence says:

These guidelines apply to all Check Point appliances running on Gaia OS / SecurePlatform OS,
as well as Virtual Appliances running vSEC Virtual Edition on Gaia OS

from how I understand its vSEC=CloudGuard=virtual appliance

Re: FULL HA cluster support

Uri_Lewitus — Tue, 03 Mar 2020 08:31:45 GMT

Thanks Martin

I see - however vSEC is a different product and by definition does not support FULL HA, it is not VMWare ESX

Will ask the SK team to clarify

Re: FULL HA cluster support

Ronen_Zel — Tue, 10 Mar 2020 09:51:13 GMT

I am happy to say that based on this feedback sk60443 is now updated. Thanks for bringing this to our attention.

Re: FULL HA cluster support

PhoneBoy — Tue, 10 Mar 2020 19:09:28 GMT

We've updated sk60443 so it is clear this is only supported on physical Check Point appliances.
It is not supported on Open servers or virtualized appliances at all.

Re: FULL HA cluster support

James_Lim — Wed, 28 Oct 2020 05:03:21 GMT

Quick question.

Is Active-Active Cluster XL FW supported in Full HA Setup in r80.40?

While Management Components still remain active/standby.

Re: FULL HA cluster support

G_W_Albrecht — Wed, 28 Oct 2020 08:48:14 GMT

NO: See sk101539 - ClusterXL Load Sharing mode limitations and important notes !

Re: FULL HA cluster support

Ian_Cresswell — Tue, 14 Dec 2021 14:34:44 GMT

If HA is not available in the Virtual world what is recommended for virtual gateways running on ESX?

If we have two ESX servers with the gateway on one of them, if that ESX server blows up how are the services transitioned to the other ESX server?

Re: FULL HA cluster support

Martin_Raska — Tue, 14 Dec 2021 15:22:47 GMT

HA is supported, what is not is FULL HA = Standalone HA cluster