topic Re: ClusterXL SG Bridge Mode Connection in Firewall and Security Management

ClusterXL SG Bridge Mode Connection

CyberBreaker — Tue, 25 Feb 2020 04:41:06 GMT

Hi Guys,

I have 2 new security gateways in VSX bridge mode in clusterXL, these security gateways are connected to a stacked switch (1 gateway to 1 switch physical connection). My concern is that since the gateways are not running in L3 mode, the stacked switch is not pointing to a VIP to route the traffic and it is prone that the switch will pass the traffic to the standby firewall hence it will drop the traffic.

Is this how the CP behaves or are there any ways to prevent it?

Thank you very much.

Re: ClusterXL SG Bridge Mode Connection

Maarten_Sjouw — Tue, 25 Feb 2020 06:06:50 GMT

With VSX only 1 gateway is handling the specific VS, so there will not be any information on the other switch about MAC addresses on the other side of the bridge.

Re: ClusterXL SG Bridge Mode Connection

CyberBreaker — Tue, 25 Feb 2020 07:49:48 GMT

Hi @Maarten_Sjouw ,

I understand that part but still I am still confused since the switch that is connecting to the gateways is a stacked switch both of the switch is in active/active and each switch is connected to a security gateway (1 switch to 1 gateway physical connection).

In this scenario, there will be a possibility that the switch will send the traffic to the gateway which is the standby.

Let us say the active firewall for my VS1 is FW01 and FW02 is the standby, my stacked switch which has a physical connection of 1 switch to 1 gateway and both of my switch forwarding traffic, there is now a possibility that my FW02 can receive traffic but FW02 is the standby state.

Thank you for the help.

Re: ClusterXL SG Bridge Mode Connection

Maarten_Sjouw — Tue, 25 Feb 2020 08:15:02 GMT

Each switch builds its MAC table per port. When the VS is not active on member 2 it will not tell Switch2 any MAC addresses. So again Switch2 does not know about these addresses and will not forward anything for those addresses to your FW02.

Re: ClusterXL SG Bridge Mode Connection

CyberBreaker — Tue, 25 Feb 2020 08:37:33 GMT

Hi @Maarten_Sjouw

Thanks for the clarification about that, so this is also applicable for modes of deployment either L3 or bridge mode?

Thanks

Re: ClusterXL SG Bridge Mode Connection

Maarten_Sjouw — Tue, 25 Feb 2020 09:22:28 GMT

Also in L3 the VS is only active on 1 of the 2 FW's not on the other.

Re: ClusterXL SG Bridge Mode Connection

CyberBreaker — Tue, 25 Feb 2020 09:24:59 GMT

Hi @Maarten_Sjouw ,

But it should be the same if in bridge mode right?

A VS can be active in only 1 FW in ClusterXL?

Thanks

Re: ClusterXL SG Bridge Mode Connection

Maarten_Sjouw — Tue, 25 Feb 2020 09:28:32 GMT

As I already said a VS can only be active on 1 FW it will not do anything on the other FW except for keeping the connection table up to date.
It is not active in either mode on the Backup FW.