topic Re: Geo Active-active Datacenter firewall architecture in Firewall and Security Management

Geo Active-active Datacenter firewall architecture

ndcosta — Thu, 01 Aug 2019 13:23:16 GMT

Hi guys,

We are checkpoint costumer. Currently we have two VSX clusters in two geographic locations with production and disaster recovery site.

In near future we will change this to active-active architecture streching the network in both geographies using Cisco ACI with VxLAN.

Can you please advise us with the best scenario for firewall?

Do we need two clusters?

Can we have firewall instance in both geographies for the same networking "zone".

Regards,

Nuno

Re: Geo Active-active Datacenter firewall architecture

HeikoAnkenbrand — Thu, 01 Aug 2019 20:32:34 GMT

If you are using a VSX Cluster with gateways at two locations, you must comply with the following ClusterXL parameters:

- maximum sync / CCP packet delay: 100 ms

- maximum sync / CCP packet lost: 0.2%

- Layer 2 connection between the locations

Re: Geo Active-active Datacenter firewall architecture

Wolfgang — Fri, 02 Aug 2019 05:56:38 GMT

Nuno,

please note the requirements mentioned by Heiko.

If you can use VSLS ( Virtual System Load Sharing) with your VSX you can build a VSX cluster with 4 nodes, two in every location. With VSLS you can distribute your virtual system beetween all nodes. As an example you have 4 VS, you can run one VS on every node in your VSX-cluster.

VSLS can't be used if you are using a virtual-router in your environment.

best regards

Wolfgang

Re: Geo Active-active Datacenter firewall architecture

ndcosta — Fri, 02 Aug 2019 08:48:02 GMT

Hi everyone, Thank you for sharing your knowledge! Regarding the number os nodes, do we have limitations for VSLS Cluster? Can we have dynamic routing active with this scenario? best regards, Nuno