topic configure clusterXL HA in General Topics

configure clusterXL HA

tng_aik_hong — Thu, 07 Mar 2019 05:34:39 GMT

Hi all,

i'm intending to install 2 vm checkpoint r80.10 to perform clusterxl HA i'm able to login to the primary checkpoint

In the main checkpoint, i have allow any any policy rules for testing but it seem i cant ping my other checkpoint device.

both checkpoint, i have sucessfully installed the license

the primary checkpoint installed security mangement server and sercurity gateway, another checkpoint installed with security gateway only

im able to login to the smartconsole for the primary checkpoint but not with other checkpoint devices

how do i configure a clusterXL with primary device with 3 interface?

Re: configure clusterXL HA

Wolfgang — Fri, 21 Jun 2019 09:01:41 GMT

You have to understand Check Points management topology. The SMS (SecurityManagementServer) is the instance to manage all gateways. You run this once and this can be running on a gateway or on a separate server. With ClusterXL it is better to have this separate. An environment like this is called distrubuted configuration. You have to install three VMs, two with gateway only for your ClusterXL and another one with the SMS only. You can't login with SmartConsole to your gateways, only to SMS You have to create the cluster via SmartConsole, initiating SIC with the gateways and add these gateways as members to the Cluster.

Please have look at https://community.checkpoint.com/thread/9695-welcome-to-check-point-for-beginners At the beginning there is a really good description about Check Points architecture.

Wolfgang

Re: configure clusterXL HA

HeikoAnkenbrand — Thu, 07 Mar 2019 06:54:55 GMT

First step, check the layer 2 connection.

Ping the ClusterXL gateway interface and let you show the arp entry:

# ping <gateway ip>

# arp -an | grep <gateway ip>

If you see a arp entry , the vmware layer 2 infrastructure is ok.

Second step. If layer 2 is ok, check layer 3.

Disable the policy on the gateway:

# fw unloadlocal

Now ping the gateway interface IP

# ping <gateway ip>

Re: configure clusterXL HA

HeikoAnkenbrand — Thu, 07 Mar 2019 07:01:34 GMT

Tip:

4GB of RAM doesn't meet the minimum requirements for R80.10 management.

6GB of RAM is considered the bare minimum, more is better.

And 4 GB of RAM for the gateway.