topic Re: Cluster Member Status in General Topics

Cluster Member Status

Sanjay_S — Sat, 01 May 2021 08:16:09 GMT

Hi All,

We have 4 cluster members, can we make the cluster member status as Active, Standby, Backup, Backup? Is this achievable?

Regards,

Sanjay S

Re: Cluster Member Status

genisis__ — Sat, 01 May 2021 11:03:04 GMT

Not dealt with many clusters with more then two nodes, but using ClusterXL I believe the states are Active/Standby only. In order to define the failover order you would then set the priority order in SmartConsole > Cluster Object > Cluster Members

Re: Cluster Member Status

the_rock — Sat, 01 May 2021 19:17:12 GMT

Im 99.99% sure its ONLY active/standby, but maybe someone from R&D can confirm 100% : )

Re: Cluster Member Status

genisis__ — Sun, 02 May 2021 08:57:53 GMT

I believe Active/Standby/Backup applied to VSX and perhaps VRRP.

Re: Cluster Member Status

PhoneBoy — Sun, 02 May 2021 17:20:19 GMT

Applies to VSX only.
VRRP is just specific priorities (highest one is active).

I think a more important question is: why?
What is it you’re trying to achieve with a four member cluster?
Surely it’s possible to do, but it seems like an awful lot of excess hardware for only a minimal gain in redundancy.
And if what you’re trying to do is a four member cluster across two sites, there are a lot of other issues you need to address.

Re: Cluster Member Status

Lari_Luoma — Sun, 02 May 2021 18:58:14 GMT

With VSLS yes, in SGW mode no.

Re: Cluster Member Status

Sanjay_S — Mon, 03 May 2021 09:42:51 GMT

Hi PhoneBoy,

We have 2 sites and placing 2 firewalls in each location and clustering all 4 of them. We need to prefer the 1st site to be active and only when both the firewalls in 1st has issues then the traffic should fail to 2nd site.

Re: Cluster Member Status

genisis__ — Mon, 03 May 2021 10:01:34 GMT

This does sounds like my original suggestion of priorities, assuming standard gateway cluster.

Re: Cluster Member Status

PhoneBoy — Mon, 03 May 2021 15:29:07 GMT

Remember that clustering assumes there are multiple shared Layer 2 segments between all the gateways with the same IP address space, particularly on the Internet side of the equation.
Between sites, this is rarely the case.
You need a clear picture of the entire network to understand what all the various traffic flows are and what it will actually take for a failover to occur.
Most likely, a four node cluster is NOT the solution in this case.

Re: Cluster Member Status

Lari_Luoma — Mon, 03 May 2021 18:29:09 GMT

To complement PhoneBoy’s answer there is a clustering solution that could work in this case. It’s Check Point Maestro. With Maestro you can have several gateways active on one site and standby on another.

Re: Cluster Member Status

Vladimir — Tue, 04 May 2021 02:34:09 GMT

For the love of everything, do not do it 🙂 IMHO, better to invest time in the configuration of the routing failover between sites and have an HA cluster in each site.

Re: Cluster Member Status

genisis__ — Tue, 04 May 2021 08:10:37 GMT

I agree, and in fact we are going to two of the gateways from the cluster as there is no benefit. I would just have the servers sitting in the rack as cold standbys if anything.

As Vlad has rightly said below, it would be better to have two separate HA cluster, at least you would then have utilisation of two of the nodes.

Re: Cluster Member Status

genisis__ — Wed, 05 May 2021 16:36:23 GMT

I was thinking about that as well, but ultimately it may not be a cost viable solution, but its certainly a good option, technically.