topic Setup Cluster HA with 1 WAN IP in General Topics

Setup Cluster HA with 1 WAN IP

NicolaiNielsen — Thu, 27 May 2021 12:17:49 GMT

Hi All,

I'm new to Checkpoint and I've been trying to learn how to setup.
I'm trying to setup a Cluster for High Availability, but I can't seem to find definite proof that my topoligy is possible with how Checkpoint works.

Is it possible to have the same single WAN IP on the WAN interface of both the Firewalls?
Or do I need to make VIP on the WAN interfaces as well?

I only have 1 WAN IP from my ISP.

The IP addresses on the picture attached is purely fantasy. Not my real ones.

Kind Regards,

Nicolai

Re: Setup Cluster HA with 1 WAN IP

_Val_ — Thu, 27 May 2021 12:55:38 GMT

Yes you can use a cluster with VIP being on a different IP network than the actual physical interfaces.

Download ClusterXL Admin guide for your version and look for "Cluster IP Addresses on Different Subnets" part in it for details.

Re: Setup Cluster HA with 1 WAN IP

NicolaiNielsen — Fri, 28 May 2021 12:48:13 GMT

Hi Val,

I have looked at that, but the VIP needs to be pushed from MGMT server.
But the MGMT server is externally.
As the Firewalls doesn't have internet access until the VIP is configured, then I cannot push the VIP from MGMT server?
It's contradicting.

Kind Regards,

Nicolai

Re: Setup Cluster HA with 1 WAN IP

Wolfgang — Fri, 28 May 2021 13:28:26 GMT

Your management must reach both gateways, via internal or external interfaces. If not you can't install policy.

That's a limititation if you use private IPs on different subnet for the physical cluster interfaces.

Have a look at Configuring Cluster Addresses on Different Subnets section 4. important notes:

It is not possible to manage over the Internet the Cluster when IP addresses Addresses of its members and the VIP address are configured on different subnets.
In such configuration, the IP addresses of cluster members are supposed to be configured with private IP addresses (RFC 1918), and only one Cluster VIP address is supposed to be public.
Private IP addresses (RFC 1918) are not allowed over the Internet.
As a result, communication from the external Management Server to the private IP addresses of the physical cluster members will not be possible over the Internet for services such as SIC.

Re: Setup Cluster HA with 1 WAN IP

_Val_ — Mon, 31 May 2021 08:02:33 GMT

@NicolaiNielsen, what he says👆🏻

Re: Setup Cluster HA with 1 WAN IP

NicolaiNielsen — Mon, 31 May 2021 10:00:11 GMT

Hi Wolfgang and Val,

Thanks for the answer.

Because of the limitations, I will make a note that either plan with having the MGMT server internally behind the cluster and/or if the MGMT is externally, I will need at least 3 WAN IP's on the remote site.

Re: Setup Cluster HA with 1 WAN IP

max71 — Fri, 24 Mar 2023 10:51:00 GMT

Hi Wolfgang, i'm reading in detail the doc as you mention, in external ip address of both chk members i put 10.80.100.1 and 10.80.100.2 end as VIP my public ip address.

The main problem is that as soon as i try to reach internet seems that the checkpoint do not perform a correct match from internal to external network ...

if i put 3 public ip address without change the config everithing working correctly.

have you some suggest for me to solve my issues ?

Re: Setup Cluster HA with 1 WAN IP

PhoneBoy — Fri, 24 Mar 2023 19:51:09 GMT

Interestingly enough, in R82, this limitation should be removed when ElasticXL is implemented and all communication happens through an SMO.