topic Re: Cluster XL active & standby using VIP access destination ip in General Topics

Cluster XL active & standby using VIP access destination ip

oscar790806 — Tue, 14 Mar 2023 05:56:55 GMT

Hi guys

I found something strange , When active & standby access syslog server , it using VIP access destination , How to solve this problem ?

I try to " fw ctl set int fwha_forw_packet_to_not_active 1 " command , but invalid

actvie ip 192.168.69.1 , standby ip 192.168.69.2 , vip 192.168.69.254

Re: Cluster XL active & standby using VIP access destination ip

PhoneBoy — Tue, 14 Mar 2023 14:07:05 GMT

What version/JHF?
That command won't prevent the cluster fold NAT.
Instead, see: https://support.checkpoint.com/results/sk/sk34180

Re: Cluster XL active & standby using VIP access destination ip

the_rock — Tue, 14 Mar 2023 14:16:07 GMT

That command should definitely work, what version are you on?

Andy

Re: Cluster XL active & standby using VIP access destination ip

oscar790806 — Wed, 15 Mar 2023 15:54:56 GMT

Device version is R80.40 take 255

I give it a try https://support.checkpoint.com/results/sk/sk34180

Thanks!

Re: Cluster XL active & standby using VIP access destination ip

oscar790806 — Wed, 15 Mar 2023 15:55:31 GMT

R80.40 take 255

Re: Cluster XL active & standby using VIP access destination ip

the_rock — Wed, 15 Mar 2023 16:07:21 GMT

What is the error you get?

Re: Cluster XL active & standby using VIP access destination ip

the_rock — Wed, 15 Mar 2023 16:39:48 GMT

My R81.20 lab fw:

[Expert@quantum-firewall:0]# fw ctl set int fwha_forw_packet_to_not_active 1
[Expert@quantum-firewall:0]# fw ctl set -f int fwha_forw_packet_to_not_active 1
"fwkern.conf" was updated successfully
[Expert@quantum-firewall:0]# more /opt/CPsuite-R81.20/fw1/boot/modules/fwkern.conf
fw_allow_simultaneous_ping=1
fw_clamp_vpn_mss=1200
fwha_forw_packet_to_not_active=1
[Expert@quantum-firewall:0]#

Re: Cluster XL active & standby using VIP access destination ip

JozkoMrkvicka — Wed, 15 Mar 2023 17:33:26 GMT

One of option is to construct manual "no-NAT" rules at the top of the NAT Rule Base for connections from each cluster member to server(s), for the specific service. Manual NAT rules use the IP address of the cluster member that is configured in the Cluster Member property page of the cluster object. If the traffic is going out of a network interface with an address that is not the address in the Cluster Member property page, then create a Host object with the IP address of the cluster member's interface to use in the "no-NAT" rule.

For more options, refer to sk31832.