topic Re: Check Point 1600 ClusterXL with only public IP addresses in General Topics

Check Point 1600 ClusterXL with only public IP addresses

ikafka — Fri, 05 May 2023 12:24:42 GMT

Hi community;

I want to cluster 2 1600 series devices, but I only have one public ip address. Solution proposed with this sk: https://support.checkpoint.com/results/sk/sk32073

Does this solution apply to the 1600 series?

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Fri, 05 May 2023 12:36:59 GMT

Based on the sk, it is possible, BUT, note below notice.

Andy

Below is what you need to follow:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ClusterXL_AdminGuide/Content/Topics-CXLG/Configuring-cluster-addresses-on-different-subnets.htm?Highlight=Configuring%20Static%20Routes%20on%20the%20Members

Re: Check Point 1600 ClusterXL with only public IP addresses

ikafka — Fri, 05 May 2023 13:02:08 GMT

Thanks the_rock

Ok, I will check and read my device version. I just wanted to know It is possible. thanks for your answer.

regards.

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Fri, 05 May 2023 13:10:16 GMT

No worries. Process is almost the same as back in R55 days, honestly, not much has changes as far as things you need to do.

Andy

Re: Check Point 1600 ClusterXL with only public IP addresses

ikafka — Mon, 29 May 2023 07:43:59 GMT

Hi @the_rock

I have complated configuration but I hava a few quation.

This picture my HA configuration.

I did configuration for internet-1 and internet-2 as int the picture and other local networks. Different services are running on public ip addresses and there NAT rules.bIs best practise right this configuration?

Can I make my configuration better because sometimes my NAT sevices are not working properly.

Q1: Are the primary and secondary ip addresses to be used for internet interfaces public or private in accordance with best practice? I preferred to use 10.x.x.x.x.

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Mon, 29 May 2023 11:17:23 GMT

Well, you just have to make sure that NAT and routing are correct as per articles we provided. If you follow whats in there, it will work, for sure.

Andy

Re: Check Point 1600 ClusterXL with only public IP addresses

ikafka — Mon, 29 May 2023 13:05:26 GMT

Ok thnaks. My NAT and Route ryles are working, no problem now. But I cannot select ISP (internet ip) for Remote Access. For example: I want to use 212.x.x.x ip address for remote access. Is there ip selection on these device (quantum spark 1600)? I could not find admin guide.

Admin Guide link: https://sc1.checkpoint.com/documents/SMB_R81.10.05/Help/Locally_Managed/EN/Content/Topics/Configuring-Remote-Access-Blade.htm?tocpath=Managing%20VPN%7C_____1

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Mon, 29 May 2023 13:11:29 GMT

Not that Im aware of on locally managed SMB appliances. You may want to confirm with TAC, but I will spin up demo soon and verify myself as well.

Andy

Re: Check Point 1600 ClusterXL with only public IP addresses

ikafka — Mon, 29 May 2023 13:19:05 GMT

Ok @the_rock thanks. I will be waiting your answer if you verify on demo.

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Mon, 29 May 2023 13:21:58 GMT

I just spun up quick demo (takes 5 mins from support site) and I dont see such an option anywhere, sorry. As I stated, maybe verify 100% with TAC.

Andy

Re: Check Point 1600 ClusterXL with only public IP addresses

ikafka — Mon, 29 May 2023 13:36:01 GMT

Ok @the_rock thanks for repling. I will contact TAC.

Re: Check Point 1600 ClusterXL with only public IP addresses

the_rock — Mon, 29 May 2023 13:39:17 GMT

Let us know what they say.

Andy