topic Firewall migration from Active/Active to Active/Passive in General Topics

Firewall migration from Active/Active to Active/Passive

Kasuntha95 — Fri, 25 Apr 2025 05:58:39 GMT

Hi Guys,

Can somebody share if you have any experience in migrating Checkpoint Cluster environment from Active/Active to Active/Passive.

What Areas need to focus. I m not planning to do any change to existing gateways. Need to migrate them with Active/Passive cluster setup.

Thanks.

Re: Firewall migration from Active/Active to Active/Passive

_Val_ — Fri, 25 Apr 2025 12:29:30 GMT

This should be the easiest one yet. Change the cluster mode in the SmartConsole and push the policy. That should be enough, and I would not expect any caveats on the way.

Re: Firewall migration from Active/Active to Active/Passive

the_rock — Fri, 25 Apr 2025 12:54:32 GMT

Personally, I always found active/passive is better and here is why I say that. You may think, well if its active/active, firewalls will simultaneously share the traffic, which is indeed true, but lots of times, randomly, specific connections may get dropped and not be processed at all.

In active passive scenario, that literally never happens, since you always have 1 active member and if any issues, it will failover to 2nd one.

Andy