topic Re: Simple Question in General Topics

Simple Question

RemoteUser — Wed, 14 May 2025 07:27:11 GMT

MVC is enable by deafult now? (FROM R81.20)

Re: Simple Question

Tal_Paz-Fridman — Wed, 14 May 2025 07:38:50 GMT

Just looking at the relevant administration guide it should be enabled manually. Perhaps someone else has different experience:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/MVC-Upgrade-of-ClusterXL-GW-mode.htm

Re: Simple Question

RemoteUser — Wed, 14 May 2025 07:42:29 GMT

I'll rephrase the question, shouldn't it be disabled by default?

Re: Simple Question

G_W_Albrecht — Wed, 14 May 2025 07:47:57 GMT

Why should it ? See the obstacles to policy install in sk177626 first ! Next limitation: Do not add, remove, or edit settings of cluster interfaces (IP addresses, Network Objectives, and so on) while in MVC, see https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Multi-Version-Cluster-Upgrade.htm?tocpath=Upgrade%20of%20Security%20Gateways%20and%20Clusters%7CUpgrading%20ClusterXL%252C%20VSX%20Cluster%252C%20or%20VRRP%20Cluster%7CMulti-Version%20Cluster%20(MVC)%20Upgrade%7C_____0

Idea of MVC is that You can upgrade to a newer version without a loss in connectivity (Zero Downtime Upgrade) and test the new version on some of the Cluster Members before you decide to upgrade the rest of the Cluster Members or revert the upgraded.

This also is not full HA clustering as failover will not fully work (depending on the version gap).

Re: Simple Question

emmap — Wed, 14 May 2025 08:04:37 GMT

In R81.20 GA it is disabled. When you install any JHF take 14 and above it is enabled, so that you don't lose clustering during the JHF install process. This information is in the notes section of the JHF documentation.

In my R82 install it is disabled, I have not changed this configuration so I think this would be the default setting in R82.

Re: Simple Question

G_W_Albrecht — Wed, 14 May 2025 08:06:52 GMT

You always have to enable it on the member(s) using:

set cluster member mvc on

Re: Simple Question

RemoteUser — Wed, 14 May 2025 08:35:50 GMT

Ok, you answered my question, so from JHF 14 onwards it is enabled by default, but I haven’t found where it says that in the JHF documentation.

Thank you very much, emmap

Re: Simple Question

emmap — Wed, 14 May 2025 08:37:49 GMT

It's in the Critical Information section (used to be called Important Notes) - search for PRJ-44444 in there and you'll see the entry,

Re: Simple Question

RemoteUser — Wed, 14 May 2025 08:39:55 GMT

The Multi-Version Cluster feature is enabled by default to prevent traffic loss after a failover from a cluster member running a lower Jumbo Hotfix version.

Take 14

PRJ-44444

Thank you very much emma

Re: Simple Question

RemoteUser — Wed, 14 May 2025 08:46:54 GMT

Based on what's written here:

The Multi-Version Cluster feature is enabled by default to prevent traffic loss after a failover from a cluster member running a lower Jumbo Hotfix version.

it seems like it was enabled to solve issues related to Jumbo Hotfixes, but MVC isn’t designed for major versions... or am I missing something

Re: Simple Question

emmap — Wed, 14 May 2025 08:51:13 GMT

It is designed for version upgrades primarily, but there was something in the code that was updated in that JHF take that also triggered essentially the same thing, ie no cluster sync when one box has the JHF and the other doesn't. I don't have any further details on what changed though.

Re: Simple Question

RemoteUser — Wed, 14 May 2025 08:55:53 GMT

Thank you very much for the explanation.

Re: Simple Question

G_W_Albrecht — Wed, 14 May 2025 09:06:03 GMT

See ClusterXL Admin Guide: ClusterXL is supported only between identical Check Point software versions - all Cluster Members must be installed with identical Check Point software, including OS build and hotfixes.

Re: Simple Question

RemoteUser — Wed, 14 May 2025 09:08:18 GMT

Yes, that's true, but it's already happened to me a couple of times that I kept different JHF versions for a few days and nothing ever happened. Maybe I just got lucky, haha!

Re: Simple Question

G_W_Albrecht — Wed, 14 May 2025 09:10:24 GMT

As long as MVC is used...

Re: Simple Question

RemoteUser — Wed, 14 May 2025 09:12:50 GMT

After JHF 14 yes