topic Re: Migrate eth interface to a VLAN interface in bond in General Topics

Migrate eth interface to a VLAN interface in bond

shauls — Tue, 16 Sep 2025 13:42:08 GMT

Hi,

I have an 1gb interface (eth5) that I would like to migrate as a vlan interface to an existing bond of two 10g interfaces (bond101.1).

I would like to know which steps exactly should I take to do so. It is a clusterXL, so it needs to be done on both members.

I saw some posts regarding this, but they are a little bit different from each other and old, so I would like to know which is the best option to do this today.

We are using R81.10, management is R81.20.

Thanks.

Re: Migrate eth interface to a VLAN interface in bond

Chris_Atkinson — Tue, 16 Sep 2025 14:11:07 GMT

Is this a coincidence or extension of this discussion?

https://community.checkpoint.com/t5/Management/have-different-physical-interfaces-in-a-cluster-in-same-ip-range/m-p/257267#M42745

Re: Migrate eth interface to a VLAN interface in bond

the_rock — Tue, 16 Sep 2025 14:21:50 GMT

I would definitely follow process Bob Zimmerman posted in the link Chris referenced, it works 100%.

Andy

Re: Migrate eth interface to a VLAN interface in bond

shauls — Tue, 16 Sep 2025 14:32:18 GMT

Pure coincidence 😂

Thanks!

Re: Migrate eth interface to a VLAN interface in bond

Bob_Zimmerman — Tue, 16 Sep 2025 18:03:47 GMT

For reference, here's the direct link:

https://community.checkpoint.com/t5/Security-Gateways/ClusterXL-Changing-MGMT-and-eth2-from-1Gb-to-10Gb/m-p/254990/highlight/true#M49915

The short explanation is that ClusterXL supports backing a cluster interface with a different logical interface on each member (e.g, you can have member 1 back the cluster VIP with eth5, then have member 2 back it with bond101.1). This isn't a common configuration, so I wouldn't leave it that way for more than a few hours.

Longer works fine, people just don't know what they're looking at when troubleshooting, and confusion extends outages.

Re: Migrate eth interface to a VLAN interface in bond

shauls — Tue, 16 Sep 2025 19:07:40 GMT

One part that is missing for me is the dhcp relay part.

Probably should be configured between step 2 to 4.

Re: Migrate eth interface to a VLAN interface in bond

Bob_Zimmerman — Tue, 16 Sep 2025 19:32:56 GMT

Yeah, step 3 should really be "bring all the config over from the old interface to the new interface". DHCP relay, proxy ARP, interface-local routes (used for off-net VIPs, like how VSX works), and so on.

Re: Migrate eth interface to a VLAN interface in bond

shauls — Thu, 18 Sep 2025 06:23:05 GMT

Thanks

One last question - it seems to me there is no downtime by following your method, am i correct?

Re: Migrate eth interface to a VLAN interface in bond

the_rock — Thu, 18 Sep 2025 13:32:24 GMT

Thats what I gather as well, though never personally tried it, but maybe @Bob_Zimmerman can say for sure.

Re: Migrate eth interface to a VLAN interface in bond

Bob_Zimmerman — Thu, 18 Sep 2025 14:29:58 GMT

There shouldn't be any downtime, but there may be PNOTEs and failovers. After all, you're changing the logical interfaces being monitored. This is why the process includes pinning the member down administratively until you're done with it and ready to fail over.