topic Re: minimum required intrerfaces for LACP bond in Hyperscale Firewall (Maestro)

minimum required intrerfaces for LACP bond

Wolfgang — Tue, 22 Aug 2023 12:20:47 GMT

Following Configuring the Minimal Number of Required Subordinate Interfaces for Bond Load Sharing we can change the required interfaces for a BOND interface to be up.

I found no similar description in the MAESTRO documentation. I think it's the same way to be configured with MAESTRO but maybe someone can confirm ?

Re: minimum required intrerfaces for LACP bond

the_rock — Tue, 22 Aug 2023 12:33:52 GMT

Lets see if someone from CP can confirm for sure, but Im fairly positive would be the same.

Andy

Re: minimum required intrerfaces for LACP bond

Dario_Perez — Tue, 22 Aug 2023 13:24:22 GMT

That is Gaia Limitation and information, not related to maestro and/or chassis it does mean we apply the same concept as ClusterXL.

Re: minimum required intrerfaces for LACP bond

Sven_Glock — Tue, 22 Aug 2023 19:10:26 GMT

Hi Wolfgang,

may I ask in this context: Are you working with kernel parameter "fwha_monitor_all_vlan=1" on maestro?
Sorry for beeing off topic.

Thanks in advance.

Regards
Sven

Re: minimum required intrerfaces for LACP bond

Tom_Kendrick — Tue, 22 Aug 2023 19:19:06 GMT

I had a discussion with R&D back in January this year. Here is what they shared:

From R81.20 we support min slave feature when you can configure how many slaves should be UP in order to the bond to be UP (cluster grade wise).

For example if you have 3 slaves, you can configure that the min slaves should be 3, therefore if one slave is down, the bond will monitored as down in cluster grade which will trigger failover.

You can define it in gclish:

set chassis high-availability bond <bond_name> min_slaves <value>

Installing policy after.

Monitor via:

cphaprob show_bond

Re: minimum required intrerfaces for LACP bond

Wolfgang — Tue, 22 Aug 2023 20:36:18 GMT

@Tom_Kendrick and @Dario_Perez now I‘ve got different answers from Check Point employees. Which one is working? I need this information for R81.10 and R81.20 Maestro solution.

Re: minimum required intrerfaces for LACP bond

_Val_ — Wed, 23 Aug 2023 07:12:31 GMT

It is best to receive an official answer for your specific case via a TAC case.

Re: minimum required intrerfaces for LACP bond

Wolfgang — Wed, 23 Aug 2023 13:47:43 GMT

@Sven_Glock yes, this is off topic 😉 We are using the default on all of our Maestro solutions:

[Expert@XX-XX-XX-ch01-01:0]# fw ctl get int fwha_monitor_all_vlan
fwha_monitor_all_vlan = 0

Re: minimum required intrerfaces for LACP bond

Wolfgang — Thu, 24 Aug 2023 19:46:03 GMT

I got an answer from TAC.

R81.10 => changing $FWDIR/conf/cpha_bond_ls_config.conf Setting Critical Required Interfaces

R81.20 => same as with R81.10 and solution mentioned by @Tom_Kendrick , changing „set chassis high-availability bond <bond_name> min_slaves <value>“ Both are possible.

Re: minimum required intrerfaces for LACP bond

the_rock — Thu, 24 Aug 2023 20:15:54 GMT

Thanks for sharing!