topic SMB Cluster - Management Interface in Spark Firewall (SMB)

SMB Cluster - Management Interface

leonid1890 — Mon, 25 Dec 2023 11:02:38 GMT

Hello,

I create SMB Cluster R80.20.50 via Smart Console in High Availability mode.

This cluster have s2s with Gaia 7000.

My Goal: to create managmenet inteface on each gateway of the SMB which is not monitored by the cluster
in order to get access to each device seperatly.

In topology table I configred this interface as "Non-Monitored Private" and it is internal.

The problem is that I still got access to Avtive member interface and not to the standby.

I think this is because of the site to site.

Any suggestions?

Re: SMB Cluster - Management Interface

PhoneBoy — Tue, 26 Dec 2023 20:59:29 GMT

What version/JHF is your management?
Setting a "Non-Monitored Private" interface isn't necessary here, but you may need to disable cluster fold NAT.
It is settable via the CLI from R81.10.00: https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/170583.htm

Re: SMB Cluster - Management Interface

leonid1890 — Wed, 27 Dec 2023 07:07:16 GMT

Hello,

My Smart Console version is R81.10

I don't use NAT on my SMB Cluster.

Re: SMB Cluster - Management Interface

PhoneBoy — Wed, 27 Dec 2023 14:18:26 GMT

Clustering does this "NAT" by default.
It should also be settable in your software release via the CLI as well.
How precisely are you attempting to access the secondary member?

Re: SMB Cluster - Management Interface

leonid1890 — Wed, 27 Dec 2023 14:25:25 GMT

1. I checked inside my SMB Cluster NAT settings:

perform-cluster-hide-fold: false

2. I tried to access secondary cluster member via WAN or via one the LAN interfaces.

but it didn't work.

I am trying to find way to have access both of cluster members when the site to site is working.

Re: SMB Cluster - Management Interface

PhoneBoy — Wed, 27 Dec 2023 14:35:52 GMT

How are you attempting to perform this access?
Have you used tcpdump to see if the traffic is reaching the secondary member or not?

Re: SMB Cluster - Management Interface

leonid1890 — Wed, 27 Dec 2023 14:51:22 GMT

Trying access via SSH / HTTPs

I can't used tcpdump on the secondary member because I don't have access when site to site is working.

When I remove site to site I have access to both of the Cluster members via WAN interface.

Re: SMB Cluster - Management Interface

the_rock — Wed, 27 Dec 2023 18:32:25 GMT

Might be worth TAC case or do remote session, sounds like something simple might be missing here.

Best,

Andy

Re: SMB Cluster - Management Interface

PhoneBoy — Wed, 27 Dec 2023 19:06:09 GMT

With the VPN in place, it would be expected for the traffic to traverse the primary node.
However, you should still be able to:

Reach the primary node
SSH from the primary node to the secondary node

Are you able to do that?
I also think working with TAC on this would be advisable.

Re: SMB Cluster - Management Interface

leonid1890 — Mon, 01 Jan 2024 07:24:33 GMT

Ok thanks, I will check with TAC