topic Re: High Availability (HA) on Checkpoint 1590 Quantum Spark in Spark Firewall (SMB)

High Availability (HA) on Checkpoint 1590 Quantum Spark

Phillip-83 — Mon, 15 Apr 2024 20:27:31 GMT

Hi everyone,

I'm new to Checkpoint and I've been trying to learn how to set up for my customer.
Currently, I'm stuck in this place (Connection diagram as shown in the attached picture). I have configured HA for LAN on Lan3, synchronizing the firewall via Lan2. I don't HA the 2 WAN inputs of the 2 Checkpoints, but let them connect directly to the IPS via Metro (my customer using Metro Wan-MPLS Layer 2). Now if I drop the channel on FW1's WAN, will FW2 automatically switch from Standby to Active?

Can someone help me with the answer to this, please.

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

PhoneBoy — Tue, 16 Apr 2024 00:00:48 GMT

To the best of my knowledge, only interfaces that are involved in clustering can cause a failover.
Doesn't sound like the WAN is involved in clustering, which means I would expect this to not work.
However, you might want to open a TAC case and confirm: https://help.checkpoint.com

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

Chris_Atkinson — Tue, 16 Apr 2024 06:36:10 GMT

Is this locally or centrally managed, running R81.10.10 firmware?

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

Phillip-83 — Tue, 16 Apr 2024 05:11:43 GMT

So if I have 2 transmission channels, with this checkpoint 1590 (There is no Router and SW WAN above the FW), is there any plan to HA those 2 transmission channels? These two transmission channels use 2 different IP layers from 2 different network providers.

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

G_W_Albrecht — Tue, 16 Apr 2024 09:16:15 GMT

Find all details for how to configure a SMB HA Cluster here: sk121096: How to configure a cluster between locally managed SMB appliances

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

PhoneBoy — Tue, 16 Apr 2024 14:28:01 GMT

ClusterXL (on non-SMB appliances) definitely has a requirement for the WAN interfaces being on a "shared" network.
That said, clustering is a little different on the SMB appliances, which is one of the reasons I suggested checking with TAC.
I will also check internally as well.

Re: High Availability (HA) on Checkpoint 1590 Quantum Spark

PhoneBoy — Tue, 16 Apr 2024 14:34:01 GMT

Actually, there's an SK that covers this exact scenario and the steps needed to achieve it: https://support.checkpoint.com/results/sk/sk181841