topic Re: HA on Spark Devices - No cluster IP required for Active/Inactive? in Spark Firewall (SMB)

HA on Spark Devices - No cluster IP required for Active/Inactive?

SnafuNL — Fri, 27 Mar 2026 18:15:01 GMT

Hello All

Looking for some clarification on how HA works on the Spark Device, specifically ones managed in Spark Management.

I haven't worked with HA in Check Point for about 10 years, back then each firewall needed it's own IP along with the Cluster IP. Today I was setting up HA on some Spark Management connected devices, and while configuring the primary member I made all the interfaces non-HA with the intent of setting them up after. After I had the peer configured and synced up, I noticed all the interface settings (including IPs) from the primary had came over to the peer (Inactive).

I know configuring an HA interface with cluster and devices IPs is still an option, but does Check Point now offer a Active/Passive HA similar to say Palo Altos? So, I enable monitor state on each of the primary's interfaces will the peer assume the primary's IP if it goes down

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

the_rock — Fri, 27 Mar 2026 18:23:51 GMT

I believe that is how it indeed works for spark devices HA, not like typical clusterXL, where you do need separate IP addresses.

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

sigal — Fri, 27 Mar 2026 18:30:33 GMT

Hi,
It is still required to have an IP address on the separate interfaces along with cluster IP (total of 3 addresses per clustered interface).
On the LAN interfaces the IP on the interfaces should be routable. On the internet connections the IPs on the interfaces can be private (non routable), while the cluster IP should be routable.
We had few bugs with non-HA interfaces on R81.10.17 and this is probably why the interface IP was duplicated. Are you using R81.10.17? If yes, I recommend upgrading to R82.00.10.

Thanks.

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

SnafuNL — Fri, 27 Mar 2026 18:52:00 GMT

Thank you. These are 1590 appliances, so I don't believe R82 is available for them currently.

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

the_rock — Fri, 27 Mar 2026 18:59:10 GMT

Btw, not sure if you had a chance to have a look at below?

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Configuring-High-Availability.htm?tocpath=Managing%20the%20Device%7CConfiguring%20High%20Availability%7C_____0#Prerequisites

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

SnafuNL — Fri, 27 Mar 2026 19:11:25 GMT

Follow-up question - Cluster status Monitored. The Admin Guide says

This status is also called private monitored.
The physical interface on this Cluster Member is not coupled with another interface on the other Cluster Member as in High Availability interface mode.
The interface's status is still monitored, and if a problem occurs, the Cluster Member fails over to the other Cluster Member

Does that mean fail over to the peer but the IP from the primary is not assumed?

Re: HA on Spark Devices - No cluster IP required for Active/Inactive?

sigal — Fri, 27 Mar 2026 19:29:56 GMT

An interface can be configured to one of three cluster status:
1. Non-HA (private): each cluster member has its own IP address. When the interface goes down the cluster state is not affected
2. Monitored: each cluster member has its own IP address. When the interface goes down the associated cluster member becomes down
3. Clustered (HA): each cluster member has its own IP address + cluster IP address that is visible to the network. When the interface goes down the associated cluster member becomes down

Since you are using R81.10.17 you can only use the third option.