topic Re: In an HA environment disable CCP packet check on specific interfaces in Spark Firewall (SMB)

In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Mon, 13 Sep 2021 18:08:24 GMT

Hi Community,

I want to disable or switch off the CCP packet check on specific interfaces. Only on 1 interface out of 8.

So if the CCP packet is not receiving on this interfaces, this will not cause cluster failover.

Is it possible somehow?

Akos

Re: In an HA environment disable CCP packet check on specific interfaces

Timothy_Hall — Mon, 13 Sep 2021 19:29:09 GMT

Yes just define the desired interfaces as Network Type "private" in the topology of the cluster object. However I don't think you are allowed to present a cluster/virtual IP address when the interface is in this mode; the firewalls just use their dedicated fixed IP addresses on the private interface.

Re: In an HA environment disable CCP packet check on specific interfaces

mcatanzaro — Mon, 13 Sep 2021 22:35:36 GMT

You can configure the interface to only monitor the physical link rather than CCP packets:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/CXLG/Configuring-Link-Monitoring-on-Cluster-Interfaces.htm

Re: In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Tue, 14 Sep 2021 07:14:13 GMT

Hi Timothy,

Yes, this can be a solution, but I need to present 1 IP as gateway, so this can't be a solution.

An I forgot one important thing, this is an SMB cluster R80.20.15

Akos

Re: In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Tue, 14 Sep 2021 07:13:51 GMT

Hi,

Thanks for the information.

After I posted my question, I found this article

An I forgot one important thing, this is an SMB cluster R80.20.15. The article belongs to R81. Is it applicable on SMB appliances as well?

Akos

Re: In an HA environment disable CCP packet check on specific interfaces

mcatanzaro — Tue, 14 Sep 2021 17:07:45 GMT

Not sure if you can do this on Gaia Embedded.

@PhoneBoy @_Val_

Can you guys move this to the SMB forum

Re: In an HA environment disable CCP packet check on specific interfaces

_Val_ — Tue, 14 Sep 2021 17:29:15 GMT

@mcatanzaro Done. It was not obvious from the start that this is an SMB issue 🙂

Re: In an HA environment disable CCP packet check on specific interfaces

G_W_Albrecht — Wed, 15 Sep 2021 08:04:04 GMT

This is not possible on locally managed SMBs. On centrally managed, you can configure it: When High Availability is disabled on the interface, the interface is considered non-monitored private (not part of the cluster configuration).

See Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.30 Centrally Managed Administration Guide p.23

Re: In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Wed, 15 Sep 2021 08:52:31 GMT

You are right, Sorry about that

Re: In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Wed, 15 Sep 2021 09:52:43 GMT

@G_W_Albrecht

Yes, it is a centrally managed SMB cluster. If I set non-monitored private, it will cause lost the ability of the virtual IP which is really important in that two trunc interface.

I know the cluster prerequisites, which describes between cluster interfaces must be layer 2 connection....

In a nutshell:

There is a special device with two interfaces:

On the special device (appliance) eth1 and eth2 is a linux bond trunc interface. This device is probing its default gateway on both interfaces. The traffic will flow on that IF, which receives the ARP answer faster.
And no, I can't put an active device there (router, switch, etc.) It is prohibited.

This is a very special scenario

Any idea will appreciate

Re: In an HA environment disable CCP packet check on specific interfaces

G_W_Albrecht — Wed, 15 Sep 2021 10:04:31 GMT

Open an SR# with TAC !

Re: In an HA environment disable CCP packet check on specific interfaces

AkosBakos — Wed, 15 Sep 2021 11:56:07 GMT

Done 🙂