topic SMP and HA clusters in Spark Firewall (SMB)

SMP and HA clusters

Ted_Serreyn — Wed, 02 Mar 2022 02:00:40 GMT

Could someone explain to me why the below limitation exists. It appears that you can configure a cluster in SMP, but you can't enable it locally on the boxes.

01615544 The user cannot configure a locally managed cluster with SMP or an externally managed log server.

This was sold to a customer after confirming that it appeared that SMP would support clustering.

Is there any kind of work around here. I know you can configure a locally managed cluster, but I really need the SMP integration for the to match the rest of the SMB deployments.

Deploying a 1800 HA cluster, but really need the SMP for reporting and centralized management.

Re: SMP and HA clusters

Amir_Ayalon — Wed, 02 Mar 2022 07:43:16 GMT

Hi Ted.

please notice that this limitation was resolved in R80.20.10

as it appear in the Wiki

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk159772

if you have any other question, feel free.

Re: SMP and HA clusters

Ted_Serreyn — Wed, 02 Mar 2022 12:34:10 GMT

Yes, I saw that it was resolved in the SK article. However I am having issues establishing a cluster with a pair of 1800’s with SMP connection. If I build it standalone it works fine, but with SMP enabled, cluster configuration fails. I am trying to understand the original problem to see if it sheds any light on my current one.

This is a pair of 1800 appliances with the latest firmware.

I have opened a TAC case regarding this,

Re: SMP and HA clusters

G_W_Albrecht — Wed, 02 Mar 2022 12:48:20 GMT

So after enabling SMP the secondary will not sync with primary when clustered? You did only configure the primary as usual in SMB clustering ?

Re: SMP and HA clusters

Ted_Serreyn — Wed, 02 Mar 2022 12:58:08 GMT

yes, it doesn't even appear to finish the configuration.

Re: SMP and HA clusters

G_W_Albrecht — Wed, 02 Mar 2022 13:09:46 GMT

The primary node doesn't even appear to finish the configuration ? Firmware is R80.20.35 (992002614) ?

Y Q was: when you do the sync interface on an SMB ha cluster, direct connect cable or thru a switch?

Use an Ethernet cross-cable to connect SYNC interfaces on the two appliances.

(Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.35 Centrally Managed Administration Guide p.20)

Re: SMP and HA clusters

Ted_Serreyn — Wed, 02 Mar 2022 14:34:35 GMT

Here is a screenshot after trying to configure the HA on the secondary member. This same cluster configuration configures (now) as a standalone cluster not connected to SMP.

here is the error received

Re: SMP and HA clusters

G_W_Albrecht — Wed, 02 Mar 2022 14:37:08 GMT

In QUANTUM SPARK PORTAL R12.30 Administration Guide, cluster is explained as a number of GWs in Gateway Map:

Multiple gateways at a near location are clustered together. You can click on the cluster and zoom in to show those gateways.

So where is this explained and documented ?

Re: SMP and HA clusters

mattiasl — Wed, 30 Nov 2022 18:21:33 GMT

I had this issue as well and thought that I would share how I resolved it.

It turns out to be access rules that blocks the traffic on the sync-interface so when trying to configure HA, it fails with the error message "The software version of the primary member is not compatible". I had the firewall setting in SMP set to strict which blocks all traffic. You have to set the firewall setting to standard when you configure the HA. After that you can configure your firewall rules and also a rule to allow traffic on the sync-interface. Then change back firewall policy to strict.

Hope this helps if others have the same issue.