topic Re: SMB Firewall Cluster in Spark Firewall (SMB)

SMB Firewall Cluster

Sanjay_S — Thu, 22 Jun 2023 10:51:10 GMT

Hi Team,

We have SMB firewalls in ACTIVE/ACTIVE mode. We need to change it to ACTIVE/STANDBY. May i know how we can change this? Does it require downtime at all?

Regards,

Sanjay S

Re: SMB Firewall Cluster

G_W_Albrecht — Thu, 22 Jun 2023 11:21:44 GMT

SMB firewalls do have no active/active = load sharing mode at all - see sk178604: Check Point R81.10.X for 1500, 1600, and 1800 appliance Known Limitations and Resolved Issues and refer to sk115868 !

Re: SMB Firewall Cluster

Chris_Atkinson — Thu, 22 Jun 2023 11:24:45 GMT

Yes you should plan for downtime.

Refer below for locally managed:

https://sc1.checkpoint.com/documents/smb_r81.10.x/adminguides_locally_managed/en/content/topics/configuring-high-availability.htm

Re: SMB Firewall Cluster

G_W_Albrecht — Thu, 22 Jun 2023 11:21:16 GMT

Why do you suggest downtime although ClusterXL Loadsharing does not exist on SMBs ? Also the suggested link does not work - use https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Configuring-High-Availability.htm?Highlight=high%20availability

Re: SMB Firewall Cluster

Chris_Atkinson — Thu, 22 Jun 2023 11:32:47 GMT

Did you review the guide and look at the changes required for a cluster?

Whilst we dont have enough information one or more devices require reconfiguration here.

Active/Active could also imply independent devices for some...

Re: SMB Firewall Cluster

G_W_Albrecht — Thu, 22 Jun 2023 11:34:38 GMT

This depends all on the steps already done, but currently cluster XL can not be in load sharing mode...

Re: SMB Firewall Cluster

Chris_Atkinson — Thu, 22 Jun 2023 11:39:22 GMT

We agree, the original post doesn't mention Cluster XL 🙂

@Sanjay_S Please clarify your existing configuration and appliance model.

Re: SMB Firewall Cluster

Sanjay_S — Thu, 22 Jun 2023 12:03:29 GMT

Hi Chris,

The device model is Checkpoint 1550, R80.20.20.

Cluster Mode: High Availability (Active Up, Bridge Mode) with IGMP Membership

Both the devices are in ACTIVE/ACTIVE state.

Just want to change this to ACTIVE/STANDBY Mode.

I think it is pretty straight forward in the normal Gaia, just going into cpconfig and changing the cluster config. But not sure about this.

Just going through the SKs shared above.

Thanks @G_W_Albrecht @Chris_Atkinson

Re: SMB Firewall Cluster

Chris_Atkinson — Thu, 22 Jun 2023 14:45:46 GMT

The guide provided won't apply to your current state.

You currently have an unsupported configuration (sk159772 / sk121096) so conversion without downtime cannot be guaranteed, least not without prior testing.

Re: SMB Firewall Cluster

G_W_Albrecht — Fri, 23 Jun 2023 19:46:07 GMT

I would suggest to update to a newer firmware - R80.20.20 is outdated ! Is this SMB locally managed ? High Availability (Active Up, Bridge Mode) with IGMP Membership is OK. https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/Configuring-High-Availability.htm?Highlight=cluster

SMB CLI has no cpconfig command, see Admin Guide, this is Embedded GAiA.

Re: SMB Firewall Cluster

anstelios — Fri, 23 Jun 2023 09:55:38 GMT

Can you please help me on a quick question here?

I can't find anywhere the configuration option for Active-Up or Primary-Up for a centrally managed SMB cluster (1600).
Where is it?? Is it possible to configure this? If not, what is the default mode??

Thing is that I have different behaviors on two different 1600 clusters...
One does switch to primary when it's up with (Member state has been changed after returning from ACTIVE/ACTIVE scenario (remote cluster member TESTFW1 has higher priority)
And the other 1600 cluster just stays on whichever member is active at any time..!!
So there must be a configuration option for this behavior somewhere... where is it???? 😛

Re: SMB Firewall Cluster

G_W_Albrecht — Fri, 23 Jun 2023 10:10:35 GMT

Just follow the steps listed here:

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Configuring-Gateway-and-Cluster-Objects.htm?tocpath=Small-Scale%20Deployment%20Installation%7C_____1

With SMB GWs, you have an active node that is up all the time. When it fails, standby node comes up.

Re: SMB Firewall Cluster

anstelios — Fri, 23 Jun 2023 10:20:03 GMT

thanks,

I am not trying to configure new clusters here.

I am talking about existing clusters and specifically looking for the feature that is available for normal GAIA clusters:

Is something similar available for SMB??

If not, what is the default behavior upon recovery? does it switch to higher priority member or stays as is??

Re: SMB Firewall Cluster

G_W_Albrecht — Fri, 23 Jun 2023 10:37:47 GMT

In GAiA, both nodes are configured, but with SMB, only the active node is ! The standby member is synced from the first, active node - also see Converting an Existing Quantum Spark Appliance to a Cluster. Afaik after failover it would switch to promary as active again if it is available.