topic Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet in Spark Firewall (SMB)

SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

dede79 — Thu, 02 Mar 2023 08:38:06 GMT

Hello,

I need to configure VIP on different subnet on a SMB cluster - centrally managed - on WAN link (have not enought pub. IPs and Mgmt is directly connected).

So private IPs for the interfaces and a public IP as VIP. Problem is to set the default gateway - SMB Internet connection only allows configure Gateway in the same subnet. Adding a manual default route is also no possible.

Any idea?

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

G_W_Albrecht — Thu, 02 Mar 2023 09:41:48 GMT

Ask TAC - https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ClusterXL_AdminGuide/Topics-CXLG/Cluster-IP-addresses-on-different-subnets.htm?tocpath=Advanced%20Features%20and%20Procedures%7CCluster%20IP%20Addresses%20on%20Different%20Subnets%7C_____0 could apply.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Chris_Atkinson — Thu, 02 Mar 2023 10:44:06 GMT

sk159772 suggests this should be possible in R81.10.x

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

G_W_Albrecht — Thu, 02 Mar 2023 11:14:15 GMT

Description

Found In

Resolved In

01615874

When defining a locally managed cluster, the Virtual IP address of a clustered interface has to be in the same subnet as the real IP addresses of the cluster members.

R80.20 GA

R81.10.00

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

dede79 — Thu, 02 Mar 2023 12:07:24 GMT

I use centrally managed - but actually as said I heve no idea how to configure the default gateway.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

xAnTx — Thu, 02 Mar 2023 12:41:10 GMT

Hi!
Are you trying to configure DG before or after cluster configuration?
As far as I know, DG could be configured in subnet, other than actual IP address, only when cluster configuration already done on the appliance.
Means - try to configure cluster first (with all needed IPs), install policies, and only after that - change DG on members themselves.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

dede79 — Thu, 02 Mar 2023 13:20:19 GMT

cluster is configured - actually the issue is in configuring the default route on gaia embedded itself!

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Amir_Ayalon — Thu, 02 Mar 2023 13:29:24 GMT

Have you tried R81.10.05 ?

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

dede79 — Mon, 06 Mar 2023 08:09:24 GMT

for some reason my last post was deleted with the screensot of the issue.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

G_W_Albrecht — Mon, 06 Mar 2023 08:21:49 GMT

Did you contact TAC already ?

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

dede79 — Wed, 08 Mar 2023 10:07:12 GMT

I pushed issue to Checkpoint SE .....will post the solution here if I get one

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

RS_Daniel — Wed, 28 Jun 2023 17:42:32 GMT

Hello @dede79 ,

We are facing a similar scenario, need to have member interfaces in a different subnet than virtual IP. Were you able to make it work? was default route possible?

Regards

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

FerPr0c03 — Thu, 29 Jun 2023 02:04:48 GMT

Hi @dede79

Were you able to solve the problem with the default routes? I have the same scenario and same problem.
Could you help me? thanks

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Chris_Atkinson — Thu, 29 Jun 2023 06:42:35 GMT

Please open a case with TAC if not already and I will follow up internally, thanks.

Share the SR number with me in private message.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Chris_Atkinson — Fri, 30 Jun 2023 00:04:55 GMT

Have you tested R81.10.07 (996001430) out of interest?

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Chris_Atkinson — Fri, 30 Jun 2023 03:12:07 GMT

Successfully tested this to the extent my lab allows on a locally managed cluster running R81.10.07 (996001430).

Time permitting will follow-up similar tests on a centrally managed variant also.

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Jones — Tue, 11 Jun 2024 15:20:27 GMT

Hi,

I would also like to know if there is a supported solution for centrally managed SPARK cluster with a Cluster IP Address on different subnets on the WAN interface. Could you share the solution please?

Kind Regards,

Jones

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

Steven_Sultana — Fri, 13 Sep 2024 07:16:20 GMT

sk182234 claims that such a solution is possible for both Locally and Centrally Managed Clusters.

How do I configure a cluster on Quantum Spark appliances with only one public address?
Is it necessary to have 3 public IP addresses to access the cluster members?

The feature "Single routable IP" for clusters is supported starting from the R81.10.05 release.
For Locally Managed appliances, see the R81.10.X Locally Managed Administration Guide topic "Configuring High Availability" section "Single Routable IP Cluster."
For Centrally Managed appliances, see the R81.10.X Centrally Managed Administration Guide topic "Configuring High Availability" section "Configuring a Single Routable IP Cluster in Central Management."
Example diagram:

Re: SMB 1500 R81.10 - Cluster Virtual IP address belongs to a different subnet

perfect4situa — Wed, 12 Mar 2025 14:03:59 GMT

Even if there a section in documentation about the configuration of Single Routable IP (https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Centrally_Managed/EN/Content/Topics/Configuring-High-Availability.htm?TocPath=Managing%20the%20Device%7CConfiguring%20High%20Availability%7C_____5#Configuring_a_Cluster_with_a_Single_Routable_IP_Address_in_Central_Management) as described in https://community.checkpoint.com/t5/SMB-Gateways-Spark/Implementing-High-Availability-Firewall-Clusters-with-Single/m-p/240481/highlight/true#M12031 I recently close a ticket with TAC and they say that there is no way to do this configuration with Spark Appliances in Centrally Managed mode.

I suggest to you the "local transport network" between gateway and router