Secondary Azure management server

[greenchair]

Hi,

We are creating a secondary R81.10 management server in Azure.  ( We will be upgrading entire environment next year to R82)

The primary server was built using Azure marketplace. marketplace 

Per docs we are building the secondary server with the same marketplace app. 

 

In this doc here it says to select Secondary server when creating the server. : Overview of Management High Availability

(Video shows R80 but is on the R81 Doc.)

But the first time setup wizard does not seem to run on first login and there are no options in the marketplace tool to select Secondary.

 

In the Smart Console the Secondary button is greyed out:

Can we just proceeded with syncing the servers with both servers set as primary ?

Primary and Secondary both have the latest hotfix installed.

There also does not seem to be anywhere to set a SIC key. I am guessing this would be available if this was a secondary server.

Also. the new secondary management server seems to take the public IP address by default.

Is this safe to change to the private post install ?

thanks

[Don_Paterson · Accepted solution]

No. Two Primary management server cannot sync and offer management HA.

When you deploy the image from the marketplace you need to choose Configure Manually under CloudGuard Advanced settings > Installation Type

Then you can run the FTW on the new server.

[Don_Paterson]

Just to add a few notes:

You shared an R81 guide. It is best to use the R81.10 guides in your case. I don't think that you will see a difference in the case of management HA but it's still best to use the version specific documentation.

https://support.checkpoint.com/results/sk/sk170416  <-- Administration Guides

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SecurityManagement_AdminGuid... 

The Management HA for Azure solution deployment does not seem to be well documented and you are not the first to find fall into that trap. 

I will ask for the documents to be updated.

Other references:

https://support.checkpoint.com/results/sk/sk173705 

https://support.checkpoint.com/results/sk/sk54160 

https://support.checkpoint.com/results/sk/sk132192

https://support.checkpoint.com/results/sk/sk39345 

https://support.checkpoint.com/results/sk/sk30857 

[greenchair]

Brilliant. Thanks for the quick reply !

Yes the docs seem to go around in circles sometimes.

[the_rock]

It happens 🙂

[Don_Paterson]

You're welcome. 

I've sent some feedback in about that. 

[the_rock]

Don is 100% correct, you need to follow what he posted in his first response, and he stated, you can NOT sync two primary servers, that was never possible and Im sure it never will be.