update aws route table issue with AWS Cluster deployment

[Bill_wang]

Hi Body

    I deployed two GW with cluster mode in the aws...the server subnet's default geteway point to active gw eni. 

my question is "if the swirtchover happened,  how to automatically replace server subnet's nexthop to new active member eni ??? "

i don't find like this script ....

[PhoneBoy]

Did you follow the instructions here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Bill_wang]

Hi PhoneBoy
thank your reply...i not find any helpful information from this sk about update route table....
now, HA work is fine, and the failover has no any problem. only the route table of server's subnet have not been replace to new active eni....

[PhoneBoy]

If you set up the cluster per the SK, then this should happen automatically, as the SK states.
If it's not, then use the troubleshooting steps provided in the same SK. to help understand why.

[Bill_wang]

my environment have a little different with sk....server's subnet and gw internal subnet is same one in the sk.
and then , server's sbunet is a another subent in my environment.
like gw internal subnet is 10.1.1.0/24....server subnet is 10.1.2.0/24...

[Bill_wang]

anybody have any idear ?

[nullform]

Can you explain your topology, the layout and what have you done that's not according to the deployment guide.

[Kurt_Abela]

Hi,

was this ever solved? We have a similar setup and we are struggling to find a way to change routes/interfaces on subnets not created directly by Checkpoint

[Roman_Kats]

Hi Kurt
Can you please share your topology and how exactly have you created cluster?
Thanks,
Roman

[Nir_Shamir]

Hi,

The deployment is based on the fact that the Cluster is installed in its own VPC with no other servers.

so any other Spoke VPCs should be Peered to it with Regular Peering or TGW etc.

The Server VPC routing should take him to the Cluster VPC and there it will have a route directed to the Cluster Active member ENI.

[Kurt_Abela]

Hi,

This is an existing AWS setup and customer asked us to fit in a Checkpoint Cluster (same AZ). The problem is that they have existing servers directly on the current existing gateway backend interface, as well as a number of Transit Gateways and other pre-existing route tables.

When we deploy a cluster in the existing VPC, the cluster can only change the route tables it created during the deployment. My question is if we can force the new cluster to modify the existing route tables.

I know this is the recommended design from CP, but this is an existing customer topology and they want to deploy CP cluster in the Same VPC.

Thanks,

Kurt

[Nir_Shamir]

As I remember and tested again , you can associate any Route table to the Cluster's internal Subnet , or other Subnets in That VPC , add routes to the currently ACTIVE member's ENI and that's it.

the failover changes the routes to the ACTIVE member's ENI