Check Point 1600 ClusterXL with only public IP addresses

[ikafka]

Hi community;

I want to cluster 2 1600 series devices, but I only have one public ip address. Solution proposed with this sk: https://support.checkpoint.com/results/sk/sk32073

Does this solution apply to the 1600 series?

[the_rock · Accepted solution]

Based on the sk, it is possible, BUT, note below notice.

Andy

 

Below is what you need to follow:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_ClusterXL_AdminGuide/Content...

[ikafka]

Thanks the_rock

Ok, I will check and read my device version. I just wanted to know It is possible. thanks  for your answer. 

regards.  

[the_rock]

No worries. Process is almost the same as back in R55 days, honestly, not much has changes as far as things you need to do.

Andy

[ikafka]

Hi @the_rock 

I have complated configuration but I hava a few quation.

 This picture my HA configuration.

I did configuration for internet-1 and internet-2 as int the picture and other local networks. Different services are running on public ip addresses and there NAT rules.bIs best practise right this configuration?

Can I make my configuration better because sometimes my NAT sevices are not  working properly.

Q1: Are the primary and secondary ip addresses to be used for internet interfaces public or private in accordance with best practice? I preferred to use 10.x.x.x.x. 

[the_rock]

Well, you just have to make sure that NAT and routing are correct as per articles we provided. If you follow whats in there, it will work, for sure. 

Andy

[ikafka]

Ok thnaks. My NAT and Route ryles are working, no problem now. But I cannot select ISP (internet ip) for Remote Access. For example: I want to use 212.x.x.x ip address for remote access. Is there  ip selection on these device (quantum spark 1600)? I could not find admin guide. 

Admin Guide link:  https://sc1.checkpoint.com/documents/SMB_R81.10.05/Help/Locally_Managed/EN/Content/Topics/Configurin... 

[the_rock]

Not that Im aware of on locally managed SMB appliances. You may want to confirm with TAC, but I will spin up demo soon and verify myself as well.

Andy

[ikafka]

Ok @the_rock  thanks. I will be waiting your answer if you verify on demo. 

[the_rock]

I just spun up quick demo (takes 5 mins from support site) and I dont see such an option anywhere, sorry. As I stated, maybe verify 100% with TAC.

Andy

[ikafka]

Ok @the_rock thanks for repling. I will contact TAC. 

[the_rock]

Let us know what they say.

Andy