Firewall migration from Active/Active to Active/Passive

[Kasuntha95]

Hi Guys,

Can somebody share if you have any experience in migrating Checkpoint Cluster environment from Active/Active to Active/Passive.

What Areas need to focus. I m not planning to do any change to existing gateways. Need to migrate them with Active/Passive cluster setup.

Thanks.

[_Val_ · Accepted solution]

This should be the easiest one yet. Change the cluster mode in the SmartConsole and push the policy. That should be enough, and I would not expect any caveats on the way. 

[the_rock]

Personally, I always found active/passive is better and here is why I say that. You may think, well if its active/active, firewalls will simultaneously share the traffic, which is indeed true, but lots of times, randomly, specific connections may get dropped and not be processed at all.

In active passive scenario, that literally never happens, since you always have 1 active member and if any issues, it will failover to 2nd one. 

Andy