Migrate eth interface to a VLAN interface in bond

[shauls]

Hi,

I have an 1gb interface (eth5) that I would like to migrate as a vlan interface to an existing bond of two 10g interfaces (bond101.1).

I would like to know which steps exactly should I take to do so. It is a clusterXL, so it needs to be done on both members.

I saw some posts regarding this, but they are a little bit different from each other and old, so I would like to know which is the best option to do this today. 

We are using R81.10, management is R81.20.

Thanks.

[Chris_Atkinson · Accepted solution]

Is this a coincidence or extension of this discussion?

https://community.checkpoint.com/t5/Management/have-different-physical-interfaces-in-a-cluster-in-sa...

[shauls]

Pure coincidence 😂 

Thanks!

[the_rock]

I would definitely follow process Bob Zimmerman posted in the link Chris referenced, it works 100%.

Andy

[Bob_Zimmerman]

For reference, here's the direct link:

https://community.checkpoint.com/t5/Security-Gateways/ClusterXL-Changing-MGMT-and-eth2-from-1Gb-to-1...

The short explanation is that ClusterXL supports backing a cluster interface with a different logical interface on each member (e.g, you can have member 1 back the cluster VIP with eth5, then have member 2 back it with bond101.1). This isn't a common configuration, so I wouldn't leave it that way for more than a few hours.

Longer works fine, people just don't know what they're looking at when troubleshooting, and confusion extends outages.

[shauls]

One part that is missing for me is the dhcp relay part.

Probably should be configured between step 2 to 4. 

[Bob_Zimmerman]

Yeah, step 3 should really be "bring all the config over from the old interface to the new interface". DHCP relay, proxy ARP, interface-local routes (used for off-net VIPs, like how VSX works), and so on.

[shauls]

Thanks

One last question - it seems to me there is no downtime by following your method, am i correct? 

[the_rock]

Thats what I gather as well, though never personally tried it, but maybe @Bob_Zimmerman can say for sure.

[Bob_Zimmerman]

There shouldn't be any downtime, but there may be PNOTEs and failovers. After all, you're changing the logical interfaces being monitored. This is why the process includes pinning the member down administratively until you're done with it and ready to fail over.