R80.10 VRRP cluster: To hide or not to hide members ip?

[Markus_Marquard]

Hi,

during troubleshooting connectivity issue from Gateway to Checkpoint update server on a R80.10 VRRP cluster standby member, it came to my attention, that even the standby Security Gateway in a VRRP cluster is using the cluster ip address to open the outgoing connection, eg. to open a connection to https://usercenter.checkpoint.com/  (seen by using tcpdump on the Gateway).

I believe this maybe correct, because option Hide Cluster Members outgoing traffic behind IP address is checked in cluster properties.

However, I wonder how it can work, because the next hop (internet router) cannot know how to route traffic back properly. If the reply comes back from internet, destination will be the cluster ip address, so it would be routed to the active cluster member, not to the standby where it originated from.

What is the recommendation for this option? Enable or disable it? The documentation is quite sparse, some SKs are stating it should be enabled in a specific case, others are stating it should be disabled.

In our environment, we have identity Awareness rolled out, using Identity Agent, and sharing identities between all Gateways.

So what would be the pros and cons in this case for this option?

Thanks

Markus

[Daniel_Taney]

This may not exactly answer your question, but if you have this option enabled already, I'd be careful about just turning it off. 

I believe if you disable this option, you will need Manual or Automatic NAT rules created for all traffic that needs to get out to the Internet. This can be very beneficial if you want 100% total granular control over what can or can't get out to the Internet. However, if your NAT policy isn't structured that way already, you may experience some unintended side effects by turning it off. 

I haven't used VRRP as a clustering option in GAIA, but I assume the Standby member works because its outbound traffic is being NAT'd behind the active gateway the same way any other traffic destined for the Internet on your network does. 

[Maarten_Sjouw]

This option has been there in VRRP configured clusters for many years and we always turn it off, exactly because of the issue you give, each gateway needs to collect updates and needs to be able to independently get to the address it wants to access.

There is no impact on turning the option off, other than it will all the sudden start to work.

[AlekseiShelepov]

If the reply comes back from internet, destination will be the cluster ip address, so it would be routed to the active cluster member, not to the standby where it originated from.

And here is the part where I point to one my favourite kernel parameter: fwha_forw_packet_to_not_active

Updates For Anti-Virus/Anti-Bot/Application Control/URL Filtering blades are not working on standby ... 

It also helps in many different cases:

Simultaneously pinging the cluster members and the VIP address stopped working after... 

"Contract entitlement check failed" error on policy installation failure 

Cluster debug shows "FW-1: fwha_forw_ssl_handler: Rejecting ssl packets to a non-active member" 

"ERR_CONNECTION_REFUSED" error is displayed in web browser when connecting to Gaia Portal 

Connection from one side of the ClusterXL destined to the physical IP address of a non-Active cluste...