R82 - ElasticXL

[HeikoAnkenbrand]

ElasticXL is a new cluster technology that enables simplified operation with a single management object with automatic configuration and software synchronisation between all cluster members.

ElasticXL is expected to be delivered with R82 or later versions. ElasticXL is based on similar technology to Maestro, but without MHOs. It is based on Check Point's SP versions for a scalable platform that allows you to increase the performance of the security gateways almost linearly.

This is achieved naturally by load balancing between individual gateways that operate in a cluster as a single entity.

This new cluster technology will some of the Maestro featchers such as SMO (Singel Management Object) use.

A ElasticX gateway will work as a pivot member and act simelar as a MHO's in a Maestro environment and simultaneously takes on the role of SMO.

The pivot member takes over the network connection and controls the ARP requests in the network. The pivot member distributes the connections via a distribution matrix to the connected member in the security group similar to a Maestro environment.

Same as the Maestro environments, the familiar SP commands will also be available here and there will also be a gclish. The management traffic will be handled by the SMO (pivot member).

Installation process:

1) The gateways are installed as usual via the First Configuration Wizard. ElasticXL" is now selected instead of "ClusterXL" on the product page.
2) After that, the SIC to the first gateway (pivot member) will be established single gateway (not as a cluster object). Afterwards, the policy can be installed.
3) In the following step the next gateways can be added by (host name, serial number).

Here you can find detailed installation information about ElasticXL:
Install ElasticXL Cluster

>>> Please note that this information is not yet an official statement from Check Point and may change at any time. <<<

[Mikula83]

Hello PhoneBoy,

you said that for an HA-only cluster (no load sharing) you have to set up ElasticXL as "Dual Site" where each site has a single member. This is very useful information, it's like you have active and standby gateway in ClusterXL HA but realised as ElasticXL.

But I think that is better to have a both gateways as Active/Active to process traffic equally, to waste CPU and memory equally than to have one standby gateway which doesn't work anything (it only waiting for something to happen with active gateway).

I think that ElasticXL has a lot of benefits compared to ClusterXL (configuration, management, performance, etc).

I will prefer to use ElasticXl in some future configurations, when Gaia R82 become recommended version.

As far as I know, currently there is no a way to automatically convert ClusterXL to ElasticXL but I'm very interested in how to do it in future, what are the steps and what is the down time?

Best regards,

Milan Babic

[PhoneBoy]

We are planning a migration tool of sorts for converting from ClusterXL to ElasticXL.
Not sure on the exact timing of this, but it might be by the time R82 is considered the recommended version. 🙂

[the_rock]

I was playing around in demo point R82 elastic XL and its great. I never realized you do failover with same command clusterXL_admin down like normal clusterXL.

Andy

[ShaiF]

Hi @the_rock ,

Our recommendation for site or member failover to use either from gclish:

[Global] SMO-s01-01> set cluster members-admin-state
[Global] SMO-s01-01> set cluster sites-admin-state

end from expert to use the new command cluster-cli(if you run it without param you will get textual UI which will show you all options) 

[Expert@SMO-s01-01:0]# cluster-cli set --help
Usage: cluster-cli set [OPTIONS] COMMAND [ARGS]...

Cluster set commands. Tip: Use shortcut command 'cset'

Options:
--help Show this message and exit.

Commands:
members-admin-state Manage the administrative state of cluster members.
members-reboot Reboot members command Will apply to all given...
sites-admin-state Manage the administrative state of cluster sites.

without param, see attached screenshot

Regards,

Shai

[the_rock]

Okay, good to know!

Andy