Simple Question

[RemoteUser]

MVC is enable by deafult now? (FROM R81.20)

[Tal_Paz-Fridman]

Just looking at the relevant administration guide it should be enabled manually. Perhaps someone else has different experience:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Gui...

[RemoteUser]

I'll rephrase the question, shouldn't it be disabled by default?

[G_W_Albrecht]

You always have to enable it on the member(s) using:

set cluster member mvc on

[G_W_Albrecht]

Why should it ? See the obstacles to policy install in sk177626 first ! Next limitation: Do not add, remove, or edit settings of cluster interfaces (IP addresses, Network Objectives, and so on) while in MVC, see https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Gui...

Idea of MVC is that You can upgrade to a newer version without a loss in connectivity (Zero Downtime Upgrade) and test the new version on some of the Cluster Members before you decide to upgrade the rest of the Cluster Members or revert the upgraded.

This also is not full HA clustering as failover will not fully work (depending on the version gap).

[emmap]

In R81.20 GA it is disabled. When you install any JHF take 14 and above it is enabled, so that you don't lose clustering during the JHF install process. This information is in the notes section of the JHF documentation.

In my R82 install it is disabled, I have not changed this configuration so I think this would be the default setting in R82.

[RemoteUser]

Ok, you answered my question, so from JHF 14 onwards it is enabled by default, but I haven’t found where it says that in the JHF documentation.

Thank you very much, emmap

[emmap]

It's in the Critical Information section (used to be called Important Notes) - search for PRJ-44444 in there and you'll see the entry,

[RemoteUser]

The Multi-Version Cluster feature is enabled by default to prevent traffic loss after a failover from a cluster member running a lower Jumbo Hotfix version.

Take 14

PRJ-44444

Thank you very much emma

[RemoteUser]

Based on what's written here:

The Multi-Version Cluster feature is enabled by default to prevent traffic loss after a failover from a cluster member running a lower Jumbo Hotfix version.

it seems like it was enabled to solve issues related to Jumbo Hotfixes, but MVC isn’t designed for major versions... or am I missing something

[emmap]

It is designed for version upgrades primarily, but there was something in the code that was updated in that JHF take that also triggered essentially the same thing, ie no cluster sync when one box has the JHF and the other doesn't. I don't have any further details on what changed though. 

[RemoteUser]

Thank you very much for the explanation.

[G_W_Albrecht]

See ClusterXL Admin Guide: ClusterXL is supported only between identical Check Point software versions - all Cluster Members must be installed with identical Check Point software, including OS build and hotfixes.

[RemoteUser]

Yes, that's true, but it's already happened to me a couple of times that I kept different JHF versions for a few days and nothing ever happened. Maybe I just got lucky, haha!

[G_W_Albrecht]

As long as MVC is used...

[RemoteUser]

After JHF 14 yes