Question about dual MHO & Multisite

[Alex-]

We are preparing a multisite installation and would like to clarify a couple of questions.

Right now we have one MHO foreseen per site and one SGM but there will be growth.

As such we are considering a second MHO per site for local redundancy.

Let's say we plan an aggregated 2*40G uplink from the MHO to the customer's LAN, can we use 1*40G on each MHO and get the full capacity or do we have to foresee 2*40G per MHO, so 4*40G uplinks in total, which will require a change at the switching level.

Thanks for any clarifications on this matter.

[Chris_Atkinson]

Capacity or actual throughput will be more dependent on the SGM population and other factors...

In general if the intent is to use LACP (802.3AD) Bonds with Layer-3+4 hashing it should behave as expected.

[emmap]

To expand on Chris' answer here, the MHOs on the active site are both actively on the network. The LACP hashing and whatnot is managed by the SGMs, so which MHO the interfaces are on doesn't matter, they are all actively part of the bond. Any packet that lands at MHO1 uplink will go down the downlink to the designated SGM directly, and anything that lands at MHO2 will go down its downlinks. The TX hashing is managed at the SGM and the packets send out the downlinks up to the MHO that holds the interface that the hashing decided to use. So yes, as long as your downlink connectivity isn't a bottleneck, you will get the full throughput expected from bonding two interfaces, one from each MHO.

[Alex-]

Thanks Emma and Chris for the clarification. We are planning high-end appliances for this setup with MHO-175.

Since the uplink switches already redundant in a virtualised setup, only the MHO on each site remained a single point of failure  locally.

Bonus question: can we/should we have dual sync between the sites?

[emmap]

Yes/sure if you want. 

If your site sync links are going over switches please make sure you've read and understood the requirements there.

https://support.checkpoint.com/results/sk/sk168092

[Alex-]

Great, many thanks!