MDS and VSX

[Ivo_Marques]

Dear Mates,

We are starting a new MDS R80.10 with several VSX clusters and we also have two sites geographically distants, On R77.30 and below the logic was a DOMAIN for all the VSX Cluster and a Domain for each VS.

Someone suggest us to use the GLOBAL Domain to put the VSX Cluster. This is even possible? What are the advantages? Do anyone recommend it?

Regards,
Ivo

[Maarten_Sjouw]

No you can't use the global, why: you can't push any policy from global to the gateways.

The practice to use a separate domain for the physical cluster is that you cannot mess it up from any of the VS based domains.

We are an MSP that supply managed services to our customers, some of them use VSX and when they do and they are allowed to do management themselves you also need to allow them Write access to the domain containing the VSX boxes.

We have come to the following differentiation:

• When the hardware is dedicated to a customer and all VS'es are managed from the same domain, put these boxes in the same domain. (we have a couple of these kind of customers)
• When the hardware is dedicated to a customer and that customer wants to have multiple domains, we can set it up this way.
• When we install a Shared environment with many different customers we put the VSX Boxes in a seperate domain with those VSX boxes in it only. (we have multiple clusters in 1 domain for this type of setup)
• Last but not least, we also have situations where we need an additional FW but do not have the hardware within the contract to add another, we set the machine up as a VSX machine/cluster and use the ability within the Appliance license to add 1 VS. This way you have a Physical gateway and a VS on top of it. In a cluster you can even get the 2 boxes to run an instance each, so VS0 on FW1 and VS1 on FW2.

Hope this helps a bit?

[Ivo_Marques]

Thanks Marteen for your help and sorry for the late response.

We are on the same page - We are doing the VSX implementation in the same way but I didn't understand the last paragraph - somtimes you use the VS0 for a customer, that it?

Best regards,

Ivo

[Maarten_Sjouw]

When you need 2 firewalls for a customer and you cannot get the customer to pay for another you can use the same box with VSX and you use both VS0 and VS1.

All you need is sufficient interfaces. In one case I have a cluster running, where member 1 is handling traffic for VS0 and member 2 is handling all traffic for VS1.

Works all just fine.