Smart-1 5050 best practice guidance

[nicholas_rowe]

We are currently looking at deploying 3 Smart-1 5050 Mgmt svr appliances in an Active/standby/standby posture. We've been looking through the checkpoint documentation looking for guidance on how best to use the multiple network interfaces (1 mgmt and 3 others Gig ports). Specifically of concern is what is the dedicated Mgmt port to be used for? Is it just for smart console to access the Mgmt server? if so the Mgmt server object IP will be tied to the dedicated Mgmt interface? If that's the case how can we best use the 3 other Gig interfaces......How can we establish SIC with a remote gateway through the other interfaces if the Mgmt server IP is tied to the dedicated Mgmt port.....Just looking for best practice and maybe some recommended architectures that best use all 4 ports.

[PhoneBoy]

The management interfaces are just labeled this way on the Smart-1 and most gateways (44000/64000 being the notable exception).

You can theoretically use any interface for management-related traffic (be it SIC, SmartConsole traffic, etc).

[AlekseiShelepov]

I would recommend to aggreagte two-three physical interfaces into one logical bond interface. HA or LoadSharing bond that's your choice, but I think 1 Gb/s interface is enough for management usually. Maybe in some cases with very heavily used environments it would be useful to increase maximum speed and for backup purposes.

This bond interface can be used as the main interface for everything, IP address of the bond can be used in the management server object. Physical Mgmt port can be disabled, added to the bond interface or used later for some additional purposes. As Dameon mention, all ports are the same, just Mgmt interface is usually used for initial config with pre-configured IP.

[nicholas_rowe]

Ok, so basically what your saying is that there is no real use case for having multiple IP's on the smart-1 mgmt server, as a Mgmt server should always have a single IP address.

[PhoneBoy]

There is no requirement (from the Check Point perspective) to utilize more than a single interface.

You may have environment-specific requirements that dictate the use of multiple interfaces (either thru bonding or using secondary IP/interfaces).

[Maarten_Sjouw]

The only reason to add a management network would be to offload the transfer of your backup file to the backup server so it will not interfere with logging when under heavy load of the gateways.

Just out of curiosity, why are you deploying 3 units? To spread a large number of domains over 3 boxes or really as HA?