Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
nicholas_rowe
Participant

Smart-1 5050 best practice guidance

We are currently looking at deploying 3 Smart-1 5050 Mgmt svr appliances in an Active/standby/standby posture. We've been looking through the checkpoint documentation looking for guidance on how best to use the multiple network interfaces (1 mgmt and 3 others Gig ports). Specifically of concern is what is the dedicated Mgmt port to be used for? Is it just for smart console to access the Mgmt server? if so the Mgmt server object IP will be tied to the dedicated Mgmt interface? If that's the case how can we best use the 3 other Gig interfaces......How can we establish SIC with a remote gateway through the other interfaces if the Mgmt server IP is tied to the dedicated Mgmt port.....Just looking for best practice and maybe some recommended architectures that best use all 4 ports.

5 Replies
PhoneBoy
Admin
Admin

The management interfaces are just labeled this way on the Smart-1 and most gateways (44000/64000 being the notable exception).

You can theoretically use any interface for management-related traffic (be it SIC, SmartConsole traffic, etc).

0 Kudos
AlekseiShelepov
Advisor

I would recommend to aggreagte two-three physical interfaces into one logical bond interface. HA or LoadSharing bond that's your choice, but I think 1 Gb/s interface is enough for management usually. Maybe in some cases with very heavily used environments it would be useful to increase maximum speed and for backup purposes.

This bond interface can be used as the main interface for everything, IP address of the bond can be used in the management server object. Physical Mgmt port can be disabled, added to the bond interface or used later for some additional purposes. As Dameon mention, all ports are the same, just Mgmt interface is usually used for initial config with pre-configured IP.

0 Kudos
nicholas_rowe
Participant

Ok, so basically what your saying is that there is no real use case for having multiple IP's on the smart-1 mgmt server, as a Mgmt server should always have a single IP address.

0 Kudos
PhoneBoy
Admin
Admin

There is no requirement (from the Check Point perspective) to utilize more than a single interface.

You may have environment-specific requirements that dictate the use of multiple interfaces (either thru bonding or using secondary IP/interfaces).

0 Kudos
Maarten_Sjouw
Champion
Champion

The only reason to add a management network would be to offload the transfer of your backup file to the backup server so it will not interfere with logging when under heavy load of the gateways.

Just out of curiosity, why are you deploying 3 units? To spread a large number of domains over 3 boxes or really as HA?

Regards, Maarten

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events