Using HA MGMT in a virtual environment

[Ari_who]

Hi all,

OS: Gaia R81.20

Environment: Maestro + VSX 

We have two management servers running as an active-passive HA, and both are VMs, running on a vCenter.

The vCenter servers are in two physically separate locations, one is a DataCenter, and one, a DR.

In case of failover to the DR, the entire vCenter will be available there including the Checkpoint Management server, 

as it's being replicated all the time in a hot backup.

Since there's plenty redundancy through the vCenter, Is there any point in having also a secondary Management server in this case?

Or did I miss something...

Thanks in advance!

[Chris_Atkinson · Accepted solution]

It entirely depends on the types of failures that you are attempting to guard against and what interdependencies / risks you choose to accept.

• With VSX there is greater importance on the Management than other deployment scenarios.
• VMotion is not supported by the Check Point Management platform.
• Would different/additional teams be involved in any recovery efforts?
• Are the machines currently in different IP subnets from a routing perspective?   

[the_rock · Accepted solution]

To me personally, but again its just my honest opinion, I would never bother with mgmt HA in such scenario, because if there is constant replication on vCentre side, you dont really have a need for another server.

Just my 2 cents.

Andy

[Vincent_Bacher]

Out of curiosity: What is MVP ?

[the_rock]

I know in sports it stands for most valuable player, but I believe in community context it means most valuable professional...I THINK : - )

Andy

[Vincent_Bacher · Accepted solution]

If I understand the question correctly, are you asking whether a second management server is required for each data center?
Then my answer is: No.
We also only have one MDS per data center.

[Lesley · Accepted solution]

One thing to keep in mind is the CRL check. Default is 24 hours. This is for VPN tunnels only from Check Point towards other CP's on the same mgmt! If mgmt is down to long firewalls cannot do CRL check. (CRL check can be disabled, not secure). 

HA mgmt could be handy, if you have frequent changes on the system. If system is allowed to be down couple hours I would not invest in HA mgmt.