Implementing High-Availability Firewall Clusters with Single Public IP Connectivity

[SallesThiago]

Today, we have an internal cluster with two 9100 devices, and everything is working fine.

Now, we are planning to implement two new clusters: 

Cluster Y

• Two SMB 1575 devices

• Only one fixed ISP IP

Cluster Z

• Two 9100 devices

• Only one fixed ISP IP

My question is: how can the clusters communicate using only one public IP?

[ereche]

I have same issue to solve here.

[Chris_Atkinson]

You may also wish to consider ElasticXL with R82 as another option (for non Spark) as it doesn't have the same IP address requirements as traditional ClusterXL.

https://youtu.be/Ctx9Su0y-e0?feature=shared

[SallesThiago]

Using the R82 for non-Spark scenarios seems like the best approach. In the case of Spark with 3 valid IPs, will it work? Is this the best practice in this situation? I’m considering requesting additional IPs from the ISP.

[Chris_Atkinson]

The traditional method:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ClusterXL_AdminGuide/Topics-...

[sigal]

Hi,
Note that on locally managed Spark appliances running R81.10.15, you can just configure routable IP as VIP and physical (private) IPs from different subnet without the need to implement Cluster IP Addresses on Different Subnets.

Thanks.

[SallesThiago]

Yes, for other customers, we handle this through local management in Spark and work fine. However, in this case, the manager will operates centrally.