SMB Cluster - Management Interface

[leonid1890]

Hello,

I create SMB Cluster R80.20.50 via Smart Console in High Availability mode.

This cluster have s2s with Gaia 7000.

My Goal: to create managmenet inteface on each gateway of the SMB which is not monitored by the cluster 
in order to get access to each device seperatly.

In topology table I configred this interface as "Non-Monitored Private" and it is internal.

The problem is that I still got access to Avtive member interface and not to the standby.

I think this is because of the site to site.

Any suggestions?

[PhoneBoy]

What version/JHF is your management?
Setting a "Non-Monitored Private" interface isn't necessary here, but you may need to disable cluster fold NAT.
It is settable via the CLI from R81.10.00: https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/170583.htm

[leonid1890]

Hello,

My Smart Console version is R81.10

I don't use NAT on my SMB Cluster.

[PhoneBoy]

Clustering does this "NAT" by default.
It should also be settable in your software release via the CLI as well.
How precisely are you attempting to access the secondary member?

[leonid1890]

1. I checked inside my SMB Cluster NAT settings:

perform-cluster-hide-fold: false

2. I tried to access secondary cluster member via WAN or via one the LAN interfaces.

but it didn't work.

I am trying to find way to have access both of cluster members when the site to site is working.

[PhoneBoy]

How are you attempting to perform this access?
Have you used tcpdump to see if the traffic is reaching the secondary member or not?

[leonid1890]

Trying access via SSH / HTTPs

I can't used tcpdump on the secondary member because I don't have access when site to site is working.

When I remove site to site I have access to both of the Cluster members via WAN interface.

[the_rock]

Might be worth TAC case or do remote session, sounds like something simple might be missing here.

Best,

Andy

[PhoneBoy]

With the VPN in place, it would be expected for the traffic to traverse the primary node.
However, you should still be able to:

• Reach the primary node
• SSH from the primary node to the secondary node

Are you able to do that?
I also think working with TAC on this would be advisable.

[leonid1890]

Ok thanks, I will check with TAC