Checkpoint 3800 SMB ClusterXL

[superd]

Hi all,

Im trying to deploy two Checkpoint 3800s with ClusterXL.

Ive enabled clusterXL using cpconfig. And its telling me I need a policy pushed in order to start the HA module. 

FW02:0]# cphastart
cphastart: Policy should be installed to run the command

I understand the clusterXL settings will be primarily deployed from SMS server. But from the local firewall point of view theres no HA sync interface, so Im trying to understand how the firewalls physically connect for HA sync. Is it just a matter of enabling HA sync on one of the ETH ports, and connecting back to back?

Im running R80.40, and ultimately they will be managed by an Azure SMS server.

Note, the boxes are not licensed yet. Ideally this will be deployed from the Azure SMS centrally.

One other question as an aside, when managing on prem FWs from an Azure SMS server, how does the licensing work, in terms of the central IP address - does it make more sense to do local licensing?

Cheers.

[_Val_]

Can you please explain what you mean by saying: "But from the local firewall point of view theres no HA sync interface, so Im trying to understand how the firewalls physically connect for HA sync"

When you will be configuring the cluster in SmarConsole, you will have to chose one of NICs to be a sync. What do you mean "by local firewall point of view"?

[superd]

Ah ok, so the actual sync interface is defined on SMS?

From a previous firewall deployment, I had a physical HA interface for sync. I guess that was throwing me off. 

So essentially, should I just select an unused ETH port and connect it back to back, and then configure the sync IP addressing on the SMS server?

[Chris_Atkinson]

That's pretty much it, in SMS you fetch/configure the Gateway interface topology as you've configured on the appliance via Web UI/CLI.

It's here you also define the VIP for each non Sync interface.

[superd]

Thanks Val and Chris - appreciate the prompt respones.

Would you have any thoughts on my licensing query?

One other question as an aside, when managing on prem FWs from an Azure SMS server, how does the licensing work, in terms of the central IP address - does it make more sense to do local licensing?

For central licensing of the SMB GW, do I need a static IP for the SMS server?

[Chris_Atkinson]

For reference sk155632 talks to some of the caveats of your choice of IP/License mapping during upgrades.

[Bob_Zimmerman]

The interface which is labeled "Sync" on other boxes is just an interface with a weird name. There's nothing at all special about it. Any interface (or set of interfaces bonded together) can be used for state sync.

Sync should always be run through a switch. Direct-wired sync can cause the remaining member to refuse to take over the cluster if a member fails.