Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
kanishkaw
Participant

Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are moved?

Jump to solution

We have Cloudguard R80.10 gws [48 of them] running on a VMWARE NSX-V Cluster 's hosts.

These Cloud guard gws are managed by R80.40 manager.

When VMs are moved between hosts in the VMWARE cluster, all connections drop, and we were of the understanding that all individual Cloudguard gateways are in sync, so that when VMs are moved, traffic will flow without drops [ie... without seeing First packet is no syn].

When I looked at fw tab -t connections -s in individual gateways, I can see the numbers are very different, meaning, Cloud guard gateways are not in sync so it is obvious that when VMs move between hosts in the VMWARE cluster, Is there any fix or workaround that we can apply? This must be a common issue for many out there.

I dont see there is any mechanism that runs among these Cloud guard gateways to do tcp/ udp state synchronisation like Cluster XL, so I can guess the answer. I am bit confused because at the time of selling the product, we questioned the same feature and the answer was it does keep "in sync" the statetable among Cloud gurads, not sure whether we tried that indeed in a lab and took the word on its own merit.

So your expert reply is very much appreciated with any tips and tricks.

Thank you and Kind regards,

Kanishka

0 Kudos
1 Solution

Accepted Solutions
_Val_
Admin
Admin

Also, the cluster object itself should have dedicated sync network. Considering the nature of your question, I would advise looking for professional services engagement with Check Point or a third party having some experience in this kind of deployment. 

If not, build a lab environment, study the guide and make it work in the lab first, to build up expertise. 

View solution in original post

9 Replies
_Val_
Admin
Admin

Did you configure your group of CloudGuard gateways as a cluster object (CloudGuard NSX Admin Guide, page 34 and below)? 

0 Kudos
kanishkaw
Participant

Thank you _Val_.

Please see below. Yes we have a cluster defined and the same policy is applied to all members.

How do I verify state sync is happening and all the members have the same tcp state info, (and udp state info as well if applicable for udp).

Appreciate your reply with thanks.

Kanishka

0 Kudos
_Val_
Admin
Admin

cphaprob stat on any of the cluster members should show you the cluster status. 

kanishkaw
Participant

Hi _Val_

It says "HA module not started". What steps can I take to enable HA among members?

Thank you 

 

0 Kudos
_Val_
Admin
Admin

"cpconfig", look for clusterxl settings. Also, policy push is required again.

kanishkaw
Participant

Thank you _Val_.

Did you mean this option (as attached) in the Cloudguard R80.10 gateway?

Is this service impacting to enable it? Do I want a maintenance window?

Many Thanks

Kanishka

0 Kudos
_Val_
Admin
Admin

yes and yes

_Val_
Admin
Admin

Also, the cluster object itself should have dedicated sync network. Considering the nature of your question, I would advise looking for professional services engagement with Check Point or a third party having some experience in this kind of deployment. 

If not, build a lab environment, study the guide and make it work in the lab first, to build up expertise. 

View solution in original post

kanishkaw
Participant

Thanks _Val_.  We are going to enable Sync link and ClusterXL in a maint window. Thanks for the replies which clarified what should be done.

0 Kudos