- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Cloudguard R80.10 gws running on a VMWARE NSX-V Cl...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cloudguard R80.10 gws running on a VMWARE NSX-V Cluster - Is state sync working when VMs are moved?
We have Cloudguard R80.10 gws [48 of them] running on a VMWARE NSX-V Cluster 's hosts.
These Cloud guard gws are managed by R80.40 manager.
When VMs are moved between hosts in the VMWARE cluster, all connections drop, and we were of the understanding that all individual Cloudguard gateways are in sync, so that when VMs are moved, traffic will flow without drops [ie... without seeing First packet is no syn].
When I looked at fw tab -t connections -s in individual gateways, I can see the numbers are very different, meaning, Cloud guard gateways are not in sync so it is obvious that when VMs move between hosts in the VMWARE cluster, Is there any fix or workaround that we can apply? This must be a common issue for many out there.
I dont see there is any mechanism that runs among these Cloud guard gateways to do tcp/ udp state synchronisation like Cluster XL, so I can guess the answer. I am bit confused because at the time of selling the product, we questioned the same feature and the answer was it does keep "in sync" the statetable among Cloud gurads, not sure whether we tried that indeed in a lab and took the word on its own merit.
So your expert reply is very much appreciated with any tips and tricks.
Thank you and Kind regards,
Kanishka
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, the cluster object itself should have dedicated sync network. Considering the nature of your question, I would advise looking for professional services engagement with Check Point or a third party having some experience in this kind of deployment.
If not, build a lab environment, study the guide and make it work in the lab first, to build up expertise.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you configure your group of CloudGuard gateways as a cluster object (CloudGuard NSX Admin Guide, page 34 and below)?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you _Val_.
Please see below. Yes we have a cluster defined and the same policy is applied to all members.
How do I verify state sync is happening and all the members have the same tcp state info, (and udp state info as well if applicable for udp).
Appreciate your reply with thanks.
Kanishka
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
cphaprob stat on any of the cluster members should show you the cluster status.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi _Val_
It says "HA module not started". What steps can I take to enable HA among members?
Thank you
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"cpconfig", look for clusterxl settings. Also, policy push is required again.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you _Val_.
Did you mean this option (as attached) in the Cloudguard R80.10 gateway?
Is this service impacting to enable it? Do I want a maintenance window?
Many Thanks
Kanishka
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes and yes
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, the cluster object itself should have dedicated sync network. Considering the nature of your question, I would advise looking for professional services engagement with Check Point or a third party having some experience in this kind of deployment.
If not, build a lab environment, study the guide and make it work in the lab first, to build up expertise.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks _Val_. We are going to enable Sync link and ClusterXL in a maint window. Thanks for the replies which clarified what should be done.