Geo Active-active Datacenter firewall architecture

[ndcosta]

Hi guys,

We are checkpoint costumer. Currently we have two VSX clusters in two geographic locations with production and disaster recovery site.

In near future we will change this to active-active architecture streching the network in both geographies using Cisco ACI with VxLAN.

Can you please advise us with the best scenario for firewall?

Do we need two clusters?

Can we have firewall instance in both geographies for the same networking "zone".

Regards,

Nuno