Operating ClusterXL in LS mode

[Matlu]

Hello, everyone.

Currently, we have a ClusterXL operating in HA mode.

By an explicit request from the customer, it requires to change the operation mode to Load Sharing.

When we try to do this, the following warning message appears.

Is this "alert" common to all scenarios where the operating mode is changed to LS?

I checked the SK, but currently, the client is not taking advantage of the MOB blades, nor IPsec VPN (these services do not work in the Cluster).

Is it necessary to apply the SK recommendation in this scenario?

Could someone explain me, what is the difference between choosing the LS in a Multicast or Unicast mode?

It is very important to know which of these modes to choose?

Thanks for your comments.

[the_rock]

Yes bro, you need to follow the sk and below is reference for the differences.

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ClusterXL_AdminGuide/Content/Topic....

[Matlu]

If it makes sense what you are explaining to me.

But you know how customers are, many do not want to pay attention to recommendations.

I understand according to the documentation I have read, that working the LS in Unicast mode, "balances" the traffic load, in a range of 30-70%, for each GW of the Cluster, right?

[the_rock]

Trust me mate, I had been literally all over the world, so I am very familiar with most cultures : - ). As far as Brazil, I know people can be little hesitant to change (but, in all fairness, most people are like that lol), but having said that, as long as you properly explain to them the downsides, Im sure they will understand.

Out of curiosity, what is their number 1 reason for wanting to do LS mode?

Andy

[PhoneBoy]

In Unicast mode, one member is the "pivot" which means it receives all traffic.
It will process 30% of the traffic and forward the rest (70%) to the other node to process.

ElasticXL in R82 will provide better load sharing (similar to Maestro).

[the_rock]

By the way, just me personally, I would NOT recommend they use this mode, specifically due to all the limitations. 

https://support.checkpoint.com/results/sk/sk101539

Also, think about it. Some customer would say to you, yea, but its sharing the load, so its better...um, not exactly. Here is why I say that...in clusterXL, one member will always process traffic and if there is an issue, other one takes over, so its ready to keep processing the traffic and thats more convenient, as there was no load on that firewall at all, until main one faultered.

Makes sense?

Andy

[Bob_Zimmerman]

If they're going with load sharing because they have too much load for one member, two members won't be able to carry the load safely. If either member fails, you're down to one member which you know can't carry the load. This actually increases the chance of a whole-cluster failure in the same way RAID 0 increases the chance of the whole volume failing.

Additionally, unicast load sharing only gives about 60% of the single-member throughput capacity per member. Two members gives you about 120% what one member could do. Three members gives you about 180% of what one member could do.

For a load sharing cluster to be effective and to have capacity to tolerate a member failing, they should have a minimum of four members.