Question about Sync Interface Routing in Check Point Cluster

[Solitude]

Hello team,

I'm new with Checkpoint, and I have a question about the feature in Cluster, hope you can help me answer.

I would like to ask about the possibility of routing through the Sync interface in a Check Point Cluster running in Active-Active mode.

Is there any feature in the cluster_XL that allows data traffic to be transferred via the Sync port between the two appliances?

For example, in the case below:

 

If the two uplinks (marked with red X) are down, can the host on the lower side still reach the Internet by rerouting traffic through the Sync interface between the two firewalls?

I'm tried to search for a solution but still no luck.

Best Regards.

[Danny]

Rerouting traffic is not required if a cluster member fails.
The host always talks to the Virtual Cluster IP (VIP) 192.168.1.1.

[Solitude]

I’m aware of the Virtual IP mechanism but If LAN2 goes down (On the right), is there any way for users to still reach the Internet via the Sync interface (the cluster sync link) as a fallback path?

[Chris_Atkinson]

The topology is not valid, all segments should have a VIP hence this shouldn't be a requirement.

In your example the healthiest member will be active-attention.

Utilize bonds for link protection where needed.

[emmap]

There is no mechanism to allow data traffic to traverse the Sync link. This is by design to isolate critical sync traffic from the rest of the network and to eliminate a possible bottleneck on that link.