In an HA environment disable CCP packet check on specific interfaces

[AkosBakos]

Hi Community,

I want to disable or switch off the CCP packet check on specific interfaces. Only on 1 interface out of 8.

So if the CCP packet is not receiving on this interfaces, this will not cause cluster failover.

Is it possible somehow?

BR

Akos

[Timothy_Hall]

Yes just define the desired interfaces as Network Type "private" in the topology of the cluster object.  However I don't think you are allowed to present a cluster/virtual IP address when the interface is in this mode; the firewalls just use their dedicated fixed IP addresses on the private interface.

[AkosBakos]

Hi Timothy,

Yes, this can be a solution, but I need to present 1 IP as gateway, so this can't be a solution.

An I forgot one important thing, this is an SMB cluster R80.20.15

BR

Akos

[mcatanzaro]

You can configure the interface to only monitor the physical link rather than CCP packets:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/CXL...

[AkosBakos]

Hi,

Thanks for the information.

After I posted my question, I found this article

An I forgot one important thing, this is an SMB cluster R80.20.15. The article belongs to R81. Is it applicable on SMB appliances as well?

BR

Akos

[mcatanzaro]

Not sure if you can do this on Gaia Embedded.

@PhoneBoy  @_Val_ 

Can you guys move this to the SMB forum

[_Val_]

@mcatanzaro Done. It was not obvious from the start that this is an SMB issue 🙂

[AkosBakos]

You are right, Sorry about that

[G_W_Albrecht]

This is not possible on locally managed SMBs. On centrally managed, you can configure it: When High Availability is disabled on the interface, the interface is considered non-monitored private (not part of the cluster configuration).

See Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.30 Centrally Managed Administration Guide p.23

[AkosBakos]

@G_W_Albrecht 

Yes, it is a centrally managed SMB cluster. If I set non-monitored private, it will cause lost the ability of the virtual IP which is really important in that two trunc interface.

I know the cluster prerequisites, which describes between cluster interfaces must be layer 2 connection....

In a nutshell:

There is a special device with two interfaces:

On the special device (appliance) eth1 and eth2 is a linux bond trunc interface. This device is probing its default gateway on both interfaces. The traffic will flow on that IF, which receives the ARP answer faster. 
And no, I can't put an active device there (router, switch, etc.) It is prohibited.

This is a very special scenario

Any idea will appreciate

[G_W_Albrecht]

Open an SR# with TAC !

[AkosBakos]

Done 🙂