SmartLSM Clusters

A SmartLSM Cluster is a logical entity that provides high-availability VPN connectivity by using two devices, each serving as an entry point to the same network. In a SmartLSM Cluster, there is no state synchronization between the devices: if the active SmartLSM Cluster member becomes unavailable, users are not automatically connected to the other member. The party that initiated the communication must actively intervene to reconnect the users.

To create a SmartLSM Cluster, you need two UTM-1 Edge SmartLSM Security Gateways. A gateway can participate in only one SmartLSM Cluster at a time.

To create a topology in which two UTM-1 Edge SmartLSM Security Gateways serve as entry points to the same network, a mechanism such as VRRP clustering must be configured for that network. This configuration handles the routing in situations where only one of the gateways is available, as well as in situations where both of the gateways are available.

Overview

The basic procedure for creating and configuring SmartLSM clusters includes these steps:

1. Create a SmartLSM security profile in SmartDashboard. Profiles set common parameters and policies for SmartLSM clusters created using that profile.
2. Create SmartLSM cluster objects in SmartProvisioning based on a SmartLSM security profile.
3. Configure parameters for individual networks using SmartProvisioning, or using LSMcli commands.

You define these common parameters in SmartLSM a cluster security profile:

• Cluster members.
• Cluster member physical interfaces.
• Interface network objective (Cluster, Sync etc.).
• Cluster interface names.
• Cluster and member interface IP addresses and net masks.
• When you create a SmartLSM cluster security profile, define complete IP addresses. These addresses are placeholders and you can override them when you create SmartLSM cluster objects in SmartProvisioning.

• Cluster and member name components - It is convenient to have a component of cluster and cluster member names describe the specific cluster, and another component, common to all clusters that are mapped to a given Profile, reflect the relative function in the cluster. The common component is defined at the Profile level. The cluster-specific component is defined in SmartProvisioning for the specific cluster, as a prefix or a suffix to the common component. For example, you could have two two-member clusters, named First_cluster and Second_cluster. You could then name the respective members First_member1, First_member2, Second_member1 and Second_member2. In this example, you would define the names _cluster, _member1 and _member2 at the Profile level. Then, when you define individual clusters, you will need to define only the names First and Second as name prefixes.

SmartProvisioning Clusters can be managed either by a Security Management Server or by a Domain Management Server.

Managing SmartLSM Clusters

Creating a SmartLSM Profile

A SmartProvisioning Security Cluster profile is a template for policies that apply to SmartLSM clusters. When you define a new SmartLSM cluster, you select the SmartLSM profile to automatically assign the configuration settings and security policies. Use SmartDashboard to create SmartLSM Security Cluster Profiles.

When you make a new SmartLSM cluster using a profile, define prefixes and suffixes for the profile name to form the full cluster name. This makes it easy to identify which SmartLSM profile is assigned to a cluster.

To create a SmartLSM Security Cluster Profile:

1. In SmartDashboard, right-click Check Point in the Network Objects tree.
2. Select SmartLSM Profile and then select the cluster you want:
   • Check Point Appliance/Open Server Cluster
   • 80 Series Cluster

   The Cluster Profile window opens.

3. On the General Properties page, do these steps:
   1. Enter the profile Name.
      The profile name becomes the middle section of all SmartLSM cluster names that you define using this profile.
   2. If your clusters use a third-party clustering platform (such as IPSO or Crossbeam), clear ClusterXL.

   Note - When using third party cluster platforms, create a different SmartLSM Profile for each platform type.

   1. Make sure that IPSec VPN is selected, if clusters using this profile are part of a VPN community.
4. On the Cluster Members page, add members to the Profile. These member names become the middle section of all member names defined using this Profile.
5. Configure the applicable parameters on the ClusterXL or 3rd Party Configuration page.
6. On the Topology page, click Edit Topology.
7. Configure each interface in the cluster column. Set the options in the Topology tab. The information in the other two tabs is according to the information in the Topology spreadsheet.

   Use these guidelines:

   • Make sure that the number of interfaces and their network objectives match those of the physical SmartLSM clusters.
   • For interfaces with Private or Sync network objectives, do not enter information in the Cluster column.
   • Every SmartLSM cluster mapped to this Profile will retain the host parts (by net mask) of the member IP addresses, and the name of the cluster (virtual) interface.
     • The network parts of the members’ IP addresses and the whole cluster IP addresses are here only place holders. You will later define them in SmartLSM for each SmartLSM cluster.
     • Make sure that the host ID for the external interface of the SmartLSM cluster profile is the same as the actual external interface of the cluster.
   • The network parts of the members IP addresses must be identical for the same interface name, even though they are only place holders.
   • Profile member interface names can be overridden for the actual SmartLSM cluster. However, they are usually the same for all clusters (eth0, eth1 and so on), so it is convenient to use the actual names here as well.
8. Optionally change the Fetch Policy interval on the Fetch Policy page.

   Select a Scheduled Event or create a new one.

9. Configure other parameters as required. You define VPN domains for cluster objects using SmartProvisioning.
10. Click OK to confirm the settings, and save the Policy Package.
11. In SmartDashboard, install policies to the cluster Profile.

Configuring SmartLSM Clusters

Before you define a SmartLSM cluster, there must be an applicable SmartLSM Security Cluster Profile definition in SmartDashboard. Use SmartProvisioning to create and configure a SmartLSM cluster. SmartDashboard must be closed or in Read Only mode.

To define a SmartLSM Cluster

1. From the File menu, select New > SmartLSM Cluster.
2. Enter a Cluster Name Prefix and/or Suffix to be added onto the Profile cluster and member names.
3. Enter the main IP address of the SmartLSM cluster, and click Next.
4. Define the SmartLSM Cluster Version and the SmartLSM Security Cluster Profile. Click Next.
5. Verify the resulting names, and click Next.

   The network overrides window opens. This window shows the interface topology defined on the Cluster Profile object in SmartDashboard. The profile topology includes generic (template) IPs for any SmartLSM Cluster mapped to this profile. The IP addresses in the list can be overridden with new values for a specific SmartLSM Cluster.

6. Select each interface and Edit it.

   The settings here will override Profile settings.

7. For each interface, define:
   • The Members’ Network Override address (usually the same for all interfaces).
   • Members’ interface Name Override (must match the name defined in the operating system)
   • The Cluster IP Address and Net Mask.

   For fields left empty, the values will be taken from the Profile. You can define the overrides later on by editing the cluster object. You can also override interface topology by editing the cluster object.

8. Click Next.
9. Select each member, and, for each member, Initialize SIC communication (alternatively, you can do this later - edit the member object and, in the General tab, click Communication). The Communication window opens. SIC will be actually initialized only upon completing the wizard.
10. Click Next.
11. Specify whether to create a VPN certificate for the cluster.

    The certificate will be actually created only upon completing the wizard. You can, later on, create VPN certificates for the individual cluster members - edit the member object and, in the VPN tab, click Generate.

12. Click Next.
13. Specify whether you will want to configure additional cluster options (such as VPN settings or Dynamic Objects) once the SmartLSM cluster object is created, and click Finish.

    SmartProvisioning creates the SmartLSM Cluster object and its members.

    Note - Once a SmartLSM Cluster is defined and mapped to a Profile, do not add or remove a member or an interface. Do not change a cluster (virtual) interface name.

14. To retrieve the policy for the first time, from the command line of each SmartLSM Cluster member, run:

    fw fetch_robo -n -f

Additional Configuration

You can configure the above and additional properties (VPN, Dynamic Objects, SIC etc.) by double-clicking cluster and/or member objects in SmartLSM. Member properties are also accessible from the Cluster tab of the cluster properties.

Various SmartLSM and ClusterXL options and commands are available for SmartLSM Clusters.

Pushing a Policy

In the general SmartLSM system, you can manually push a policy to a SmartLSM gateway. For a SmartLSM cluster, push the policy to the cluster object. All the cluster members will receive the policy.

To push a policy to a SmartLSM cluster:

1. Right-click the SmartLSM cluster object in SmartLSM.
2. From the Action menu, select Push Policy.

   You can also push a policy using the command line interface.

Command Line Reference

This section covers:

• LSMenabler
• LMScli

LSMenabler

This general LSM command applies to SmartLSM Clusters.

To view parameters and the current LSM definition (Security Management Server, SmartLSM gateway etc.), run LSMenabler with no parameters.

Managing SmartLSM Clusters with LSMcli

Using the LSMcli command, you can define SmartLSM clusters, and configure most of the options available in SmartLSM (in the New SmartLSM Cluster wizard and in Edit windows).

The LSMcli command syntax is:

LSMcli [-d] <server> <user> <pswd> <action>

This section lists available actions for SmartLSM Clusters. Substitute the command syntaxes in this section for the <actions> field in the above syntax.

What You Can Do with LSMcli

The main SmartLSM Cluster actions are:

• Define a new SmartLSM cluster
• Change a SmartLSM cluster main IP address
• Resolve a dynamic object for a SmartLSM cluster
• Set the VPN domain of a SmartLSM cluster
• Define the topology of a cluster (virtual) interface (external/internal, anti-spoofing etc.)
• Manage overrides for cluster members’ interface names and network addresses, and for cluster interface IP addresses and net masks
• Delete a SmartLSM cluster

AddROBO VPN1Cluster

You can define a new SmartLSM cluster with the AddROBO VPN1Cluster action. You can configure all of the options available in the New SmartLSM Cluster wizard, with the AddROBO VPN1Cluster command parameters. The only exception is the Topology overrides.

To define a new SmartLSM cluster, substitute the following for <action> in the LSMcli syntax:

AddROBO VPN1Cluster <Profile> <MainIPAddress> <NameSuffix> [-S=<SubstitutedNamePart>] [-CA=<CaName> [-R=<KeyIdentifier#>] [-KEY=<AuthorizationCode>]]

where the parameters are:

ModifyROBO VPN1Cluster

-I - Changing the Main IP Address

You can change a SmartLSM cluster main IP address either in the Cluster tab of the cluster Edit window (double-click the cluster object), or with the ModifyROBO VPN1Cluster action.

To change a SmartLSM cluster main IP address with the ModifyROBO VPN1Cluster action, substitute the following for <action> in the LSMcli syntax:

ModifyROBO VPN1Cluster <ROBOClusterName> -I=<MainIPAddress>

where <ROBOClusterName> is the cluster name, and

<MainIPAddress> is the new IP address.

-D - Resolving a Dynamic Object

You can resolve a dynamic object for a SmartLSM cluster either in the Dynamic Objects tab of the cluster Edit window (double-click the cluster object), or with the ModifyROBO VPN1Cluster action.

To resolve a dynamic object for a ROBO cluster, substitute the following for <action> in the LSMcli .syntax:

ModifyROBO VPN1Cluster <ROBOClusterName> -D:<DO Name>=<IP|IP1-IP2>

where

<ROBOClusterName> is the cluster name,

<DO Name> is the Dynamic Object name, and

<IP|IP1-IP2> is an IP address or a range of IP addresses.

ModifyROBOTopology VPN1Cluster

You can set the VPN domain of a SmartLSMcluster either in the VPN Domain area in the Topology tab of the cluster Edit window (double-click the cluster object), or with the ModifyROBO VPN1Cluster action.

To set the VPN domain of a SmartLSM cluster, substitute the following for <action> in the LSMcli syntax:

ModifyROBOTopology VPN1Cluster <RoboClusterName> -VPNDomain=<not_defined|external_ip_only|topology|manual>

The parameters are the same as in the regular (non-cluster) ModifyROBOTopology VPN1, at the cluster level.

ModifyROBOManualVPNDomain

This general LSM command applies to SmartLSM Clusters, with the same syntax, using the cluster name for <ROBOName>.

ModifyROBONetaccess VPN1Cluster

You can, for the actual SmartLSM cluster, override the profile topology definitions of a cluster (virtual) interface either by Editing the interface in the upper half of the cluster Topology tab of the cluster Edit window, and then going to the interface Topology tab, or with the ModifyROBONetaccess VPN1Cluster action.

To define the topology of an interface, substitute the following for <action> in the LSMcli syntax:

ModifyROBONetaccess VPN1Cluster <ClusterName> <InterfaceName> -Mode=<by_profile|override> [-TopologyType=<external|internal>] [-InternalIP=<not_defined|this|specific> [-AllowedGroup=<GroupName>]] [-DMZAccess=<true|false>] [-AntiSpoof=<false|true> [-AllowedGroup=<GroupName>] [-SpoofTrack=<none|log|alert>]]

Explanations of the above parameters are:

ClusterSubnetOverride Actions (Add, Modify and Delete)

Cluster members’ interface names and network addresses, and cluster interface IP addresses and net masks, have default values from the Profiles they are associated with. These values can (and in the case of addresses, usually should) be overridden for the individual SmartLSM cluster.

In SmartLSM, this is done by Editing the interface, either in the New ROBO Cluster wizard, or in the Topology tab of the general Edit window for the cluster (double-click the cluster object).

In LSMcli, substitute the following for <action> in the LSMcli syntax:

<Add|Modify|Delete>ClusterSubnetOverride VPN1Cluster <ROBOClusterName> <InterfaceName> [-IName=<MembersInterfaceName>] [-MNet=<MembersNetAddress>] [-CIP=<ClusterIPAddress> -CNetMask=<ClusterNetMask>]

If there is a set override value, and you want to change it, use only ModifyClusterSubnetOverride. If the override value you want to set is not defined (except at the Profile level), because it has never been defined or because it was deleted, use only AddClusterSubnetOverride. To cancel a value and return to the Profile value, use DeleteClusterSubnetOverride.

The action must define at least one parameter: -IName, -MNet, or both -CIP and -CNetMask.

Explanations of the parameters are:

PrivateSubnetOverride Actions (Add, Modify and Delete)

This action is similar to the ClusterSubnetOverride action, for a private (monitored or non-monitored) interface. For a private interface, you can only override cluster members’ interface names and network addresses, not cluster interface IP addresses or net masks.

In LSMcli, substitute the following for <action> in the LSMcli syntax:

<Add|Modify|Delete>PrivateSubnetOverride VPN1ClusterMember <ROBOMemberName> <InterfaceName> [-IName=<MembersInterfaceName>] [-MNet=<MembersNetAddress>]

If there is a set override value, and you want to change it, use only ModifyPrivateSubnetOverride. If the override value you want to set is not defined (except at the Profile level), because it has never been defined or because it was deleted, use only AddPrivateSubnetOverride. To cancel a value and return to the Profile value, use DeletePrivateSubnetOverride.

The action must define at least one parameter: -IName or -MNet.

Explanations of the parameters are:

RemoveCluster

This action will revoke all the certificates used by the SmartLSM cluster and its members, release all the licenses and, finally, will delete the SmartLSM cluster and member objects.

In LSMcli, substitute the following for <action> in the LSMcli syntax:

RemoveCluster <ROBOClusterName>

ResetSic

This general LSM command applies to SmartLSM Clusters, with the same syntax as for regular SmartLSM gateways, using a cluster member name for <ROBOName>

ResetIke

This general LSM command applies to SmartLSM Clusters, with the same syntax as for regular SmartLSM gateways. For <ROBOName> use either a cluster name, to reset IKE for the cluster, or a cluster member name, to reset IKE for that member.

ExportIke

This general LSM command applies to SmartLSM Clusters, with the same syntax as for regular SmartLSM gateways. For <ROBOName> use either a cluster name, to export IKE for the cluster, or a cluster member name, to export IKE for that member.

Convert Actions

There is no convert action for or to SmartLSM clusters.

SmartUpdate Actions

The SmartUpdate actions listed in the SmartProvisioning Administration Guide apply to SmartLSM cluster members, with the same syntax as for regular SmartLSM gateways.

Push Policy

This general LSM command applies to SmartLSM Clusters, with the same syntax as for regular SmartLSM gateways. In the command syntax, use the cluster name (not a cluster member name). The policy is pushed to all cluster members.

Other Push Actions

PushDOs and GetStatus are general LSM commands that apply to SmartLSM cluster members, with the same syntax as for regular SmartLSM gateways.