SyncXL

SyncXL is a Check Point technology that makes sure that active connections are only synchronized to one SGM each on the Active Chassis and the Standby Chassis.

When an SGM or Chassis state changes, all SGMs update their counterpart SGMs. Synchronization is triggered automatically by these events:

• SGM Failure – Connections with a backup connection on an SGM are synchronized to a backup SGM
• SGM Recovery – The newly recovered SGM can be:
  • A backup for connections that are active on other SGMs
  • Active for connections before SGM failure
• Chassis HA failover – When the Active Chassis fails over to the Standby Chassis, a backup entry is defined for each connection it handles.

The SyncXL mechanism can be configured using the asg_sync_manager command. To learn more the asg_sync_manager command, see Defining the Synchronization Level (asg_sync_manager).

Standby Chassis/Active SGMs ratio:

To handle load and capacity, the Standby Chassis must have at least 50% of its SGMs in the UP state, compared with the Active Chassis. For example, if there are 10 SGMs that are UP on the Active Chassis, there must be at least five UP SGMs on the Standby Chassis. SyncXL is automatically disabled if this condition is not successful. You can change the ratio parameter.

To make sure that each active connection has backups on both Chassis in a Dual Chassis system

Run:

# asg_sync_manager

To see the last connection backup operation:

Run:

# asg_blade_stats

Last Iterator Statistics:

---------------------------------------------

Start time:                      Thu Sep 13 10:48:18 2012

Running time:                    0 Seconds

Status:                          Finished

Reason:                          Chassis ID 2 state was changed to STANDBY

Total connections iterated       38

Connections w/ sync action       0

To learn more about the asg_blade_stats command, see Showing SGM Forwarding Statistics (asg_blade_stats).

Notes:

• VoIP connections are synchronized to all SGMs
• Local connections (to/from the 61000/41000 Security System pseudo IP) are not synchronized
• SyncXL does not work on the Sync interface or the Management Interface