Configuring Virtual System Load Sharing

This section presents the various procedures for configuring VSLS deployments. You use the vsx_util vsls to perform various VSLS configurations tasks.

To start vsx_util vsls:

1. From the Security Management Server, enter Expert mode.
2. Run vsx_util vsls
3. Enter the IP address for the Security Management Server.
4. Enter administrator user name and password.
5. Select the VSX Cluster name.
6. From the VSLS menu, select the configuration option.

Included Topics Enabling VSLS Creating a New VSLS Cluster Using the vsx_util vsls Command Distributing Virtual Systems Amongst Members Viewing VSLS Status Exporting and Importing VSLS Configurations

Enabling VSLS

In order to use VSLS for VSX, you must first activate the Per Virtual System State mode on each cluster member. You can then create a Load Sharing cluster, either by creating a new cluster object, or by converting an existing High Availability cluster to Load Sharing mode. After completing this process, you can modify Virtual Systems as required.

Enabling the Per Virtual System State Mode

The Per Virtual System State mode enables active Virtual Systems to be placed on different cluster members, and for Virtual System-specific failover. This setting is mandatory for VSLS. On each cluster member, do the following:

Note - The following Virtual Devices are not supported when the Per Virtual System state is enabled: Virtual Routers Virtual Switches that do not have physical or VLAN interfaces

1. Run cpconfig.
2. Select Enable Check Point Per Virtual System State.
3. Answer y to the question: Would you like to enable Per Virtual System state?
4. Reboot the machine.
5. Repeat this procedure for each member.

Creating a New VSLS Cluster

To create a new VSLS cluster:

1. Open SmartDashboard.
2. From the Network Objects tree, right click Check Point and select VSX > Cluster.

   The VSX Cluster Wizard opens.

3. Create and configure the new cluster.
   1. On the General Properties page, from VSX Cluster Platform, select Check Point ClusterXL Virtual System Load Sharing.
   2. On the Creation Templates page, select the creation template.
   3. Complete the VSX Cluster Wizard.

Using the vsx_util vsls Command

You use the vsx_util vsls command to perform various Virtual System Load Sharing configuration tasks, including:

1. Displaying the current VSLS configuration
2. Distributing Virtual Systems equally amongst cluster members
3. Set all Virtual Systems as active on one member
4. Manually define the priority and weight for individual Virtual Systems
5. Import VSLS configurations from comma separated value (CSV) text files
6. Export VSLS configurations to comma separated value (CSV) text files
7. Exporting and Import VSLS configurations from/to comma separated value (CSV) text files

To work with the vsx_util vsls command:

1. Run vsx_util vsls from the Expert mode on the management server
2. Select the desired choice from the VSLS menu

vsls_config vsls main menu

This sample output is for versions R77.10 and higher.

Enter Administrator Name: aa Enter Administrator Password: Select VSX cluster object name: 1) vsx_cluster_A 2) vsx_cluster_B Select: 1 VS Load Sharing - Menu ________________________________ 1. Display current VS Load sharing configuration 2. Distribute all Virtual Systems so that each cluster member is equally loaded 3. Set all VSs active on one member 4. Manually set priority and weight 5. Import configuration from a file 6. Export configuration to a file 7. Exit Enter redistribution option (1-7) [1]:

Distributing Virtual Systems Amongst Members

The primary advantage of VSLS is the ability to distribute active, standby and backup Virtual Systems amongst cluster members in order to maximize throughput and user response time. You can choose to distribute Virtual Systems according to one of the following options:

• Automatically distribute active Virtual Systems amongst cluster members so that all members are equally loaded based on assigned weights and existing or default priority definitions.
• Automatically place all active Virtual Systems on the same member
• Manually define priorities and weights for each Virtual System

Distributing Virtual Systems for Equal Member Loading

To distribute Virtual Systems for equal member loading:

1. From the VSLS menu, select "2. Distribute all Virtual Systems so that each cluster member is equally loaded".
2. At the "Save & apply configuration?" prompt, enter "y" to continue.

The process update process may take several minutes or longer to complete, depending on the quantity of Virtual Systems and cluster members.

Placing All Active Systems on the Same Member

1. From the VSLS menu, select "3. Set all VSs active on one member".
2. When prompted, enter the number corresponding to the member designated as the primary member.
3. When prompted, enter the number corresponding to the member designated as the standby member. All other members will be designated as backup members.
4. At the "Save & apply configuration?" prompt, enter "y" to continue.

The process update process may take several minutes or longer to complete, depending on the quantity of Virtual Systems and cluster members.

Assigning Priorities and Weights for a Single Virtual System

Methods to change priorities and weights:

• Automatically assign weights only to Virtual Systems. This method prompts you for a weight for each Virtual System and then automatically updates the settings.
• Manually assign priorities and weights to individual Virtual Systems.

Note: After you save changes, the update requires time (several minutes or longer), depending on the quantity of Virtual Systems and cluster members.

To automatically assign weights to all Virtual Systems:

1. From the VSLS menu, select Manually set priority and weight.
2. Scroll through each Virtual System. Enter: a
3. For each Virtual System, enter a weight value and press Enter.

   If you do not enter a weight value for a Virtual System, the assigned weight is not changed. Only Virtual Systems with a new weight value are updated.

   To stop entering weight values, enter s.

4. At the Save & apply configuration prompt, enter: y

To manually update both priorities and weights for individual Virtual Systems:

1. From the VSLS menu, select Manually set priority and weight.
2. Enter: m
3. At the Would you like to change the Virtual System's priority list? prompt, enter: y
4. Enter the number of the member to get the highest priority.
5. Enter the number of the member to get the next highest priority.
6. Continue until all members have a priority.
7. At the Would you like to change the Virtual System's weight? prompt, enter: y
8. Enter the new weight value. A valid value is an integer between 1 and 100.
9. At the Do you wish to configure another Virtual System? prompt, enter y to configure a different Virtual System or n to continue.
10. At the Save & apply configuration? prompt, enter: y

Viewing VSLS Status

To view the current VSLS status and Virtual System distribution amongst members, select "1. Display current VS Load Sharing configuration" from the VSLS menu. The output is similar to the below example"

----+---------+-----------+-----------+-----------+--------+ VSID| VS name | gw150 | gw151 | gw152 | Weight | ----+---------+-----------+-----------+-----------+--------+ 2 | vs1 | 0 | 1 | 2 | 10 | 3 | vs2 | 2 | 0 | 1 | 10 | 4 | vs3 | 1 | 2 | 0 | 10 | 5 | vs5 | 0 | 2 | 1 | 10 | 6 | vs4 | 1 | 0 | 2 | 10 | ----+---------+-----------+-----------+-----------+--------+ Total weight | 20 | 20 | 10 | 50 | ----+---------+-----------+-----------+-----------+--------+   Legend: 0 - Highest priority 1 - Next priority 2 - Lowest priority

Virtual System Priority

Virtual System priority refers to a preference regarding which member hosts a Virtual System's active, standby, and backup states. This preference is expressed as an integer value.

Priority	Definition
0	Highest priority, indicating the member designated to host the Virtual System active state.
1	Second highest priority, indicating the member designated to host the Virtual System standby state.
> 1	Lower priorities, indicating members designated to host a Virtual System's backup state. The cluster member assigned priority 2 will be the first to switch the Virtual System to the Standby state in the event of a failure of either the Active or Standby Virtual System. A cluster member assigned priority 3 would be the next in line to come online in the event of another failure.

Virtual System Weight

Each Virtual System is assigned a weight factor, which indicates its traffic volume relative to the total traffic volume (the sum of all weight factors) on a given cluster member. VSX uses the weight factor to determine the most efficient distribution of Virtual Systems amongst cluster members. System resource allocation is not affected by the weight factor, nor does VSX take weight into consideration for any other purpose.

By default, all Virtual Systems are assigned an equal weight factor of 10.

Exporting and Importing VSLS Configurations

When working with large scale VSLS deployments consisting of many Virtual Systems, multiple cluster members, using the vsx_util command to perform configuration tasks can be quite time consuming. To allow administrators to efficiently configure such deployments, VSX supports uploading VSLS configuration files containing configuration information for all Virtual Systems directly to management servers and cluster members.

This capability offers the following advantages:

• Rapid VSLS configuration of large-scale deployments with many Virtual Systems and cluster members.
• Efficient migration and scalability for complex deployments
• External backup of VSLS configurations.

VSLS configuration files are comma separated value (CSV) files that are editable using a text editor or another applications, such as Microsoft Excel. You can use the configuration file to rapidly change the weight and cluster member priority for each Virtual Systems in the list.

Note - You cannot use the VSLS configuration file to add or remove cluster members. You must use the appropriate vsx_util commands to accomplish this. You can use the VSLS configuration file to change member priorities for Virtual Systems after adding or removing a member.

VSLS Configuration File

The VSLS configuration file is a comma separated value (CSV) text file that contains configuration settings for all Virtual Systems controlled by a management server. All lines preceded by the # symbol are comments and are not imported into the management database.

# Check Point VSX - VS Load Sharing configuration file # # Administrator : aa # SmartCenter/Main Domain Management Server : 192.168.50.160 # Generated on : Thu Jul 23 13:08:42 2009 # # # # VSID, Weight, Active member, Standby member, Backup member #1 # Virtual System name: vs1 2,10,gw150,gw151,gw152   # Virtual System name: vs2 3,10,gw151,gw152,gw150   # Virtual System name: vs3 4,10,gw152,gw150,gw151   # Virtual System name: vs4 6,10,gw151,gw150,gw152   # Virtual System name: vs5 5,10,gw150,gw152,gw151

The configuration file contains one line for each Virtual System, consisting of the following data as shown below:

Each line contain the VSID, the weight assigned the Virtual System, one primary member and one standby member. Additional backup members are listed following the standby member.

Exporting a VSLS configuration

The most common way to use VSLS configuration files is to initially define your cluster environment and Virtual Systems using SmartDashboard.

To export a VSLS configuration to a text file:

1. From the VSLS menu, select "6. Export configuration to a file".
2. Enter a file name, include its fully qualified path, for example:

   /home/admin/MyConfiguration

Processing Options

You can insert the following commands in the VSLS Configuration file to display audit trail information while validating and processing data. Each of the commands act as a toggle, whereby the first occurrence of a command enables the action and the next occurrence disables it. These options his allow you to efficiently debug very long configuration files by displaying or logging only suspicious sections of the data.

Command	Action
!comments	Sequentially displays comment lines (those preceded with the '#' character) contained in the configuration file. You can insert comments into the configuration file to indicate which Virtual Systems are currently being processed or to provide status information as the parser processes the data.
!verbose	Displays whether or not each data line has been successfully verified and the configuration parameters for each Virtual System.
!log	Saves !comments and !verbose information in the vsx_util.log file.

Importing a VSLS configuration

To import a VSLS configuration from a text file:

1. From the VSLS menu, select "5. Import configuration from a file".
2. Enter the file name, include its fully qualified path, for example:

   /home/admin/MyConfiguration

3. At the "Save & apply configuration?" prompt, enter "y" to continue.

During the import process, the parser reads the configuration file and attempts to validate the contents. Errors are displayed on the screen together with the offending line number. If either the !comments or !verbose processing options are enabled, the appropriate information appears on the screen.

The process update process may take several minutes or longer to complete, depending on the quantity of Virtual Systems, Domain Management Servers and cluster members.