Working with VLANS and Clusters

VLAN Support in ClusterXL

Connecting Several Clusters on the Same VLAN

Changes to the Destination MAC Address

How the Destination Cluster MAC Address is Assigned in Load Sharing Multicast Mode

Duplicate Multicast MAC Addresses: The Problem

Duplicate Multicast MAC Addresses: The Solution

A VLAN switch tags packets that originate in a VLAN with a four-byte header that specifies, which switch port it came from. No packet is allowed to go from a switch port in one VLAN to a switch port in another VLAN, apart from ports ("global" ports) that are defined so that they belong to all the VLANs.

The Cluster Member is connected to the global port of the VLAN switch, and this logically divides a single physical port into many VLAN ports each associated with a VLAN tagged interface (VLAN interface) on the Cluster Member.

When defining VLAN tags on an interface, cluster IP addresses can be defined only on the VLAN interfaces (the tagged interfaces). Defining a cluster IP address on a physical interface that has VLANs is not supported. This physical interface has to be defined with the Network Type Private.

ClusterXL (including VSX) supports the Synchronization Network (CCP packets that carry Delta Sync information) only on the lowest VLAN ID (VLAN tag). For example, if three VLANs with IDs 10, 20 and 30 are configured on interface eth1, then you can use only the VLAN interface eth1.10 for the State Synchronization.

This is the default interface monitoring in Check Point cluster:

Interface type	ClusterXL (non-VSX)	VSX Cluster
Physical interfaces	Monitors all cluster interfaces	Monitors all cluster interfaces
VLAN interfaces	Monitors only lowest VLAN ID configured on a physical interface	VSX High Availability (non-VSLS): Monitors only lowest and highest VLAN IDs configured on a physical interface If both VLAN IDs reside on the same Virtual System, only the lowest VLAN ID is monitored
	Monitors only lowest and highest VLAN IDs configured on a physical interface	Virtual System Load Sharing: Monitors all VLAN IDs configured on a physical interface on each Virtual System When a Virtual System is connected to a Virtual Switch with the same physical interface and a lower VLAN ID, the `wrp` interface that leads to the Virtual Switch is considered the lowest VLAN ID for the physical interface

Interface type

ClusterXL (non-VSX)

VSX Cluster

Physical interfaces

Monitors all cluster interfaces

VLAN interfaces

Monitors only lowest VLAN ID configured on a physical interface

VSX High Availability (non-VSLS):

Monitors only lowest and highest VLAN IDs configured on a physical interface

If both VLAN IDs reside on the same Virtual System, only the lowest VLAN ID is monitored

Monitors only lowest and highest VLAN IDs configured on a physical interface

Virtual System Load Sharing:

Monitors all VLAN IDs configured on a physical interface on each Virtual System

When a Virtual System is connected to a Virtual Switch with the same physical interface and a lower VLAN ID, the wrp interface that leads to the Virtual Switch is considered the lowest VLAN ID for the physical interface

You can customize the default monitoring of VLAN IDs:

Need to monitor	In ClusterXL (non-VSX)	In VSX Cluster
Only the lowest VLAN ID	Enabled by default	Must disable the monitoring of all VLAN IDs - set the value of the kernel parameter `fwha_monitor_all_vlan` to 0 See sk92826
Only the lowest and highest VLAN IDs	Enabled by default Controlled by the kernel parameter `fwha_monitor_low_high_vlans` See sk92826	VSX High Availability (non-VSLS): Enabled by default Controlled by the kernel parameter `fwha_monitor_low_high_vlans` See sk92826
All VLAN IDs	Disabled by default Controlled by the kernel parameter `fwha_monitor_all_vlan` See sk92826	Virtual System Load Sharing: Disabled by default Controlled by the kernel parameter `fwha_monitor_all_vlan` See sk92826
Only specific VLAN IDs	Disabled by default Controlled by the kernel parameter `fwha_monitor_specific_vlan` See sk92784	Disabled by default Controlled by the kernel parameter `fwha_monitor_specific_vlan` See sk92784

It is not recommended to connect the non-secured interfaces (the internal or external cluster interfaces, for example) of multiple clusters to the same VLAN. A separate VLAN, and/or switch is needed for each cluster.

Connecting the secured interfaces (the synchronization interfaces) of multiple clusters is also not recommended for the same reason. Therefore, it is best to connect the secured interfaces of a given cluster via a crossover link when possible, or to an isolated VLAN.

If there is a need to connect the secured or the non-secured interfaces of multiple clusters to the same VLAN you need to make changes to:

The destination MAC address, to enable communication between the cluster and members outside the cluster (for ClusterXL Load Sharing Multicast Mode clusters only).
The source MAC address of the cluster, to enable Cluster Control Protocol communication between Cluster Members.

This section applies to ClusterXL Load Sharing Multicast Mode only.

When a member that is outside the cluster wishes to communicate with the cluster, it sends an ARP query with the cluster (virtual) IP address. The cluster replies to the ARP request with a multicast MAC address, even though the IP address is a unicast address.

This destination multicast MAC address of the cluster is based on the unicast IP address of the cluster. The upper three bytes are 01.00.5E, and they identify a Multicast MAC in the standard way. The lower three bytes are the same as the lower three bytes of the IP address. An example MAC address based on the IP address 10.0.10.11 is shown below.

When more than one cluster is connected to the same VLAN, the last three bytes of the IP addresses of the cluster interfaces connected to the VLAN must be different. If they are the same, then communication from outside the cluster that is intended for one of the clusters will reach both clusters, which will cause communication problems.

For example, it is OK for the cluster interface of one of the clusters connected to the VLAN to have the address 10.0.10.11, and the cluster interface of a second cluster to have the address 10.0.10.12. However, the following addresses for the interfaces of the first and second clusters will cause complications: 10.0.10.11 and 20.0.10.11.

Destination unicast IP address for the cluster

Destination multicast MAC address for the cluster

Upper 3 bytes

Identify a Multicast MAC

Lower 3 bytes

From IP address

The best solution is to change to the last three bytes of the IP address of all but one of the cluster interfaces that share the same last three bytes of their IP address.

If the IP address of the cluster interface cannot be changed, you must change the automatically assigned multicast MAC address of all but one of the clusters and replace it with a user-defined multicast MAC address. Proceed as follows:

In SmartConsole, open the cluster object.
In the left navigation tree, go to ClusterXL and VRRP page.
In the Select the cluster mode and configuration section, select Load Sharing and select Multicast.
In the left navigation tree, go to Network Management page.
Select the cluster interface that is connected to same VLAN as the other cluster and click Edit.
Go to Advanced page.
In the Multicast Address section, select User Defined.
Enter the new user-defined MAC address. It must be of the form 01:00:5e:xy:yy:yy where x is between 0 and 7 (in hex) and y is between 0 and f (in hex).
Click OK to close the Network interface properties window.
Click OK to close the Gateway Cluster properties window.
Install the Access Control Policy on this cluster object.