Print Download PDF Send Feedback

Previous

Next

Working with VLANS and Clusters

VLAN Support in ClusterXL

A VLAN switch tags packets that originate in a VLAN with a four-byte header that specifies, which switch port it came from. No packet is allowed to go from a switch port in one VLAN to a switch port in another VLAN, apart from ports ("global" ports) that are defined so that they belong to all the VLANs.

The Cluster Member is connected to the global port of the VLAN switch, and this logically divides a single physical port into many VLAN ports each associated with a VLAN tagged interface (VLAN interface) on the Cluster Member.

When defining VLAN tags on an interface, cluster IP addresses can be defined only on the VLAN interfaces (the tagged interfaces). Defining a cluster IP address on a physical interface that has VLANs is not supported. This physical interface has to be defined with the Network Type Private.

ClusterXL (including VSX) supports the Synchronization Network (CCP packets that carry Delta Sync information) only on the lowest VLAN ID (VLAN tag). For example, if three VLANs with IDs 10, 20 and 30 are configured on interface eth1, then you can use only the VLAN interface eth1.10 for the State Synchronization.

This is the default interface monitoring in Check Point cluster:

Interface type

ClusterXL (non-VSX)

VSX Cluster

Physical interfaces

Monitors all cluster interfaces

Monitors all cluster interfaces

VLAN interfaces

Monitors only lowest VLAN ID configured on a physical interface

VSX High Availability (non-VSLS):

Monitors only lowest and highest VLAN IDs configured on a physical interface

If both VLAN IDs reside on the same Virtual System, only the lowest VLAN ID is monitored

 

Monitors only lowest and highest VLAN IDs configured on a physical interface

Virtual System Load Sharing:

Monitors all VLAN IDs configured on a physical interface on each Virtual System

When a Virtual System is connected to a Virtual Switch with the same physical interface and a lower VLAN ID, the wrp interface that leads to the Virtual Switch is considered the lowest VLAN ID for the physical interface

You can customize the default monitoring of VLAN IDs:

Need to monitor

In ClusterXL (non-VSX)

In VSX Cluster

Only the lowest VLAN ID

Enabled by default

Must disable the monitoring of all VLAN IDs - set the value of the kernel parameter fwha_monitor_all_vlan to 0

See sk92826

Only the lowest and highest VLAN IDs

Enabled by default

Controlled by the kernel parameter fwha_monitor_low_high_vlans

See sk92826

VSX High Availability (non-VSLS): Enabled by default

Controlled by the kernel parameter fwha_monitor_low_high_vlans

See sk92826

All VLAN IDs

Disabled by default

Controlled by the kernel parameter fwha_monitor_all_vlan

See sk92826

Virtual System Load Sharing: Disabled by default

Controlled by the kernel parameter fwha_monitor_all_vlan

See sk92826

Only specific VLAN IDs

Disabled by default

Controlled by the kernel parameter fwha_monitor_specific_vlan

See sk92784

Disabled by default

Controlled by the kernel parameter fwha_monitor_specific_vlan

See sk92784

Connecting Several Clusters on the Same VLAN

It is not recommended to connect the non-secured interfaces (the internal or external cluster interfaces, for example) of multiple clusters to the same VLAN. A separate VLAN, and/or switch is needed for each cluster.

Connecting the secured interfaces (the synchronization interfaces) of multiple clusters is also not recommended for the same reason. Therefore, it is best to connect the secured interfaces of a given cluster via a crossover link when possible, or to an isolated VLAN.

If there is a need to connect the secured or the non-secured interfaces of multiple clusters to the same VLAN you need to make changes to:

Changes to the Destination MAC Address

This section applies to ClusterXL Load Sharing Multicast Mode only.

How the Destination Cluster MAC Address is Assigned in Load Sharing Multicast Mode

When a member that is outside the cluster wishes to communicate with the cluster, it sends an ARP query with the cluster (virtual) IP address. The cluster replies to the ARP request with a multicast MAC address, even though the IP address is a unicast address.

This destination multicast MAC address of the cluster is based on the unicast IP address of the cluster. The upper three bytes are 01.00.5E, and they identify a Multicast MAC in the standard way. The lower three bytes are the same as the lower three bytes of the IP address. An example MAC address based on the IP address 10.0.10.11 is shown below.

 

 

10.

0.

10.

11

Destination unicast IP address for the cluster

 

 

 

Arrow

Arrow

Arrow

 

01

00

5E

00

0A

0B

Destination multicast MAC address for the cluster

Upper 3 bytes

Identify a Multicast MAC

Lower 3 bytes

From IP address

Duplicate Multicast MAC Addresses: The Problem

When more than one cluster is connected to the same VLAN, the last three bytes of the IP addresses of the cluster interfaces connected to the VLAN must be different. If they are the same, then communication from outside the cluster that is intended for one of the clusters will reach both clusters, which will cause communication problems.

For example, it is OK for the cluster interface of one of the clusters connected to the VLAN to have the address 10.0.10.11, and the cluster interface of a second cluster to have the address 10.0.10.12. However, the following addresses for the interfaces of the first and second clusters will cause complications: 10.0.10.11 and 20.0.10.11.

Duplicate Multicast MAC Addresses: The Solution

The best solution is to change to the last three bytes of the IP address of all but one of the cluster interfaces that share the same last three bytes of their IP address.

If the IP address of the cluster interface cannot be changed, you must change the automatically assigned multicast MAC address of all but one of the clusters and replace it with a user-defined multicast MAC address. Proceed as follows:

  1. In SmartConsole, open the cluster object.
  2. In the left navigation tree, go to ClusterXL and VRRP page.
  3. In the Select the cluster mode and configuration section, select Load Sharing and select Multicast.
  4. In the left navigation tree, go to Network Management page.
  5. Select the cluster interface that is connected to same VLAN as the other cluster and click Edit.
  6. Go to Advanced page.
  7. In the Multicast Address section, select User Defined.
  8. Enter the new user-defined MAC address. It must be of the form 01:00:5e:xy:yy:yy where x is between 0 and 7 (in hex) and y is between 0 and f (in hex).
  9. Click OK to close the Network interface properties window.
  10. Click OK to close the Gateway Cluster properties window.
  11. Install the Access Control Policy on this cluster object.