Print Download PDF Send Feedback

Previous

Next

Modifying a Cluster Definition

After you create a cluster with the wizard, you can change the topology and other parameters in the Cluster Members Properties window. This window lets you configure many advanced features not available with the wizard.

To work with a VSX Cluster definition, double-click a cluster object in SmartConsole. The VSX Cluster Properties window opens.

You can define most cluster objects with SmartConsole. There are some features or properties that you must CLI commands to configure.

A brief explanation for each of the definition pages follows. More detailed explanations for features that are not specific to VSX (NAT, IPS, VPN, etc.) are available in the online help or in the applicable product documentation.

General Properties

See the General Properties page to view general properties and to activate Software Blades for use with this VSX Cluster.

You can modify the following properties:

VSX Cluster Members

The Cluster Members page lets you view and modify several properties for individual VSX Cluster Members, including IP addresses for Cluster Members and the Internal Communication Network.

Gateway VSX Cluster Member List

The Cluster Members page shows all the VSX Cluster Members.

To edit a VSX Cluster Member:

From the Cluster Member page, select a VSX Cluster Member and click Edit.

The Cluster Member Properties window opens. These are the settings that you can edit:

For more about VPN concepts and configurations, see the R80.30 Site to Site VPN Administration Guide.

Where Used

Click Where used to show information about the selected member in the objects database.

Internal IP Address and Net Mask

VSX creates an internal communication network and automatically assigns it an IP address and net mask from a predefined pool. You can change this IP address here if you have not yet defined a Virtual System. Although traffic from this address is never sent to any networks, you must ensure that this IP address is unique and not in use anywhere on your defined network.

ClusterXL

To manage state synchronization, open the ClusterXL window, or run the vsx_util command on the Management Server.

All other ClusterXL configuration properties are disabled.

Creation Templates

The Creation Templates page displays the creation template used to create Virtual Systems. You can change from the current creation template to the Custom Configuration template and change the shared physical interface if the Shared Interface template is active.

Physical Interfaces

The Physical Interfaces page allows you to add or delete a physical interface on the VSX Gateway, and to define interfaces to be used as VLAN trunks.

Synchronization

The Synchronization window displays the state synchronization network. There are no configurable properties.

Topology

On the Topology page, you can see and configure interface and routing definitions.

Interfaces

The Interfaces section defines interfaces and links to devices. You can add new interfaces as well as delete and modify existing interfaces.

To add an interface:

  1. Click New and select one of these options:
    • Regular - Create a new interface
    • State Synchronization
    • Leads to Virtual Router
    • Leads to Virtual Switch

    The Interface Properties window opens.

    Click Actions > Copy to Clipboard to copy the Interfaces table in CSV format.

  2. Define the appropriate properties.
  3. Click OK.

To change an interface:

  1. Double-click an interface.

    The Interface Properties window opens.

  2. Change the parameters for the interface.
  3. Click OK.

To delete an interface:

  1. From the Topology page, select the interface and click Delete.
  2. Click OK.

Routes

The Routes section of the Topology window defines routes between network devices, network addresses, and Virtual Devices. Some routes are defined automatically based on the interface definitions. You can add, change, and delete routes.

To add a default route to the routing table:

  1. Click Add Default Route.

    The Default Gateway window opens.

  2. Enter the default route IP address or select the default Virtual Router.
  3. Click OK.

    The default route is added to the routing table.

  4. Select the default route and click Edit.

    The Route Configuration window opens.

  5. Configure the settings for the default route and click OK.

To add a new route to the routing table:

  1. Click Add.

    The Route Configuration window opens.

  2. Configure the Destination IP address and netmask.
  3. Configure the next hop IP address or Virtual Router.
  4. Optional: Select Propagate route to adjacent Virtual Devices to "advertise" the route to neighboring Virtual Devices, and enable connectivity between them.
  5. Click OK.

To change a route:

  1. Select the route.
  2. Click Edit.

    The Route Configuration window opens.

  3. Change the settings.
  4. Click OK.

To delete a route:

  1. Select the route.
  2. Click Remove.

    A confirmation window opens.

  3. Click OK.

Calculating Topology Automatically Based on Routing Information

Enable this option to allow VSX to automatically calculate the network topology based on interface and routing definitions (enabled by default). VSX creates automatic links, or connectivity cloud objects linked to existing internal or external networks.

VPN Domain

The VPN Domain section in the Topology page defines the set of hosts that use a VPN tunnel to communicate with peer Virtual Systems.

Define a VPN Domain to include a Virtual Device as part of the VPN connection. The domain defines the Virtual System interfaces that are in the VPN. You can define a VPN Domain in different ways:

To specify the VPN domain:

  1. Click Set domain for Remote Access Community.

    The VPN Domain per Remote Access Community window opens.

  2. Double-click a Remote Access Community.

    The Set VPN Domain window opens.

  3. Select a VPN domain from the list, or click New, to define a new domain.
  4. Click OK.

NAT

The NAT > Advanced page lets you configure NAT rules for packets originating from a Virtual System.

To enable and configure NAT for a Virtual System:

  1. Select Add Automatic Address Translation.
  2. Select a translation method:
    • Hide: Hide NAT only allows connections originating from the internal network. Internal hosts can access internal destinations, the Internet and other external networks. External sources cannot initiate a connection to internal network addresses.
    • Static: Static NAT translates each private address to a corresponding public address.
  3. If you select Hide, select one of these options:
    • Hide behind Gateway hides the real IP address behind the Virtual System external interface IP address,

      or

    • Hide behind IP Address hides the real address behind a virtual IP address, which is a routable, public IP address that does not belongs to any real machine.
  4. If you selected Static NAT, enter the static IP address in the appropriate field.
  5. Select the VSX Gateway from the Install on Gateway list.

VSX Bridge Configuration

The VSX Bridge Configuration page allows you to specify the loop detection algorithm when working in the Bridge mode.

Enable the Check Point ClusterXL option to enable the Active/Standby Bridge Mode loop detection algorithms contained in ClusterXL.

Enable the Standard Layer-2 Loop Detection Protocols to use standard loop detection protocols, such as STP or PVST+.

Changing the Cluster Management IP and/or Subnet

To add, change or delete the cluster management IP address and/or subnet, run the vsx_util change_mgmt_ip and vsx_util change_mgmt_subnet commands on the Management Server.

Changing the Internal Communication Network IP

You can change the internal communication network IP address by using the vsx_util change_private_net command on the Management Server.