Active-Active Mode in ClusterXL

Introduction

R80.40 introduced a new ClusterXL Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. mode called Active-Active A cluster mode (in versions R80.40 and higher), where cluster members are located in different geographical areas (different sites, different cloud availability zones). This mode supports the configuration of IP addresses from different subnets on all cluster interfaces, including the Sync interfaces. Each cluster member inspects all traffic routed to it and synchronizes the recorded connections to its peer cluster members. The traffic is not balanced between the cluster members..

This mode is designed for a cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., whose Cluster Members are located in different geographical areas (different sites, different cloud availability zones).

The IP addresses of the interfaces on each Cluster Member Security Gateway that is part of a cluster. are on different networks (including the Sync interfaces).

Each Cluster Member inspects all traffic routed to it and synchronizes the recorded connections to its peer Cluster Members.

The traffic is not balanced between the members.

Example Topology:

Important:

You can configure the Active State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism.-Active mode only on Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. R80.40 (and higher) and only on ClusterXL R80.40 (and higher).
The Active-Active mode does not provide Load Sharing A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. of the traffic.

Administrator must monitor the load on each Cluster Member (see Monitoring and Troubleshooting Clusters).
Cluster Control Protocol Proprietary Check Point protocol that runs between Cluster Members on UDP port 8116, and has the following roles: (1) State Synchronization (Delta Sync), (2) Health checks (state of Cluster Members and of cluster interfaces): Health-status Reports, Cluster-member Probing, State-change Commands, Querying for cluster membership. Note: CCP is located between the Check Point Firewall kernel and the network interface (therefore, only TCPdump should be used for capturing this traffic). Acronym: CCP. (CCP) Encryption must be enabled, which is the default (see Configuring the Cluster Control Protocol (CCP) Settings).
It is possible to configure the Cluster Control Protocol (CCP) to work on Layer 2.
It is possible to enable Dynamic Routing on each Cluster Member , so they become routers in the applicable Area or Autonomous System on the site.

In this case, you must enable the Bidirectional Forwarding Process of transferring of an incoming traffic from one Cluster Member to another Cluster Member for processing. There are two types of forwarding the incoming traffic between Cluster Members - Packet forwarding and Chain forwarding. For more information, see "Forwarding Layer in Cluster" and "ARP Forwarding". Detection (BFD - ip-reachability-detection) on each interface that is configured for dynamic routing.

Limitations

These limitations apply to Active-Active mode in ClusterXL:

Only these Software Blades and features are supported:
Up to four Cluster Members are supported.
VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. is not supported.
All Multi-Portals are not supported (examples of Multi-Portals: Mobile Access Check Point Software Blade on a Security Gateway that provides a Remote Access VPN access for managed and unmanaged clients. Acronym: MAB. Portal, Identity Awareness Check Point Software Blade on a Security Gateway that enforces network access and audits data based on network location, the identity of the user, and the identity of the computer. Acronym: IDA. Captive Portal, Data Loss Prevention Check Point Software Blade on a Security Gateway that detects and prevents the unauthorized transmission of confidential information outside the organization. Acronym: DLP. Portal).
Names of interfaces that belong to the same "side" must be the same on all Cluster Members.

Example: If you connected the interface eth1 to Switch A on Cluster Member, then you must connect the interface eth1 to Switch #A on all other Cluster Members.
In the cluster object properties, go to the Network Management page, select a cluster interface An interface on a Cluster Member, whose Network Type was set as Cluster in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. and click Edit.

In the Network Type field, it is not supported to select Cluster + Sync when you deploy a cluster on-premises or in the cloud (examples: AWS, Azure).
In the cluster object properties, go to the Network Management page, select a cluster interface, and click Edit.

In the Topology section, only these options are supported for cluster interfaces:
- Override > Network defined by routes (this is the default).
- Override > Specific > select the applicable Network object or Network Group object.
If you enable Dynamic Routing on Cluster Members, then you must enable the Bidirectional Forwarding Detection (BFD) - ip-reachability-detection) on each interface that is configured for dynamic routing.
The option Hide internal networks behind the Gateway's external IP (in the ClusterXL object properties > NAT pane) is not supported.
The option Hide behind the gateway (in the ClusterXL object properties > NAT pane) is not supported.

Configuring a new ClusterXL in Active-Active Mode

Note - This procedure is to configure a new ClusterXL object.

Procedure

Step

Instructions

Install ClusterXL Cluster Members.

See the R80.40 Installation and Upgrade Guide.

Important:

On all Cluster Members in Active-Active mode, names of interfaces that belong to the same "side" must be identical (Known Limitation PMTR-70256).

Examples:

If you connected the interface eth1 to Switch #A on one Cluster Member, then you must connect the interface eth1 to Switch #A on all other Cluster Members.
If you configured the interface eth2 as a Sync interface An interface on a Cluster Member, whose Network Type was set as Sync or Cluster+Sync in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. This interface is used for State Synchronization between Cluster Members. The use of more than one Sync Interfaces for redundancy is not supported because the CPU load will increase significantly due to duplicate tasks performed by all configured Synchronization Networks. Synonyms: Secured Interface, Trusted Interface. on one Cluster Member, then you must configure the interface eth2 as a Sync on all other Cluster Members.

Optional: On each Cluster Member, enable Dynamic Routing, so they become routers in the applicable Area or Autonomous System on the site.

Important - In this case, you must enable the Bidirectional Forwarding Detection (BFD - ip-reachability-detection) on each interface that is configured for dynamic routing.

See the R80.40 Gaia Advanced Routing Administration Guide.

Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Management Server.

From the left navigation panel, click Gateways & Servers.

Create a new Cluster object in one of these ways:

From the top toolbar, click the New () > Cluster > Cluster.
In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Cluster.
In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Cluster > Cluster.

In the Check Point Security Gateway Cluster Creation window, you must click Classic Mode.

From the left tree, click General Properties.

In the IPv4 Address field, you must enter the 0.0.0.0 address.
On the Network Security tab, you must clear IPsec VPN.
For the list of supported Software Blades, see the Known Limitation PMTR-70255 in sk160753.

From the left tree, click Cluster Members.

Click Add > New Cluster Member.

The Cluster Member Properties window opens.
In the Name field, enter the applicable name for the first Cluster Member object.
Configure the main physical IP address(es) for this Cluster Member object.

In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

Make sure the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. can connect to these IP addresses.
Click Communication.
In the One-time password and Confirm one-time password fields, enter the same Activation Key you entered during the Cluster Member's First Time Configuration Wizard.
Click Initialize.
Click Close.
Click OK.
Repeat Steps a-h to add the next Cluster Member.

If the Trust State field does not show Trust established, perform these steps:

Connect to the command line on the Cluster Member.
Make sure there is a physical connectivity between the Cluster Member and the Management Server (for example, pings can pass).

Run:

cpconfig

Enter the number of this option:

Secure Internal Communication

Follow the instructions on the screen to change the Activation Key.
In SmartConsole, click Reset.
Enter the same Activation Key you entered in the cpconfig menu.
In SmartConsole, click Initialize.

From the left tree, click ClusterXL and VRRP.

In the Select the cluster mode and configuration section, select Active-Active.
In the Tracking section, select the applicable option.

Optional: Select Use State Synchronization.

This configures the Cluster Members to synchronize the information about the connections they inspect.

Best Practice - Enable this setting to prevent connection drops after a cluster failover Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over..

Optional: Select Start synchronizing [ ] seconds after connection initiation and enter the applicable value.

This option is available only for clusters R80.20 and higher.

To prevent the synchronization of short-lived connections (which decreases the cluster performance), you can configure the Cluster Members to start the synchronization of all connections a number of seconds after they start.

Range: 2 - 60 seconds

Default: 3 seconds

Notes:

This setting in the cluster object applies to all connections that pass through the cluster.

You can override this global cluster synchronization delay in the properties of applicable services - see Configuring Services to Synchronize After a Delay.
The greater this value, the fewer short-lived connections the Cluster Members have to synchronize.
The connections that the Cluster Members did not synchronize, do not survive a cluster failover.

Best Practice - Enable and configure this setting to increase the cluster performance.

Click OK to update the cluster object properties with the new cluster mode Configuration of Cluster Members to work in these redundant modes: (1) One Cluster Member processes all the traffic - High Availability or VRRP mode (2) All traffic is processed in parallel by all Cluster Members - Load Sharing..

Open the cluster object and continue the configuration.

From the left tree, click Network Management.

From the top, click the Get Interfaces > Get Interfaces With Topology.

Important - On all Cluster Members in Active-Active mode, names of interfaces that belong to the same "side" must be identical (Known Limitation PMTR-70256).

Select each interface and click Edit.
From the left tree, click the General page.

In the General section, in the Network Type field, select the applicable type:

For cluster traffic interfaces, select Cluster.

In the IPv4 field, the dummy IP address 0.0.0.0 / 24 is configured automatically.

Note - SmartConsole requires an IP address configured for each interface. Cluster Members do not get and do not use this IP address.

For cluster synchronization interfaces, select Sync.

Notes:

Check Point cluster supports only one synchronization network A set of interfaces on Cluster Members that were configured as interfaces, over which State Synchronization information will be passed (as Delta Sync packets ). The use of more than one Synchronization Network for redundancy is not supported because the CPU load will increase significantly due to duplicate tasks performed by all configured Synchronization Networks. Synonyms: Sync Network, Secured Network, Trusted Network.. If redundancy is required, configure a Bond interface.
In the Network Type field, it is not supported to select "Cluster+Sync" (Known Limitation PMTR-70259) when you deploy a cluster in a cloud (for example: AWS, Azure).

For interfaces that do not pass the traffic between the connected networks, select Private.

In the Member IPs section, make sure the IPv4 address and its Net Mask are correct on each Cluster Member.
In the Topology section:

Make sure the settings are correct in the Leads To and Security Zone fields.

Only these options are supported on cluster interfaces (Known Limitation PMTR-70260):
- Override > Network defined by routes (this is the default).
- Override > Specific > select the applicable Network object or Network Group object.

Click OK.

Publish the SmartConsole session.

Configure and install the applicable Access Control Policy.

Configure and install the applicable Threat Prevention Policy.

Examine the cluster state.

See Viewing Cluster State.

Changing the ClusterXL Mode to Active-Active

Procedure

Step

Instructions

Connect with SmartConsole to the Management Server.

From the left navigation panel, click Gateways & Servers.

Open the existing ClusterXL object.

From the left tree, click ClusterXL and VRRP.

In the Select the cluster mode and configuration section, select Active-Active.

Mandatory: Click OK to update the cluster object properties with the new cluster mode.

Open the cluster object and continue the configuration.

From the left tree, click ClusterXL and VRRP.

In the Tracking section, select the applicable option.

Optional: Select Use State Synchronization.

This configures the Cluster Members to synchronize the information about the connections they inspect.

Best Practice - Enable this setting to prevent connection drops after a cluster failover.

Optional: Select Start synchronizing [] seconds after connection initiation and enter the applicable value.

This option is available only for clusters with version R80.20 and higher.

To prevent the synchronization of short-lived connections (which hurts cluster performance), you can configure the Cluster Members to start the synchronization of all connections a number of seconds after they start.

Range: 2 - 60 seconds

Default: 3 seconds

Notes:

This setting in the cluster object applies to all connections that pass through the cluster.
You can override this global cluster synchronization delay in the properties of applicable services - see Configuring Services to Synchronize After a Delay.
The greater this value, the fewer short-lived connections the Cluster Members have to synchronize.

The connections that the Cluster Members did not synchronize do not survive a cluster failover.

Best Practice - Enable and configure this setting to improve the cluster performance.

From the left tree, click Network Management.

Select each interface and click Edit.
From the left tree, click the General page.

In the General section, in the Network Type field, select the applicable type:

For cluster traffic interfaces, select Cluster.

In the IPv4 field, the dummy IP address 0.0.0.0 / 24 is configured automatically.

Note - SmartConsole requires an IP address configured for each interface. Cluster Members do not get and do not use this IP address.

For cluster synchronization interfaces, select Sync.
- Check Point cluster supports only one synchronization network. If redundancy is required, configure a Bond interface.
- In the Network Type field, it is not supported to select Cluster + Sync when you deploy a cluster in a cloud (for example: AWS, Azure).
- For interfaces that do not pass the traffic between the connected networks, select Private.

In the Member IPs section, make sure the IPv4 address and its Netmask are correct for each Cluster Member.
In the Topology section:
1. Make sure the settings are correct in the Leads To and Security Zone fields.
2. Click Modify.
3. In the Leads To section, if you select Override, only these options are supported on cluster interfaces (Known Limitation PMTR-70260):
  - Override > Network defined by routes (this is the default).
  - Override > Specific > select the applicable Network object or Network Group object.
4. In the Anti-Spoofing section, make sure to clear the option Perform Anti-Spoofing based on interface topology.
5. Click OK.

Click OK.

Publish the SmartConsole session.

Configure and install the applicable Access Control Policy.

Configure and install the applicable Threat Prevention Policy.

Examine the cluster state.

See Viewing Cluster State.

Dynamic Routing Failover

If there is an issue with the Sync interface (interface state or interface link):
- The Critical Device A special software device on each Cluster Member, through which the critical aspects for cluster operation are monitored. When the critical monitored component on a Cluster Member fails to report its state on time, or when its state is reported as problematic, the state of that member is immediately changed to Down. The complete list of the configured critical devices (pnotes) is printed by the 'cphaprob -ia list' command or 'show cluster members pnotes all' command. Synonyms: Pnote, Problem Notification. Interfaces Active Check on the Cluster Member reports its state as "problem".
- Each Cluster Member reports the state of its peer Cluster Member as LOST.
If you run the command "clusterXL_admin down" (see The clusterXL_admin Script):
- The Critical Device admin_down on the Cluster Member reports its state as "problem".
- The Cluster Member, on which you ran this command, reports its state as DOWN.

When the cluster state of a Cluster Member is DOWN, it stops processing the dynamic routing traffic to force the next hop router to update its routing tables. As a result, there may be a network outage, because it takes time for dynamic routing protocols to update their routing tables and propagate the changes.