Installing a VRRP Cluster

Notes:

  • This procedure applies to both Check Point Appliances and Open Servers.

  • This procedure does not apply to Check Point Small Office Appliance models lower than 3000.

  • VRRP Cluster on Gaia supports only two Cluster Members (see sk105170).

Procedure:

  1. Step

    Instructions

    1

    Install the Gaia Operating System:

    2

    Follow Configuring Gaia for the First Time.

    3

    During the First Time Configuration Wizard, you must configure these settings:

    • In the Installation Type window, select Security Gateway and/or Security Management.

    • In the Products window:

      1. In the Products section, select Security Gateway only.

      2. In the Clustering section, select these two options:

        • Unit is a part of a cluster

        • VRRP Cluster

    • In the Secure Internal Communication window, enter the applicable Activation Key (between 4 and 127 characters long).

    4

    Install a valid license.

    See Working with Licenses.

    5

    On Gaia, VRRP can be used with ClusterXL enabled or with ClusterXL disabled.

    See the R80.40 Gaia Administration Guide - Chapter High Availability for more information.

    If it is necessary to configure VRRP with ClusterXL enabled, then:

    1. When prompted to reboot, click Cancel.

    2. Connect to the command line.

    3. Run:

      cpconfig

    4. Select Enable cluster membership for this gateway to enable State synchronization.

      Enter y when prompted.

    5. Exist from the cpconfig menu.

    6

    Reboot.

  2. Configure the VRRP in Gaia on both Cluster Members.

    Follow the instructions in the R80.40 Gaia Administration Guide - Chapter High Availability.

    In addition, refer to:

    • Step

      Instructions

      1

      Connect with SmartConsole to the Security Management Server or Domain Management Server that should manage this VRRP Cluster.

      2

      From the left navigation panel, click Gateways & Servers.

      3

      Create a new Cluster object in one of these ways:

      • From the top toolbar, click the New () > Cluster > Cluster.

      • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Cluster.

      • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Cluster > Cluster.

      4

      In the Check Point Security Gateway Cluster Creation window, click Wizard Mode.

      5

      On the Cluster General Properties page:

      1. In the Cluster Name field, enter the applicable name for this VRRP Cluster object.

      2. Configure the main Virtual IP address(es) for this VRRP Cluster object.

        • In the Cluster IPv4 Address section, enter the main Virtual IPv4 address for this VRRP Cluster object.

        • In the Cluster IPv6 Address section, enter the main Virtual IPv6 address for this VRRP Cluster object.

        Note - You can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members.

      3. In the Choose the Cluster's Solution field, select Gaia VRRP.

      4. Click Next.

      6

      On the Cluster members' properties page, add the objects for the Cluster Members.

      1. Click Add > New Cluster Member.

        The Cluster Member Properties window opens.

      2. In the Name field, enter the applicable name for this VRRP Cluster Member object.

      3. Configure the main physical IP address(es) for this object.

        In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

        Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

        Note - You can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members.

      4. In the Activation Key and Confirm Activation Key fields, enter the same Activation Key you entered during the Cluster Member's First Time Configuration Wizard.

      5. Click Initialize.

      6. Click OK.

      7. Repeat Steps a-f to add the second VRRP Cluster Member.

       

      If the Trust State field does not show Trust established, perform these steps:

      1. Connect to the command line on the Cluster Member.

      2. Make sure there is a physical connectivity between the Cluster Member and the Management Server (for example, pings can pass).

      3. Run:

        cpconfig

      4. Enter the number of this option:

        Secure Internal Communication

      5. Follow the instructions on the screen to change the Activation Key.

      6. In SmartConsole, click Reset.

      7. Enter the same Activation Key you entered in the cpconfig menu.

      8. In SmartConsole, click Initialize.

      7

      On the Cluster Topology page, configure the roles of the cluster interfaces:

      1. Examine the IPv4 Network Address at the top of the page.

      2. Select the applicable role:

        • For cluster traffic interfaces, select Representing a cluster interface and configure the Cluster Virtual IPv4 address and its Net Mask.

          Note - You can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members.

        • For cluster synchronization interfaces, select Cluster Synchronization and select Primary only. Check Point cluster supports only one synchronization network.

        • For interfaces that do not pass the traffic between the connected networks, select Private use of each member (don't monitor members interfaces).

      3. Click Next

      8

      On the Cluster Definition Wizard Complete page:

      1. Examine the Configuration Summary.

      2. Select Edit Cluster's Properties.

      3. Click Finish

      The Gateway Cluster Properties window opens.

      9

      On the General Properties page > Machine section:

      1. In the Name field, enter the applicable name for this VRRP Cluster object.

      2. In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

        Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

      10

      On the General Properties page > Platform section, select the correct options:

      1. In the Hardware field:

        If you install the Cluster Members on Check Point Appliances, select the correct appliances series.

        If you install the Cluster Members on Open Servers, select Open server.

      2. In the Version field, select R80.40.

      3. In the OS field, select Gaia.

      11

      On the General Properties page:

      1. On the Network Security tab, make sure the ClusterXL Software Blade is selected.

      2. Enable the additional applicable Software Blades on the Network Security tab and on the Threat Prevention tab.

      12

      On the Cluster Members page:

      1. Click Add > New Cluster Member.

        The Cluster Member Properties window opens.

      2. In the Name field, enter the applicable name for this VRRP Cluster Member object.

      3. Configure the main physical IP address(es) for this VRRP Cluster Member object.

        In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

        Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

        Note - You can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members.

      4. Click Communication.

      5. In the One-time password and Confirm one-time password fields, enter the same Activation Key you entered during the Cluster Member's First Time Configuration Wizard.

      6. Click Initialize.

      7. Click Close.

      8. Click OK.

      9. Repeat Steps a-h to add the second Cluster Member.

       

      If the Trust State field does not show Trust established, perform these steps:

      1. Connect to the command line on the Cluster Member.

      2. Make sure there is a physical connectivity between the Cluster Member and the Management Server (for example, pings can pass).

      3. Run:

        cpconfig

      4. Enter the number of this option:

        Secure Internal Communication

      5. Follow the instructions on the screen to change the Activation Key.

      6. In SmartConsole, click Reset.

      7. Enter the same Activation Key you entered in the cpconfig menu.

      8. In SmartConsole, click Initialize.

      13

      On the ClusterXL and VRRP page:

      1. In the Select the cluster mode and configuration section, select High Availability and VRRP.

      2. In the Tracking section, select the applicable option.

      3. In the Advanced Settings section:

        • Optional: Select Use State Synchronization

        • Optional: Select Hide Cluster Members outgoing traffic behind the Cluster IP Address

        • Optional: Select Forward Cluster incoming traffic to Cluster Members IP Addresses

        For more information, click the (?) button in the top right corner.

        Best Practice - We recommend to select all these optional settings.

      14

      On the Network Management page:

      1. Select each interface and click Edit. The Network: <Name of Interface> window opens.

      2. From the left tree, click the General page.

      3. In the General section, in the Network Type field, select the applicable type:

        • For cluster traffic interfaces, select Cluster.

          Make sure the Cluster Virtual IPv4 address and its Net Mask are correct.

        • For cluster synchronization interfaces, select Sync or Cluster+Sync.

          Notes:

          • We do not recommend the configuration Cluster+Sync.

          • Check Point cluster supports only one synchronization network.

          • For Check Point Appliances or Open Servers:

            The Synchronization Network is supported only on the lowest VLAN tag of a VLAN interface.

        • For interfaces that do not pass the traffic between the connected networks, select Private.

      4. In the Member IPs section, make sure the IPv4 address and its Net Mask are correct on each Cluster Member.

        Note - For cluster traffic interfaces, you can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members. See the R80.40 ClusterXL Administration Guide.

      5. In the Topology section:

        • Make sure the settings are correct in the Leads To and Security Zone fields.

        • Make sure to enable the Anti-Spoofing.

      15

      Click OK.

      16

      Publish the SmartConsole session.

    • Step

      Instructions

      1

      Connect with SmartConsole to the Security Management Server or Domain Management Server that should manage this VRRP Cluster.

      2

      From the left navigation panel, click Gateways & Servers.

      3

      Create a new Cluster object in one of these ways:

      • From the top toolbar, click the New () > Cluster > Cluster.

      • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Cluster.

      • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Cluster > Cluster.

      4

      In the Check Point Security Gateway Cluster Creation window, click Classic Mode.

      The Gateway Cluster Properties window opens.

      5

      On the General Properties page > Machine section:

      1. In the Name field, enter the applicable name for this VRRP Cluster object.

      2. In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

        Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

      6

      On the General Properties page > Platform section, select the correct options:

      1. In the Hardware field:

        If you install the Cluster Members on Check Point Appliances, select the correct appliances series.

        If you install the Cluster Members on Open Servers, select Open server.

      2. In the Version field, select R80.40.

      3. In the OS field, select Gaia.

      7

      On the General Properties page:

      1. On the Network Security tab, make sure the ClusterXL Software Blade is selected.

      2. Enable the additional applicable Software Blades on the Network Security tab and on the Threat Prevention tab.

      8

      On the Cluster Members page:

      1. Click Add > New Cluster Member.

        The Cluster Member Properties window opens.

      2. In the Name field, enter the applicable name for this VRRP Cluster Member object.

      3. Configure the main physical IP address(es) for this VRRP Cluster Member object.

        In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

        Make sure the Security Management Server or Multi-Domain Server can connect to these IP addresses.

        Note - You can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members.

      4. Click Communication.

      5. In the One-time password and Confirm one-time password fields, enter the same Activation Key you entered during the Cluster Member's First Time Configuration Wizard.

      6. Click Initialize.

      7. Click Close.

      8. Click OK.

      9. Repeat Steps a-h to add the second Cluster Member.

       

      If the Trust State field does not show Trust established, perform these steps:

      1. Connect to the command line on the Cluster Member.

      2. Make sure there is a physical connectivity between the Cluster Member and the Management Server (for example, pings can pass).

      3. Run:

        cpconfig

      4. Enter the number of this option:

        Secure Internal Communication

      5. Follow the instructions on the screen to change the Activation Key.

      6. In SmartConsole, click Reset.

      7. Enter the same Activation Key you entered in the cpconfig menu.

      8. In SmartConsole, click Initialize.

      9

      On the ClusterXL and VRRP page:

      1. In the Select the cluster mode and configuration section, select High Availability and VRRP.

      2. In the Tracking section, select the applicable option.

      3. In the Advanced Settings section:

        • Optional: Select Use State Synchronization

        • Optional: Select Hide Cluster Members outgoing traffic behind the Cluster IP Address

        • Optional: Select Forward Cluster incoming traffic to Cluster Members IP Addresses

        For more information, click the (?) button in the top right corner.

        Best Practice - We recommend to select all these optional settings.

      10

      On the Network Management page:

      1. Select each interface and click Edit. The Network: <Name of Interface> window opens.

      2. From the left tree, click the General page.

      3. In the General section, in the Network Type field, select the applicable type:

        • For cluster traffic interfaces, select Cluster.

          Make sure the Cluster Virtual IPv4 address and its Net Mask are correct.

        • For cluster synchronization interfaces, select Sync or Cluster+Sync.

          Notes:

          • We do not recommend the configuration Cluster+Sync.

          • Check Point cluster supports only one synchronization network.

          • For Check Point Appliances or Open Servers:

            The Synchronization Network is supported only on the lowest VLAN tag of a VLAN interface.

        • For interfaces that do not pass the traffic between the connected networks, select Private.

      4. In the Member IPs section, make sure the IPv4 address and its Net Mask are correct on each Cluster Member.

        Note - For cluster traffic interfaces, you can configure the Cluster Virtual IP address to be on a different network than the physical IP addresses of the Cluster Members. In this case, you must configure the required static routes on the Cluster Members. See the R80.40 ClusterXL Administration Guide.

      5. In the Topology section:

        • Make sure the settings are correct in the Leads To and Security Zone fields.

        • Make sure to enable the Anti-Spoofing.

      11

      Click OK.

      12

      Publish the SmartConsole session.

  4. Step

    Instructions

    1

    Connect with SmartConsole to the Security Management Server or Domain Management Server that manages this VRRP Cluster.

    2

    From the left navigation panel, click Security Policies.

    3

    Create a new policy and configure the applicable layers:

    1. At the top, click the + tab (or press CTRL T).

    2. On the Manage Policies tab, click Manage policies and layers.

    3. In the Manage policies and layers window, create a new policy and configure the applicable layers.

    4. Click Close.

    5. On the Manage Policies tab, click the new policy you created.

    4

    Create the required Access Control rules.

    You must define an explicit Access Control rule to allow the VRRP Cluster Members to send and receive the VRRP and IGMP traffic:

    No

    Name

    Source

    Destination

    VPN

    Services & Applications

    Action

    Track

    Install On

    1

    VRRP and IGMP

    VRRP Cluster object

    Node Host object with IP address 224.0.0.18

    Any

    vrrp

    igmp

    Accept

    None

    VRRP Cluster object

     

    If the VRRP Cluster Members use dynamic routing protocols (such as OSPF or RIP), create new rules for each multicast destination IP address.

    Alternatively, you can create a Network object to represent all multicast network IP destinations:

    • Name: MCAST.NET (this is an example name)

    • IP Address: 224.0.0.0

    • Net mask: 240.0.0.0

    You can use one rule for all multicast protocols you agree to accept, as shown in this example:

    No

    Name

    Source

    Destination

    VPN

    Services & Applications

    Action

    Track

    Install On

    1

    All multicast protocols

    VRRP Cluster object

    VRRP Cluster object

    MCAST.NET

    Any

    vrrp

    igmp

    ospf

    rip

    Accept

    None

    VRRP Cluster object

    5

    Configure additional applicable Access Control rules.

    6

    Install the Access Control Policy on the VRRP Cluster object.

    7

    Configure and install the applicable Threat Prevention Policy on the VRRP Cluster object.

  5. Step

    Instructions

    1

    Connect to the command line on each Cluster Member.

    2

    Examine the cluster state in one of these ways:

    • In Gaia Clish, run:

      show cluster state

    • In the Expert mode, run:

      cphaprob state

    3

    Examine the cluster interfaces in one of these ways:

    • In Gaia Clish, run:

      show cluster members interfaces all

    • In the Expert mode, run:

      cphaprob -a if

    4

    Examine the VRRP configuration in one of these ways:

    • In Gaia Clish, run:

      show vrrp

    • In the Expert mode, run:

      clish -c "show vrrp"

For more information, see the: