Cluster IP Addresses on Different Subnets
You can configure cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Virtual IP addresses in different subnets than the physical IP addresses of the Cluster Members.
The network "sees" the cluster as one Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. that operates as a network router. The network is not aware of the internal cluster structure and physical IP addresses of Cluster Members.
Advantages of using different subnets:
-
You can create a cluster in an existing subnet that has a shortage of available IP addresses.
-
You use only one Virtual IP address for the cluster. All other IP addresses can be on other subnets.
-
You can "hide" physical Cluster Members' IP addresses behind the cluster Virtual IP address. This security practice is almost the same as NAT.
Traffic sent from Cluster Members to internal or external networks is hidden behind the cluster Virtual IP addresses and cluster MAC addresses. The cluster MAC address assigned to cluster interfaces is:
Cluster Mode |
MAC Address |
---|---|
MAC address of the Active State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. Cluster Member Security Gateway that is part of a cluster.'s interface |
|
Multicast MAC address of the cluster Virtual IP Address |
|
Load Sharing Unicast |
MAC address of the Pivot A Cluster Member in the Unicast Load Sharing cluster that receives all packets. Cluster Virtual IP addresses are associated with Physical MAC Addresses of this Cluster Member. This Pivot Cluster Member distributes the traffic between other Non-Pivot Cluster Members. Cluster Member's interface |
The use of different subnets with cluster objects has some limitations - see Limitations of Cluster Addresses on Different Subnets.
Configuration:
Follow the steps in Example of Cluster IP Addresses on Different Subnets.