Configuring Cloning Groups in Gaia Portal

Warning - The R81.10 Jumbo Hotfix Accumulator Take 183 hardens the authentication in the Cloning Group (PMTR-116161).

In these scenarios:

The Cloning Group Members did not have the R81.10 Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. installed, and you installed Take 183 or higher.
The Cloning Group Members had the R81.10 Jumbo Hotfix Software package installed on top of the current software version to fix a wrong or undesired behavior, and to add a new behavior. Accumulator Take 181 or lower installed, and you installed Take 183 or higher.

you must follow these steps in each existing Cloning Group:

Make sure this Jumbo Hotfix Accumulator Take is installed on each Cloning Group Member.
On each Cloning Group Member, enter a Cloning Group password - enter the current password again or a new password
On each Cloning Group Member, re-synchronize the Cloning Group.

Important:

Scalable Platform Security Groups do not support this feature (Known Limitation MBS-4756).
If you change the members of a Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Cloning Group with many members down, you are logged out of the Gaia Portal Web interface for the Check Point Gaia operating system. with an incorrect error message:

Unable to connect to server

The correct message is:

An error occurred while applying configuration change to all cloning group members - the operation was successful only for online members.

This is the normal behavior of the Cloning Group. This error does not indicate a critical failure.
If you configure a Cloning Group and ISP Redundancy on a Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., then you must enable the Gaia feature "Kernel Routes". See the R81.10 Gaia Advanced Routing Administration Guide.

Creating a new Cloning Group

Step

Instructions

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

Click System Management > Cloning Group.

Click Start Cloning Group Creation Wizard.

The Cloning Group Creation Wizard opens.

Select Create a new Cloning Group.

The New Gaia Cloning Group window opens.

In the Cloning Group Name field, enter a name for the Cloning Group.
In the IP for cloning field, select an IPv4 address (interface) for synchronizing settings between member Security Gateways.

Select an interface on a secure internal network.
In the Password field, enter a password for the administration account (cadmin).

This password is necessary to:
- Manage the Cloning Group
- Add other Security Gateways to the Cloning Group
- Create encrypted traffic between members of the Cloning Group
In the Confirm Password field, enter the password again.

In the Shared Features screen, select features to clone to other members of the Cloning Group.

Pay attention to the features you want to clone.

For example, you might not want to clone static routes to Security Gateways that are members of a cluster.

Click Next for the Wizard Summary.

Click Finish.

List of Shared Features

The features are listed in the same order, in which they are shown in Gaia Portal.

Table: Shared Features in Gaia Portal
Shared Feature	Description
SNMP	Configure SNMP.
Banner Messages	Configure banner messages.
Job Scheduler	Schedule automated tasks that perform actions at a specific time.
DNS	Configure DNS servers.
ARP	Configure static ARP entries and proxy ARP entries, control dynamic ARP entries.
System Logging	Configure system logging settings.
Host Access Control	Configure which hosts are allowed to connect to the cluster devices.
Proxy Settings	Configure proxy settings.
Host Address Assignment	Configure known hosts.
NTP	Configure Network Time Protocol for synchronizing the system's clock over a network.
Password Policy	Configure password and account policies.
Time	Configure the time and date of the system.
Network Access	Configure network access to Gaia.
Display Format	Configure how the system displays time, date and netmask.
Mail Notification	Configure email address, to which Gaia sends mail notifications.
Inactivity timeout	Configure session parameters, such as inactivity timeout.
Users and Roles	Configure users and roles settings.
Static Routes	Configure static routes.
DHCP Relay	Configure relay of DHCP and BOOTP messages between clients and servers on different IPv4 Networks.
IPv6 DHCP Relay	Configure relay of DHCPv6 messages between clients and servers on different IPv6 Networks.
BGP	Configure dynamic routing via the Border Gateway Protocol.
IGMP	Establish multicast group memberships via the Internet Group Management Protocol.
PIM	Configure Protocol-Independent Multicast.
Static Multicast Routes	Configure static multicast routes.
RIP	Configure IPv4 dynamic routing via the Routing Information Protocol.
RIPng	Configure IPv6 dynamic routing via the Routing Information Protocol.
OSPF	Configure IPv4 dynamic routing via the Open Shortest-Path First v2 protocol.
IPv6 OSPF	Configure IPv6 dynamic routing via the Open Shortest-Path First v3 protocol.
Route Aggregation	Create a supernet network from the combination of networks with a common routing prefix.
Inbound Route Filters	Configure Inbound Route Filters for RIP, OSPFv2, BGP, and OSPFv3 (supports IPv4 and IPv6).
IP Reachability Detection	Configure reachability detection of IP Addresses.
Route Redistribution	Configure advertisement of routing information from one protocol to another (supports IPv4 and IPv6).
Route Map	Configure dynamic routing route maps.
Prefix Lists and Trees	Configure dynamic routing prefix lists and trees.
Routing Options	Configure protocol ranks and trace (debug) options.
Policy Based Routing	Configure policy based routing (PBR) priority rules and action tables.
Scheduled Backups	Configure Gaia scheduled backups.

Managing a Cloning Group

Step

Instructions

Sign out of the Gaia Portal.

(Alternatively, log in to the Gaia Portal on the Security Gateway using the cadmin credentials.)

Important - No unique URL or IP address is needed to access the Cloning Group Portal or Clish command line. Use the URL or IP address of the member Security Gateway.

In System Management > Cloning Group, select features from the Shared Features.

Click Set Shared Features.

The shared features are propagated to all members of the group.

If, for example, you then configure a primary DNS server on one member of the Cloning Group, and DNS is one of the Shared Features, then the DNS settings are propagated to all members of the group. The DNS settings in the Portal of each member are grayed out.

Note - A user that gets Cloning Group administration privileges (the RBA role CloningGroupManagement), can manage specific Cloning Groups features granted by the administrator and grant Cloning Group capabilities to other users, including remote users. When these privileges are assigned, the Group Mode button shows in Gaia Portal.

Managing a Cloning Group as an assigned administrator

Step

Instructions

Connect to the Gaia Portal on a Cloning Group member Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

At the top, click Group Mode.

The Security Gateway switches to Cloning Group management mode.

Joining an existing Cloning Group

Step

Instructions

Connect to the Gaia Portal on a Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

The Cloning Group Wizard opens.

Select Join an existing Cloning Group.

The Join Existing Cloning Group window opens.

In the Remote Member Address field, enter the IPv4 address of a remote member of the Cloning Group.
In the IP for cloning field, select an IP address (interface) for synchronizing the settings between Security Gateways.

Select an interface on a secure internal network. Make sure there is a physical connectivity to the Gaia computer that runs the Cloning Group, to which you wish to join.
In the Password field, enter a password for the Cloning Group administration account (cadmin).

(The same password you entered when you created the Cloning Group, to which you wish to join.)

The cadmin password:
- Lets you log in to the cadmin account
- Is used to create authentication credentials for members during synchronization

Click Finish.

Creating a Cloning Group that follows ClusterXL

Select this option, if the Security Gateway is a member of a ClusterXL.

Important - In a Cluster, you must configure all the Cluster Members in the same way.

Step

Instructions

Connect to the Gaia Portal on a Security Gateway.

With a web browser, connect to Gaia Portal at:

https://<IP address of Gaia Management Interface>

If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

In System Management > Cloning Group, click Start Cloning Group Creation Wizard.

The Cloning Group Creation Wizard opens.

Select Cloning group follows ClusterXL.

Enter the Cloning Group name.
Enter a password for the Cloning Group administration account (cadmin).

Click Next for the Wizard Summary.

Click Finish.

Repeat Steps 1-5 for all members of the cluster.

Note - For troubleshooting steps, refer to sk119496.