Changing the VSX Cluster Type

Important: The only mode available for a VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. that was installed as R81.10 and higher is Virtual System Load Sharing (VSLS). The High Availability mode is available only if you upgrade a VSX Cluster from R81 or lower to R81.10. You can also convert a VSLS cluster to the High Availability mode.

This section presents procedures for converting VSX Cluster between High Availability and VSLS.

Changing the VSX Cluster mode involves the use of the "vsx_util convert_cluster" command on the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

Converting from VSLS to High Availability

1. Redistribute all Active Virtual Systems to one VSX Cluster Member

   1. Close all SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. windows.

   2. Connect to the command line on the Management Server.

   3. Log in to the Expert mode.

   4. Run:

      vsx_util vsls

   5. Enter the IP address for the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Domain Management Server that manages this VSX Cluster.

   6. Enter the Management Server administrator user name and password.

   7. Select the VSX Cluster.

   8. From the Load Sharing menu, enter 3. Set all VSs active on one member.

   9. Enter the number of the VSX Cluster Member Security Gateway that is part of a cluster. that is hosting the Active Virtual Systems.

   10. Enter Y to save and apply the configuration.

   11. Exit the VSLS menu.

2. Disable the VSLS options

   Perform these steps on each VSX Cluster Member:

   1. Connect to the command line.

   2. Log in to the Expert mode.

   3. Run:

      cpconfig

   4. Disable the Per Virtual System State.

   5. Disable the ClusterXL for Bridge Active/Standby.

   6. Restart the Check Point services (this can cause cluster failover):

      cpstop ; cpstart

3. Convert the VSX Cluster to High Availability

   1. Connect to the command line on the Management Server.

   2. Log in to the Expert mode.

   3. Run:

      vsx_util convert_cluster

      See vsx_util convert_cluster.

   4. Enter the IP address for the Security Management Server or Main Domain Management Server that manages this VSX Cluster.

   5. Enter the Management Server administrator user name and password.

   6. From the Load Sharing menu, enter 3. Set all VSs active on one member.

   7. Select the VSX Cluster.

   8. Enter:

      HA

   9. Reboot each VSX Cluster Members (this can cause cluster failover).

   10. On each VSX Cluster Member:

       1. Connect to the command line.

       2. Log in to the Expert mode.

       3. Examine the VSX configuration:

          vsx stat -v

       4. Examine the VSX Cluster state and configuration:

          cphaprob state

   When the "vsx_util convert_cluster" command finishes, there should be only one Active VSX Cluster Member, on which all Virtual Systems are in the Active state, and one Standby VSX Cluster Member, on which all Virtual Systems are in the Standby state. Any additional VSX Cluster Members should be in Standby state, and their Virtual Systems in the Down state.

Converting from High Availability to VSLS

Note - You cannot convert a VSX Cluster to the VSLS mode, if it contains Virtual Systems in the Active/Active Bridge Mode Security Gateway or Virtual System that works as a Layer 2 bridge device for easy deployment in an existing topology., or contains Virtual Routers.