Active-Active Mode in ClusterXL

Introduction

R80.40 introduced a new ClusterXLClosed Cluster of Check Point Security Gateways that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Security Gateways are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) VSX VSLS cluster supports up to 13 Cluster Members. Note: In ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. mode called Active-Active.

This mode is designed for a clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., whose Cluster Members are located in different geographical areas (different sites, different cloud availability zones).

The IP addresses of the interfaces on each Cluster MemberClosed Security Gateway that is part of a cluster. are on different networks (including the Sync interfaces).

Each Cluster Member inspects all traffic routed to it and synchronizes the recorded connections to its peer Cluster Members.

The traffic is not balanced between the members.

Example Topology:

Important:

Limitations

These limitations apply to Active-Active mode in ClusterXL:

Configuring a new ClusterXL in Active-Active Mode

Note - This procedure is to configure a new ClusterXL object.

Step

Instructions

1

Install ClusterXL Cluster Members.

See the R81.20 Installation and Upgrade Guide.

Important:

On all Cluster Members in Active-Active mode, names of interfaces that belong to the same "side" must be identical (Known Limitation PMTR-70256).

Examples:

2

Optional: On each Cluster Member, enable Dynamic Routing, so they become routers in the applicable Area or Autonomous System on the site.

Important - In this case, you must enable the Bidirectional Forwarding Detection (BFD - ip-reachability-detection) on each interface that is configured for dynamic routing.

See the R81.20 Gaia Advanced Routing Administration Guide.

3

Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Management Server.

4

From the left navigation panel, click Gateways & Servers.

5

Create a new Cluster object in one of these ways:

  • From the top toolbar, click New () > Cluster > Cluster.

  • In the top left corner, click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Cluster.

  • In the top right corner, click Objects Pane > New > More > Network Object > Gateways and Servers > Cluster > Cluster.

In the Check Point Security Gateway Cluster Creation window, you must click Classic Mode.

6

From the left tree, click General Properties.

  1. In the IPv4 Address field, you must enter the 0.0.0.0 address.

  2. On the Network Security tab, you must clear IPsec VPN.

  3. For the list of supported Software Blades, see the Known Limitation PMTR-70255 in sk174965.

7

From the left tree, click Cluster Members.

  1. Click Add > New Cluster Member.

    The Cluster Member Properties window opens.

  2. In the Name field, enter the applicable name for the first Cluster Member object.

  3. Configure the main physical IP address(es) for this Cluster Member object.

    In the IPv4 Address and IPv6 Address fields, configure the same IPv4 and IPv6 addresses that you configured on the Management Connection page of the Cluster Member's First Time Configuration Wizard.

    Make sure the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Multi-Domain ServerClosed Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS. can connect to these IP addresses.

  4. Click Communication.

  5. In the One-time password and Confirm one-time password fields, enter the same Activation Key you entered during the Cluster Member's First Time Configuration Wizard.

  6. Click Initialize.

  7. Click Close.

  8. Click OK.

  9. Repeat Steps a-h to add the next Cluster Member.

 

If the Trust State field does not show Trust established, follow these steps:

  1. Connect to the command line on the Cluster Member.

  2. Make sure there is a physical connectivity between the Cluster Member and the Management Server (for example, pings can pass).

  3. Run:

    cpconfig

  4. Enter the number of this option:

    Secure Internal Communication

  5. Follow the instructions on the screen to change the Activation Key.

  6. In SmartConsole, click Reset.

  7. Enter the same Activation Key you entered in the cpconfig menu.

  8. In SmartConsole, click Initialize.

8

From the left tree, click ClusterXL and VRRP.

  1. In the Select the cluster mode and configuration section, select Active-Active.

  2. In the Tracking section, select the applicable option.

  3. Optional: Select Use State Synchronization.

    This configures the Cluster Members to synchronize the information about the connections they inspect.

    Best Practice - Enable this setting to prevent connection drops after a cluster failoverClosed Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over..

  4. Optional: Select Start synchronizing [  ] seconds after connection initiation and enter the applicable value.

    This option is available only for clusters R80.20 and higher.

    To prevent the synchronization of short-lived connections (which decreases the cluster performance), you can configure the Cluster Members to start the synchronization of all connections a number of seconds after they start.

    Range: 2 - 60 seconds

    Default: 3 seconds

    Notes:

    • This setting in the cluster object applies to all connections that pass through the cluster.

      You can override this global cluster synchronization delay in the properties of applicable services - see Configuring Services to Synchronize After a Delay .

    • The greater this value, the fewer short-lived connections the Cluster Members have to synchronize.

    • The connections that the Cluster Members did not synchronize, do not survive a cluster failover.

    Best Practice - Enable and configure this setting to increase the cluster performance.

9

Click OK to update the cluster object properties with the new cluster modeClosed Configuration of Cluster Members to work in these redundant modes: (1) One Cluster Member processes all the traffic - High Availability or VRRP mode (2) All traffic is processed in parallel by all Cluster Members - Load Sharing..

10

Open the cluster object and continue the configuration.

11

From the left tree, click Network Management.

  1. From the top, click the Get Interfaces > Get Interfaces With Topology.

    Important - On all Cluster Members in Active-Active mode, names of interfaces that belong to the same "side" must be identical (Known Limitation PMTR-70256).

  2. Select each interface and click Edit.

  3. From the left tree, click the General page.

  4. In the General section, in the Network Type field, select the applicable type:

  5. In the Member IPs section, make sure the IPv4 address and its Net Mask are correct on each Cluster Member.

  6. In the Topology section:

    Make sure the settings are correct in the Leads To and Security Zone fields.

    Only these options are supported on cluster interfaces (Known Limitation PMTR-70260):

    • Override > Network defined by routes (this is the default).

    • Override > Specific > select the applicable Network object or Network Group object.

12

Click OK.

13

Publish the SmartConsole session.

14

Configure and install the applicable Access Control Policy.

15

Configure and install the applicable Threat Prevention Policy.

16

Examine the cluster state.

See Viewing Cluster State.

Member1> show cluster state
 
Cluster Mode:   Active Active with IGMP Membership
 
ID         Unique Address  Assigned Load   State          Name
 
1 (local)  11.22.33.245    N/A             ACTIVE         Member1
2          11.22.33.246    N/A             ACTIVE         Member2
 
 
Active PNOTEs: None
 
... ... ...
 
Member1>

Changing the ClusterXL Mode to Active-Active

Step

Instructions

1

Connect with SmartConsole to the Management Server.

2

From the left navigation panel, click Gateways & Servers.

3

Open the existing ClusterXL object.

4

From the left tree, click ClusterXL and VRRP.

5

In the Select the cluster mode and configuration section, select Active-Active.

6

Mandatory: Click OK to update the cluster object properties with the new cluster mode.

7

Open the cluster object and continue the configuration.

8

From the left tree, click ClusterXL and VRRP.

  1. In the Tracking section, select the applicable option.

  2. Optional: Select Use State Synchronization.

    This configures the Cluster Members to synchronize the information about the connections they inspect.

    Best Practice - Enable this setting to prevent connection drops after a cluster failover.

  3. Optional: Select Start synchronizing [] seconds after connection initiation and enter the applicable value.

    This option is available only for clusters with version R80.20 and higher.

    To prevent the synchronization of short-lived connections (which hurts cluster performance), you can configure the Cluster Members to start the synchronization of all connections a number of seconds after they start.

    Range: 2 - 60 seconds

    Default: 3 seconds

    Notes:

    • This setting in the cluster object applies to all connections that pass through the cluster.

    • You can override this global cluster synchronization delay in the properties of applicable services - see Configuring Services to Synchronize After a Delay.

    • The greater this value, the fewer short-lived connections the Cluster Members have to synchronize.

    • The connections that the Cluster Members did not synchronize do not survive a cluster failover.

      Best Practice - Enable and configure this setting to improve the cluster performance.

9

From the left tree, click Network Management.

  1. Select each interface and click Edit.

  2. From the left tree, click the General page.

  3. In the General section, in the Network Type field, select the applicable type:

    • For cluster traffic interfaces, select Cluster.

      In the IPv4 field, the dummy IP address 0.0.0.0 / 24 is configured automatically.

      Note - SmartConsole requires an IP address configured for each interface. Cluster Members do not get and do not use this IP address.

    • For cluster synchronization interfaces, select Sync.

      • Check Point cluster supports only one synchronization network. If redundancy is required, configure a Bond interface.

      • In the Network Type field, it is not supported to select Cluster + Sync when you deploy a cluster in a cloud (for example: AWS, Azure).

      • For interfaces that do not pass the traffic between the connected networks, select Private.

  4. In the Member IPs section, make sure the IPv4 address and its Netmask are correct for each Cluster Member.

  5. In the Topology section:

    1. Make sure the settings are correct in the Leads To and Security Zone fields.

    2. Click Modify.

    3. In the Leads To section, if you select Override, only these options are supported on cluster interfaces (Known Limitation PMTR-70260):

      • Override > Network defined by routes (this is the default).

      • Override > Specific > select the applicable Network object or Network Group object.

    4. In the Anti-Spoofing section, make sure to clear the option Perform Anti-Spoofing based on interface topology.

    5. Click OK.

10

Click OK.

11

Publish the SmartConsole session.

12

Configure and install the applicable Access Control Policy.

13

Configure and install the applicable Threat Prevention Policy.

14

Examine the cluster state.

See Viewing Cluster State.

Member1> show cluster state
 
Cluster Mode:   Active Active with IGMP Membership
 
ID         Unique Address  Assigned Load   State          Name
 
1 (local)  11.22.33.245    N/A             ACTIVE         Member1
2          11.22.33.246    N/A             ACTIVE         Member2
 
 
Active PNOTEs: None
 
... ... ...
 
Member1>

Dynamic Routing Failover

When the cluster state of a Cluster Member is DOWN, it stops processing the dynamic routing traffic to force the next hop router to update its routing tables. As a result, there may be a network outage, because it takes time for dynamic routing protocols to update their routing tables and propagate the changes.