Configuring Security Group High Availability

Note - Do not confuse this section with Configuring Weights for Security Group Members that is related to traffic distribution inside a Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected..

Setting Security Group Weights (High Availability Factors)

Each hardware component in a Security Group Member has a quality weight factor, which sets its relative importance to overall Security Group health.

For example, ports are more important than other components and are typically assigned a higher weight value.

The Security Group Member grade is the sum of all component weight values.

In a dual Dual Site environment, the Security Group with the higher grade becomes Active and handles traffic.

The grade for each component is calculated based on this formula:

(Unit Weight) x (Number of components in the state "UP")

To see the weight of each component, run in Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group. on a Security Group:

asg stat -v

Description

Use the "set chassis high-availability factors" command to configure a hardware component's weight.

Syntax in Gaia gClish of the Security Group

set chassis high-availability factors sgm <SGM Factor>

set chassis high-availability factors port {other <Other Port Factor> | standard <Standard Port Factor> | mgmt <Management Port Factor> | bond <Bond Port Factor>}

Parameters

Parameter

Description

<SGM Factor>

Weight factor for a Security Group Member.

Valid range: integer between 0 and 1000.

<Other Port Factor>

High grade port factor.

Valid range: integer between 0 and 1000.

<Standard Port Factor>

Standard grade port factor.

Valid range: integer between 0 and 1000.

<Management Port Factor>

Management port factor.

Valid range: integer between 0 and 1000.

<Bond Port Factor>

Bond interface factor.

Valid range: integer between 0 and 1000.

Examples

[Global] HostName-ch01-01 > set chassis high-availability factors sgm 100

[Global] HostName-ch01-01 > set chassis high-availability factors port other 70

[Global] HostName-ch01-01 > set chassis high-availability factors port standard 50

Setting the Quality Grade Differential

Description

Use the "set chassis high-availability failover" command in Gaia gClish to set the minimum quality grade differential that causes a failover.

Syntax in Gaia gClish of the Security Group

set chassis high-availability failover <Trigger>

Parameters

Parameter

Description

<Trigger>

Minimum difference in Chassis quality grade to trigger a failover.

Valid values: 1 - 1000.