Advanced Clustering Configuration

This section presents several advanced clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. scenarios and procedures for their configuration.

Monitoring all VLANs in VSX Cluster

By default, ClusterXL only monitors two VLANS for failure detection and failover.

These are the highest and lowest VLAN tags defined for a given interface.

For example, if the topology for interface eth1 includes several VLAN tags in the range of eth1.10 to eth1.50, ClusterXL only monitors VLANs eth1.10 and eth1.50 for failure. Failures on any of the other VLANs are not detected in the default configuration.

Note - The command "cphaprob -a if" (or Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). command "show cluster interfaces vlans") shows the highest and lowest VLANs that are monitored.

When both the highest and lowest VLANs fail, all the VLANs are considered down, and a failover occurs.

This means that if a VLAN, which is not listed as the highest or lowest goes down, the VLAN Trunk is still considered "up", and no failover occurs.

There are instances in which it would be advantageous to monitor all the VLANs in the trunk, not just the highest and lowest, and initiate a failover when any one of the VLANs goes down.

To enable monitoring of all VLANs, set the value of the kernel parameter "fwha_monitor_all_vlan" to 1 in the $FWDIR/boot/modules/fwkern.conf file. For more information, see sk92826 and Working with Kernel Parameters on Security Gateway.

Configuring CoreXL in a VSLS VSX Cluster

In VSLS VSXClosed Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Clusters of version R80.10 and higher, changing the CoreXLClosed Performance-enhancing technology for Security Gateways on multi-core processing platforms. Multiple Check Point Firewall instances are running in parallel on multiple CPU cores. configuration or running the cphastop command in the context of VS0 results in failover of all the Active Virtual Systems on that VSX Cluster MemberClosed Security Gateway that is part of a cluster..

This behavior is by design. Active Virtual Systems on other VSX Cluster Members do not fail over.