Configuring Virtual System Load Sharing

Introduction

VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Clusters can efficiently balance network traffic load by distributing active Virtual Systems between VSX Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members.

This capability is known as Virtual System Load Sharing (VSLS).

Virtual System Load Sharing VSX Cluster technology that assigns Virtual System traffic to different Active Cluster Members. Acronym: VSLS. is a cluster technology that assigns traffic for Virtual Systems to different Active VSX Cluster Members, which has these benefits:

• Capacity: VSLS leverages the cluster machines to handle greater network volume by efficiently dividing the load.

• Redundancy: VSLS gives full redundancy by maintaining connectivity for all Virtual Systems even when individual VSX Cluster Members fail.

• Scalability: VSLS provides linear scalability for throughput and session rate.

• Cost Effectiveness: A VSLS cluster uses standard network switches to get cost effective Load Sharing.

• Ease of Configuration: Virtual Systems are automatically distributed between all the VSX Cluster Members - no special configuration is required.

• Priority Designation: Mission-critical Virtual Systems can be separated from the other Virtual Systems to utilize better bandwidth and resources.

• System Scalability: Every VSX Cluster Member Security Gateway that is part of a cluster. added to the cluster increases the overall system capacity and redundancy.

Note - These Virtual Devices are not supported when the Per Virtual System Virtual Device on a VSX Gateway or VSX Cluster Member that implements the functionality of a Security Gateway. Acronym: VS. state is enabled: Virtual Routers Virtual Switches without physical or VLAN interfaces

In an example deployment scenario with three VSX Cluster Members, each with three Virtual Systems: an equalized Load Sharing deployment might have one Active Virtual System on each VSX Cluster Member.

A different member hosts the active peer for each Virtual System. This distribution spreads the load equally between the VSX Cluster Members.

When you create a Virtual System, VSX automatically assigns Standby and Backup states to the applicable peers and distributes them between the other VSX Cluster Members.

In the event that a VSX Cluster Member fails, VSLS directs traffic destined to affected Virtual Systems to their fully synchronized Standby peers, which then become Active. At the same time, a Backup Virtual System switches to Standby, and synchronizes with the newly Active Virtual System.

In the event that an individual active Virtual System fails, it immediately fails over to its Standby peer and one of its Backup peers becomes the Standby, synchronizing with the newly Active peer.

VSLS lets administrators manually assign Virtual Systems to specified VSX Cluster Members, or lets VSX automatically assign Virtual System traffic dynamically.

Item	Description
1	VSX Cluster with 3 Cluster Members, each running 3 Virtual Systems (2, 3, and 4)
2	Virtual System 1 on VSX Cluster Member 1 is Active
3	Virtual System 1 on VSX Cluster Member 2 is Standby
4	Virtual System 1 on VSX Cluster Member 3 is Backup
5	Policy updates only
6	State tables are synchronized

All other Virtual Systems continue to function as usual, and no failover occurs.

Configuring a VSX Cluster in VSLS Mode

1. Install the VSX Cluster Members

   See the R81 Installation and Upgrade Guide - Chapter Installing a ClusterXL, VSX Cluster, VRRP Cluster - Section Installing a VSX Cluster.

2. Enable the Per Virtual System State mode on each VSX Cluster Member

   The Per Virtual System State mode enables active Virtual Systems to be placed on different VSX Cluster Members, and for Virtual System-specific failover. This setting is mandatory for VSLS.

   On each VSX Cluster Member:

   1. Connect to the command line.

   2. Log in to the Expert mode.

   3. Run:

      cpconfig

   4. Select:

      Enable Check Point Per Virtual System State

   5. When the question appears:

      Would you like to enable Per Virtual System state?

      Enter y to confirm.

   6. Reboot the VSX Cluster Member.

3. In SmartConsole, create a new VSLS VSX Cluster object

   1. Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Main Domain Management Server that manages the VSX Cluster.

   2. From the navigation panel, click Gateways & Servers.

   3. At the top, click Objects menu > More object types > Network Object > Gateways and Servers > VSX > New Cluster.

      The VSX Cluster Wizard > General Properties opens.

   4. Create and configure the new VSX Cluster.

      See Working with VSX Clusters.

      1. On the General Properties page, from VSX Cluster Platform, select ClusterXLVirtual System Load Sharing.

      2. Complete the VSX Cluster Wizard.

4. In SmartConsole, create the objects of applicable Virtual Routers and Virtual Systems

   See:

   • Working with Virtual Routers

   • Working with Virtual Systems

5. Use the 'vsx_util vsls' command on the Management Server

   Use the "vsx_util vsls" command (see vsx_util vsls) on the Management Server to do different Virtual System Load Sharing configuration tasks:

   • Show the current VSLS configuration

   • Distribute Virtual Systems equally between VSX Cluster Members

   • Set all Virtual Systems as Active on one VSX Cluster Member

   • Manually define the priority and weight for individual Virtual Systems

   • Toggle VSLS mode between Active Up and Primary Up

   • Import VSLS configuration from CSV text files

   • Export VSLS configuration to CSV text files

   Procedure:

   1. Connect to the command line on the Management Server.

   2. Log in to the Expert mode.

   3. Run:

      vsx_util vsls

   4. Enter the IP address of the Security Management Server or Domain Management Server.

   5. Enter the Management Server administrator user name and password.

   6. Select the applicable option from the VSLS menu.

      Example

      [Expert@MGMT:0]# vsx_util vsls Enter Security Management Server/main Domain Management Server IP address (Hit 'ENTER' for 'localhost'): 172.16.16.240 Enter Administrator Name: admin Enter Administrator Password: ****   Select VSX gateway/cluster object name: 1) VSX_Cluster_1 2) VSX_Cluster_2 3) VSX_GW_1 4) VSX_GW_2 Select: 1     VS Load Sharing - Menu ________________________________ 1. Display current VS Load sharing configuration 2. Distribute all Virtual Systems so that each cluster member is equally loaded 3. Set all VSes active on one member 4. Manually set priority and weight 5. Toggle VSLS mode between Active Up and Primary Up 6. Import configuration from a file 7. Export configuration to a file 8. Exit   Enter redistribution option (1-8) [1]:

Virtual Routers in VSLS Mode

From R81, you can configure Virtual Routers in VSLS mode.

Description of Virtual Router Groups

To ensure traffic flow during a VSX Cluster failover, a Virtual Router Virtual Device on a VSX Gateway or VSX Cluster Member that functions as a physical router. Acronym: VR. and all Virtual Systems that connect to it belong to the same Virtual Router Group.

The Virtual Router in a Virtual Router Group manages all Virtual Systems in that Virtual Router Group. It makes sure all Virtual Systems are Active on the same VSX Cluster Member as the Virtual Router.

If at least one Virtual System or the Virtual Router in the affected Virtual Router Group fail, all Virtual Systems and the Virtual Router in the same Virtual Router Group fail over from the affected VSX Cluster Member to another VSX Cluster Member.

Important: A Management Server creates the corresponding Virtual Router Group automatically when you create a Virtual Router object. You can connect a Virtual System to only one Virtual Router. The cluster state of all members of the same Virtual Router Group is Active on the same VSX Cluster Member. Changes in the cluster state of Virtual Systems in a Virtual Router Group take effect only after you install the Access Control Policy on the applicable Virtual Systems. Connecting an existing Virtual System to an existing Virtual Router: If the cluster state of an existing Virtual System is Active on one VSX Cluster Member, and the cluster state of an existing Virtual Router is Active on another VSX Cluster Member, then after you connect the Virtual System to this Virtual Router and install the Access Control Policy on the Virtual System, it becomes Active on the same VSX Cluster Member as the Virtual Router.

Viewing the existing Virtual Router Groups on a Management Server

Viewing the existing Virtual Router Groups on VSX Cluster Members