Synchronizing Connections in the Cluster

A failureClosed A hardware or software problem that causes a Check Point Firewall to be unable to serve as a Cluster Member (for example, one of cluster interface has failed, or one of the monitored daemon has crashed). Cluster Member that suffered from a failure is declared as failed, and its state is changed to Down (a physical interface is considered Down only if all configured VLANs on that physical interface are Down). of a Firewall results in an immediate loss of activeClosed State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Check Point Firewall (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. connections in and out of the organization. Many of these connections, such as financial transactions, may be mission critical, and losing them will result in the loss of critical data. ClusterXLClosed Cluster of Check Point Firewalls that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Firewalls are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) Traditional VSX VSLS Cluster supports up to 13 Cluster Members. Note: In the ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. supplies an infrastructure that ensures that no data is lost in case of a failure, by making sure each Cluster MemberClosed Check Point Firewall that is part of a cluster. is aware of the connections going through the other members. Passing information about connections and other Security Gateway states between the ClusterClosed Two or more Check Point Firewalls that work together in a redundant configuration - High Availability, or Load Sharing. Members is called State SynchronizationClosed Technology that synchronizes the relevant information about the current connections (stored in various kernel tables on Check Point Firewalls) among all Cluster Members over Synchronization Network. Due to State Synchronization, the current connections are not cut off during cluster failover..

Every IP-based service (including TCP and UDP) recognized by the Security Gateway, is synchronized.

Members of a ClusterXL in Load SharingClosed A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. mode must be synchronized.

Members of a ClusterXL in High AvailabilityClosed A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. mode do not have to be synchronized. Although, if they are not synchronized, current connections are interrupted during cluster failoverClosed Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over..