Using the Wizard Mode in SmartConsole

This version includes two wizards:

  • Check Point Appliances and Open Servers

  • Check Point Small Office Appliances

The Cluster Wizard is recommended for all Check Point Appliances (except models lower than 3000 series), and for Open ServerClosed Physical computer manufactured and distributed by a company, other than Check Point. platforms.

To create a new cluster using Wizard Mode:

Step

Instructions

1

In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Cluster.

2

In Check Point Security Gateway Cluster Creation window, click Wizard Mode.

3

In the Cluster General Properties window:

  1. In the Cluster Name field, enter unique name for the clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object.

  2. In the Cluster IPv4 Address, enter the unique Cluster Virtual IPv4 addresses for this cluster.

    This is the main IPv4 address of the cluster object.

  3. In the Cluster IPv6 Address, enter the unique Cluster Virtual IPv6 addresses for this cluster.

    This is the main IPv6 address of the cluster object.

    Important - You must define a corresponding IPv4 address for every IPv6 address. This release does not support pure IPv6 addresses.

  4. In the Choose the Cluster's Solution field, select the applicable option and click Next:

    • Check Point ClusterXL and then select High Availability or Load Sharing

    • Gaia VRRP

4

In the Cluster member's properties window perform these steps for each Cluster MemberClosed Security Gateway that is part of a cluster. and click Next.

We assume you create a new cluster object from the scratch.

  1. Click Add > New Cluster Member to configure each Cluster Member.

  2. In the Cluster Name field, enter unique name for the Cluster Member object.

  3. In the Cluster IPv4 Address, enter the unique Cluster Virtual IPv4 addresses for this Cluster Member.

    This is the main IPv4 address of the Cluster Member object.

  4. In the Cluster IPv6 Address, enter the unique Cluster Virtual IPv6 addresses for this Cluster Member.

    This is the main IPv6 address of the Cluster Member object.

    Important - You must define a corresponding IPv4 address for every IPv6 address. This release does not support pure IPv6 addresses.

  5. In the Activation Key and Confirm Activation Key fields, enter a one-time password that you entered in First Time Configuration Wizard during the installation of this Cluster Member.

  6. Click Initialize.

    Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. will try to establish SICClosed Secure Internal Communication. The Check Point proprietary mechanism with which Check Point computers that run Check Point software authenticate each other over SSL, for secure communication. This authentication is based on the certificates issued by the ICA on a Check Point Management Server. with each Cluster Member.

    The Trust State field should show Trust established.

  7. Click OK.

5

In the Cluster Topology window, define a network type (network role) for each cluster interfaceClosed An interface on a Cluster Member, whose Network Type was set as Cluster in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. and define the Cluster Virtual IP addresses. Click Next.

The wizard automatically calculates the subnet for each cluster network and assigns it to the applicable interface on each Cluster Member. The calculated subnet shows in the upper section of the window.

The available network objectives are:

Network Objective

Description

Cluster Interface

A cluster interface that connects to an internal or external network.

Enter the Cluster Virtual IP addresses for each network (internal or external).

In addition, see Cluster IP Addresses on Different Subnets.

Cluster Sync Interface

A cluster Synchronization interface.

In Load SharingClosed A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. mode, you must define a synchronization interface.

Important -

Private

An interface that is not part of the cluster.

Cluster does not monitor this interface.

Cluster failoverClosed Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over. does not occur if a fault occurs on this interface.

This option is recommended for the dedicated management interface.

6

In the Cluster Definition Wizard Complete window, click Finish.

After you complete the wizard, we recommend that you open the cluster object and complete the configuration:

  • Change the Topology settings for each interface, if necessary

    1. Open the Cluster object and click the Network Management tab.

    2. Click on an interface to open its properties.

    3. In the General tab > Topology, click Modify.

    4. In the Leads To section, select the Override option.

    5. You can set the interface as External (leads to the Internet) or Internal.

    6. For an Internal interface topology, select one of the available options.

  • Define Anti-Spoofing properties for each interface

    1. To enable anti-spoofing, select the Perform Anti-Spoofing based on interface topology option.

    2. Select the action you want Anti-Spoofing to take: Prevent or Detect.

    If this is an external interface, you can configure a network, network group, or an address range, for which Anti-Spoofing is not performed.

  • Define the Network Type

    In the Network interface properties > General tab, Select the correct Network Type of each interface:

    • Cluster

    • Sync

    • Cluster + Sync

    • Private

  • Configure other Software Blades, features and properties as necessary

The Small Office Cluster wizard is recommended for Centrally Managed Check Point appliances - models lower than 3000 series.

To create a new Small Office cluster using Wizard Mode:

Step

Instructions

1

In SmartConsole, click Objects menu > More object types > Network Object > Gateways and Servers > Cluster > New Small Office Cluster.

2

In Check Point Security Gateway Cluster Creation window, click Wizard Mode.

3

In the Cluster General Properties window:

  1. Enter a unique name for the cluster object.

  2. Select the correct hardware type.

  3. Click Next.

4

In the Cluster Members window:

  1. Enter the member name and IPv4 addresses for each Cluster Member.

  2. Enter the one-time password for SIC trust.

  3. Click Next.

  4. Management Server will try to establish SIC with the Primary Cluster Member.

5

In the Configure WAN Interface page, configure the Cluster Virtual IPv4 address.

6

Define the Cluster Virtual IPv4 addresses for the other cluster interfaces.

7

Click Next, and then Finish to complete the wizard.

After you complete the wizard, we recommend that you open the cluster object and complete the configuration:

  • Define Anti-Spoofing properties for each interface

  • Change the Topology settings for each interface, if necessary

  • Define the Network Type

  • Configure other Software Blades, features and properties as necessary