NIC Teaming on SPLAT

[NACCIS]

Peoples

I would like to know if it is possible to team 2 nics on a HP DL 360 G5. the OS is SPLAT running Provider1 (R65). I want to be to able to make my system fully redundant. As have two nics teamed feed to two different switches using the same IP.

Any idea's ?

NACCIS

[cciesec2006]

I've heard that NIC teaming is supported on NGx R65 but for firewall only,
NOT provider-1 or SmartCenter. Checkpoint wants you to buy an HA
license for a secondary Provider-1. That's how they make money.

[ccie16798]

hello

as far as i know it supported on *any* splat install;
sysconfig > network config > add interface > bonding
interface bonding has been around in linux for YEARS, but when a closed-source company uses a fairly outdated kernel.....

regards
Etienne

Originally Posted by cciesec2006

I've heard that NIC teaming is supported on NGx R65 but for firewall only,
NOT provider-1 or SmartCenter. Checkpoint wants you to buy an HA
license for a secondary Provider-1. That's how they make money.

[cciesec2006]

are you sure about this? This is taken from NGx R65 2.4 kernel enforcement
module:

Choose a connection type to add ('e' to exit):
------------------------------------------------------------------
1) Secondary IP on interface (alias) 5) Loopback connection
2) VLAN 6) PPPoE connection
3) Bridge 7) PPTP connection
4) Bond 8) ISDN connection
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:

This is taken from a Provider-1 NGx R65 2.4 kernel:

Choose a connection type to add ('e' to exit):
------------------------------------------------------------------
1) Secondary IP on interface (alias) 4) PPPoE connection
2) VLAN 5) PPTP connection
3) Loopback connection 6) ISDN connection
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:

No bonding on the Provider-1 machine.

[NACCIS]

To all
Thank you for your input. I will investigate more. But i think i may have mislead some of you. My P1's are already in HA. But my site 2 is in a full redundant state. All i need to do is team the nics on the provider 1b (ha) so that its ip is visible on both switches. Then should there be a power fail, at th switch, at the fw. I will still be able to get to the p1b(ha).

I have an idea and i will post the solution later... with some luck

NACCIS

[ccie16798]

Hello,

i have it too, on linux SPLAT 2.4.... strange! and i can configure bridge too...
Etienne

Choose a connection type to add ('e' to exit):
------------------------------------------------------------------
1) Secondary IP on interface (alias) 5) Loopback connection
2) VLAN 6) PPPoE connection
3) Bridge 7) PPTP connection
4) Bond 8) ISDN connection
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:
[Expert@p1-test]# uname -a
Linux p1-test 2.4.21-21cp #1 Sun Feb 11 15:56:58 IST 2007 i686 i686 i386 GNU/Linux
[Expert@p1-test]# fwm mds ver
This is Check Point Provider-1 Server NGX (R65) - Build 292
[Expert@p1-test]#

Originally Posted by cciesec2006

are you sure about this? This is taken from NGx R65 2.4 kernel enforcement
module:

Choose a connection type to add ('e' to exit):
------------------------------------------------------------------
1) Secondary IP on interface (alias) 5) Loopback connection
2) VLAN 6) PPPoE connection
3) Bridge 7) PPTP connection
4) Bond 8) ISDN connection
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:

This is taken from a Provider-1 NGx R65 2.4 kernel:

Choose a connection type to add ('e' to exit):
------------------------------------------------------------------
1) Secondary IP on interface (alias) 4) PPPoE connection
2) VLAN 5) PPTP connection
3) Loopback connection 6) ISDN connection
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice:

No bonding on the Provider-1 machine.

[Jay_D]

What have been the results?
I also intend to use bonding on the WAN and on the LAN interface. My intention is to connect both sides to 2 different HP switches. The switches will be connected to eachother so I suppose STP should be enabled.
I'll be using a DL380 G5 as SPLAT.