How to convert an existing FW to a A-S Cluster using Nokia VRRP?

[eyunghans]

All-

We are a rather large organization with over 80 Nokia (and a few Windows-based) FW's in a fully meshed VPN Community based on R60 HFA05. All of our external firewalls primary communication channel is to our home site based in the US, at which the core is a singular Nokia IP390. I've been tasked to get this core IP390 FW into a Active-Standby HA mode using Nokia VRRP.

From what I can gather so far I will need to do the following:
1) Setup a interface on both to be used solely for VRRP.
2) Run cpconfig on both FW's and state that each are a member of a cluster
3) Create a new FW definition inside the Console in order to state that this is indeed a Cluster.

The 3rd item is what I have the biggest concerns. I would think that in creating a completely new FW definition for our core that I would be creating an entirely new certificate. This new certificate for our core would need to be pushed to every FW; and all SecureClient users when connecting would immediately be prompted to accept the new certificate. Is this a correct assumption?

I assume I'm not the only person here who has had to go through this; anyone have any pointers?

Thanks,
eyunghans

[mcnallym]

Step 1: Build a new IP390 as a VRRP member. You will need an additional interface to use for State Synchronisation. VRRP is run on all of the traffic bearing interfaces.

You will also need to allocate two new IP addresses for each interface on the box as the VRRP address will be the original IP390 interface address, requiring the use of new IP addresses as the interface IP on the new IP390 and the existing IP390 that will be redone.

This will require that you define a new gateway object to represent the new Check Point.

Step 2: Create a Check Point Cluster Object and add the new object as a member. Configure the topology etc in the cluster object.

Step 3: Insert into network and push policy to all of the gateways.

You will indeed get a new cert as a new cluster object that will have its own new certificate.

Once done rebuild existing IP390 as a cluster member and add, then push policy again.