new to clustering need help

[sebastan_bach]

hi all i am new to checkpoint and trying out clustering. i was going through the documentation abt sticky connections.

abt sticky connections with regards to vpns. in load sharing mode i really get the point to duplicate sa and they say that we have set sticky decision for the vpns with third-party peers.

lets say i have 2 vpn peers in load sharing mode. when a peer initates a vpn with the virtual ip of the cluster lets say it gives the packet to the first member in the cluster and the cluster responds back .

now since in load sharing mode synchronisation is on is the ike sa also replicated on the other member of the cluster. if yes then they are they mentioning that a duplicated sa will be created which the third party peer might reject.

i not able able to get this thing clear can somebody pls clear this doubt.

regards

sebastan

[cciesec2006]

In Checkpoint Clustering mode, whether it is Nokia VRRP or ClusterXL in Active/Standby
or Active/Active (Unicast mode) or Active/Active (multicast), both of the firewall
will share the same SA.

The third party only knows a single SA. The concept is similar to Cisco IPSec
stateful failover with InterProcess Communication (IPC/SSO). In the Cisco IPSec
scenario, when the Active router fails, the standby router will take over with
the SAME SA. The third party VPN does not even know because nothing changed.

Does that make sense?

[sebastan_bach]

yeah mate i got that but then why have they mentioned that for site to site vpns we have to enable the sticky decision function and hub and spoke vpns we have to edit a file they mentioned in the doc.

do we have to do any of those .

can u pls help me out on that mate,

thanks for ur reply.

regards

sebastan

[cciesec2006]

you must be talking about route-based VPN. I have not used that so I can
not offer any help.

[sebastan_bach]

mate u know i have not worked on checkpoint vpns yet i am new to checkpoint.

anyways thanks for ur reply. i will try it out and let u know.

thanks

regards

sebastan

[cciesec2006]

Checkpoint route-based VPN is similar to Cisco Dynamic Multipoint VPN
(DMVPN), if I am not mistaken. The concept is the same except that
with DMVPN, you're also using GRE whereas I don't think you use GRE
in checkpoint route-based VPN