VSX Clustering question

[splat]

Hi all,

VSX has the ability to Cluster at the Container level or the VM (firewall instance) level.

VSX Gateway High Availability - if any VM, Virtual Switch, etc... goes down, the entire member fails over to the second VSX.

or VM High Availability. - whereby only that VM is flipped over to its corresponding cluster member on the other container and everyone else is as is.

I am just curious about how other folks have deployed their VSX Clusters, and what the reasons were that pushed you folks in one config direction vs. the other.

Thanks

Sp

[eduardw]

Hi Splat
I manage and build 5 vsx cluster(4 R65 and 1 scalabilty pack) their al in HA mode.
When you do loadsharing or single system fail over you can not use virtual routers. Virtual routers are mandatory for our network design.
We do not track every vlan for a fail over we use the default setting. So only when the lowest or highest vlan on a interface goes down the clusters goes in a fail over. Of course there are many other tracking instance the we use, but they are all in there default configuration.

Eduard

[marklar]

Virtual System Load Sharing, I deliberately avoided the need for Virtual Routers in our design so we could move individual virtual firewalls between cluster nodes as needed (ie. for technical or political reasons).

m.

[splat]

Hi Marklar,

Thanks. You mentioned:

" Virtual System Load Sharing, I deliberately avoided the need for Virtual Routers in our design so we could move individual virtual firewalls between cluster nodes as needed"

So, you are saying in a Full-System HA, whereby all constituents, (any failing virtual device, then everybody jumps ship and is failed over to the 2nd container - you need virtual routers in that kind of design?

I'm curious to know how your firewalls themselves were configured. Bridged mode or like standard FW with subnets?

Thanks much for all replies.

Sp

[sisu-up]

I do the same as eduard, as I am using VR's and my internal interfaces are using 802.1q for customers, and since we control the vlans, if one vlan goes down it would be a configuration issue or a failure further out toward the access layer and it would only effect that one vlan tag not the whole cluster of VS's.

As for the external interfaces they are layer 3, and behave as a normal HA configuration would. After fours years of running this way, we have not had an issue that caused a re-design of the configuration. Also if you do any dymanic routing you cannot make use of any of the load sharing features.

Hi Splat
I manage and build 5 vsx cluster(4 R65 and 1 scalabilty pack) their al in HA mode.
When you do loadsharing or single system fail over you can not use virtual routers. Virtual routers are mandatory for our network design.
We do not track every vlan for a fail over we use the default setting. So only when the lowest or highest vlan on a interface goes down the clusters goes in a fail over. Of course there are many other tracking instance the we use, but they are all in there default configuration.

Eduard

[marklar]

You mentioned:

" Virtual System Load Sharing, I deliberately avoided the need for Virtual Routers in our design so we could move individual virtual firewalls between cluster nodes as needed"

So, you are saying in a Full-System HA, whereby all constituents, (any failing virtual device, then everybody jumps ship and is failed over to the 2nd container

That is one way VSLS can be made to work, I suggest talking to your systems integrator or Check Point pre-sales for the full spiel on what VSLS can do and what limitations there are.

- you need virtual routers in that kind of design?

Virtual Systems and Virtual Switches only, routing in and out of the environment is handled by real routers. Plan your layer 2 very carefully, that is the key.

I'm curious to know how your firewalls themselves were configured. Bridged mode or like standard FW with subnets?

Standard with lots of VLANs and subnets and static routes.

m.