CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


First, I hope you're all well and staying safe.
Second, I want to give a "heads up" that you should see more activity here shortly, and maybe a few cosmetic changes.
I'll post more details to the "Announcements" forum soon, so be on the lookout. -E

 

Results 1 to 9 of 9

Thread: Remove interface and vlan from ClusterXL Monitoring

  1. #1
    Join Date
    2016-10-31
    Posts
    53
    Rep Power
    7

    Default Remove interface and vlan from ClusterXL Monitoring

    Can someone advise how I can remove VLAN interface and Physical interface from the ClusterXL Monitoring in VSX environment. I do not want to touch topology.I just wanted to isolate the one virtual system out of the 5 as temporary so once VSX isolate the VSX gateway does not try to failover and move into split brain situation.

  2. #2
    Join Date
    2007-06-04
    Posts
    3,314
    Rep Power
    20

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    Same as on a physical device with the $FWDIR/conf/discntd.if file.

    List the interfaces want to ignore within ClusterXL and then install Security policy. Just make sure change to the appropriate vs within the CLI


    Stop all Check Point Services:

    [Expert@HostName]# cpstop


    2.Edit the $FWDIR/conf/discntd.if with a Vi text editor:

    [Expert@HostName]# vi $FWDIR/conf/discntd.if

    Note:
    If the $FWDIR/conf/discntd.if file does not exist, then create it:
    [Expert@HostName]# touch $FWDIR/conf/discntd.if


    3.Add the names of all interface that should not be monitored by ClusterXL on separate lines.

    Example:
    eth4
    eth5
    eth6

    To obtain the correct interface names, run this command:
    [Expert@HostName]# fw ctl iflist

    Note: In Gaia OS, in R75.47 and R77.20 (and above), this file is not needed anymore to list the unused interfaces (except for the physical slaves of Bond interfaces).


    4.Save changes in the Vi editor and exit.


    5.Start all Check Point Services:

    [Expert@HostName]# cpstart


    6.Repeat the same actions for the other cluster members.

    Note: If after making these changes to the $FWDIR/conf/discntd.if and running 'cpstart', the problematic interfaces are not shown as 'Disconnected' in the output of 'cphaprob -a if' command, then reboot the cluster members.

  3. #3
    Join Date
    2016-10-31
    Posts
    53
    Rep Power
    7

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    As you said in in R75.47 and R77.20 (and above) its not needed anymore.I am going to do this in R77.30 so what I would need to know without impacting other live VS.

  4. #4
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    18

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    Quote Originally Posted by mcnallym View Post
    Same as on a physical device with the $FWDIR/conf/discntd.if file.

    List the interfaces want to ignore within ClusterXL and then install Security policy. Just make sure change to the appropriate vs within the CLI


    Stop all Check Point Services:

    [Expert@HostName]# cpstop


    2.Edit the $FWDIR/conf/discntd.if with a Vi text editor:

    [Expert@HostName]# vi $FWDIR/conf/discntd.if

    Note:
    If the $FWDIR/conf/discntd.if file does not exist, then create it:
    [Expert@HostName]# touch $FWDIR/conf/discntd.if


    3.Add the names of all interface that should not be monitored by ClusterXL on separate lines.

    Example:
    eth4
    eth5
    eth6

    To obtain the correct interface names, run this command:
    [Expert@HostName]# fw ctl iflist

    Note: In Gaia OS, in R75.47 and R77.20 (and above), this file is not needed anymore to list the unused interfaces (except for the physical slaves of Bond interfaces).


    4.Save changes in the Vi editor and exit.


    5.Start all Check Point Services:

    [Expert@HostName]# cpstart


    6.Repeat the same actions for the other cluster members.

    Note: If after making these changes to the $FWDIR/conf/discntd.if and running 'cpstart', the problematic interfaces are not shown as 'Disconnected' in the output of 'cphaprob -a if' command, then reboot the cluster members.
    This approach is for physical GWs and not VSX. In fact there is no any "clean"way to achieve the desired results without touching topology of the VS in question.

    You still can disable interfaces and VLANs attached to that particular VS on the adjacent networking devices. In this case all interfaces on the VS will be down.

    Alternatively, you can uninstall policy on that VS on both cluster members.

    Neither way is "clean" and non-intrusive.


    Sent from my iPhone using Tapatalk
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  5. #5
    Join Date
    2016-10-31
    Posts
    53
    Rep Power
    7

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    My assumption is that once I disable the ports to adjacent device the firewall may try to failover because of ClusterXL monitoring so I do not want firewall not to be failover.

  6. #6
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    18

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    Quote Originally Posted by ba3113 View Post
    My assumption is that once I disable the ports to adjacent device the firewall may try to failover because of ClusterXL monitoring so I do not want firewall not to be failover.
    Are you running VSLS or not?
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  7. #7
    Join Date
    2016-10-31
    Posts
    53
    Rep Power
    7

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    We are running VSX in Active Standy Mode.

  8. #8
    Join Date
    2006-03-08
    Location
    Lausanne
    Posts
    1,030
    Rep Power
    18

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    Quote Originally Posted by ba3113 View Post
    We are running VSX in Active Standy Mode.
    In this case yes, disabling interfaces might face failover and WILL cause Active/Down status on the cluster. Same for unloading policy from VS in question.

    If you are looking a clean way, best would be to remove interfaces from VS or VS in whole.
    -------------

    Valeri Loukine
    CCMA, CCSM, CCSI
    http://checkpoint-master-architect.blogspot.com/

  9. #9
    Join Date
    2016-10-31
    Posts
    53
    Rep Power
    7

    Default Re: Remove interface and vlan from ClusterXL Monitoring

    If we disable interface on both device active and standy.Will is be there any Tie between device so they won't failover.

Similar Threads

  1. ClusterXL and Path Monitoring
    By sanhy85 in forum Firewall Blade
    Replies: 4
    Last Post: 2015-12-07, 05:52
  2. ClusterXL - Remove one interface from monitoring
    By laf_c in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 8
    Last Post: 2014-11-05, 15:56
  3. Issue New HA ClusterXL multiple VLAN on interface
    By emiel555 in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 9
    Last Post: 2012-01-27, 03:18
  4. interface monitoring for failover in clusterXL
    By sebastan_bach in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 12
    Last Post: 2010-02-18, 03:05
  5. Remove ClusterXL interface
    By Scoop in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 0
    Last Post: 2006-05-11, 07:14

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •