Full HA or distributed

[Tsubasa]

Hi Checkpoint experts

Planning to do HA ClusterXl Active Standby between two 5400s .


I saw that are two options:

Full HA (between two standalone devices) and HA with the management server on a different machine.

Which one do you recommend ? How about the license for the management server for the full HA?

My opinion is go with the distributed one, put the management server in Esxi machine in Trust side.


Topology

Internet >> Checkpoint 5400 >> Trust
|
DMZ


Thank you.

[EricAnderson]

That's actually a pretty easy one - distribute management on a VM as you said. This is hands-down the recommended way to go. While "Full HA" is listed as being supported up through the previous generation (I don't see mention of it being supported on the latest, like your 5400's), it's never really been a great idea. Back in the day (yes, I just used that phrase) "Full HA" wasn't supported at all. As I always saw it, Full HA was introduced as a supported feature along with the first generation of Check Point appliances, primarily as a marketing/sales tactic to reduce the number of appliances that one had to purchase.

Standalone gateways in general are only really recommended when absolutely necessary. Usually, distributing the deployment allows greater flexibility when maintaining/upgrading, and gives better performance. One very important factor that's often overlooked is that the performance/specs on your 5400's are based on gateway only functionality. Dedicating resources to management functions will have a noticeable impact. I'd seen more than a few cases where a client had a UTM-1 130 or 270, which was properly sized, but improperly tasked with management responsibilities (by someone else, of course). Separating management would breathe new life into them. Of course, the specs of the newer boxes give a bit more overhead, but R80 will also consume a bunch more of it, especially for management.

Of course, you mentioned one important caveat: licensing. If all you've purchased is 5400 appliances, you don't have licensing for anything but standalone. Running distributed will require either an Open Server SMS license, or a Smart-1 appliance. Unless I'm missing some information, this is how your deployment/purchase should have been architected in the first place.

Anyone agree or disagree?

-E

[PhoneBoy]

Full HA should still be supported on all Check Point appliances that support local management *except* for the SMB appliances (600/700/1100/1200R/1400 series).
That said, I always recommend running the management on a separate system from your firewall for the reasons EricAnderson said.
The main reason people don't is cost, as it requires a separate management license.

[Tsubasa]

Thanks guys

Simulated the following topology in Vmware workstation.
SIC through trust , it works.


Topology

Internet >> Checkpoint 5400 New HA Active Standby >> Cisco L3 switch >> Trust (management server here)
|
DMZ

BTW:
Do you recommend Active Active HA(multicast or unicast) instead of Active Standby even if not an asymmetric routing environment?

Thanks.

[jflemingeds]

active/active is more trouble then its worth most of the time. Just keep it on active standby.

[varera]

Full HA will bring you some issues when migrating to distributed later on. So distributed, keep FW cluster in HA.


Sent from my iPad using Tapatalk