CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


First, I hope you're all well and staying safe.
Second, I want to give a "heads up" that you should see more activity here shortly, and maybe a few cosmetic changes.
I'll post more details to the "Announcements" forum soon, so be on the lookout. -E

 

Results 1 to 7 of 7

Thread: Can the standby cluster member use the phsyical IP address

  1. #1
    Join Date
    2013-05-14
    Posts
    5
    Rep Power
    0

    Default Can the standby cluster member use the phsyical IP address

    Hello,

    I have a problem downloading updates from Checkpoint appliances via the Internet.

    I have a ClusterXL Active/Standby cluster based on R77.30 running on open server running GAIA.

    The Internet facing interface has a virtual IP address, because we are routing production traffic to the cluster via the same interface. When the standby cluster member is accessing the Internet it is using the cluster virtual IP address and not the physical IP Address.

    When the active cluster member checks for updates it is using the virtual IP address and it is working.
    When the standby cluster member checks for updates it is using the virtual IP address and it is not working.

    To update the standby cluster member I need to fail over the cluster to make the standby cluster member the active cluster member.

    Is there a way to get the standby cluster member to use the physical IP address, instead of the virtual IP address?
    I would be happy if both members used the physical IP addresses when sending traffic.

    Many thanks,
    Michael

  2. #2
    Join Date
    2017-04-26
    Posts
    19
    Rep Power
    0

    Default Re: Can the standby cluster member use the phsyical IP address

    So the default setting is to hide behind the VIP, the technical term is called cluster hide/fold. This SK covers what you need.

    https://supportcenter.checkpoint.com...product=VSX%22

  3. #3
    Join Date
    2006-03-21
    Posts
    87
    Rep Power
    17

    Default Re: Can the standby cluster member use the phsyical IP address

    By default the Active member does not forward traffic sent to the standby gateway.

    You might need to set fwha_forw_packet_to_not_active to 1 (zero by default)

    [Expert@HostName]# fw ctl set int fwha_forw_packet_to_not_active 1

    sk43346 can give you an idea.

    Regards

    Ed

  4. #4
    Join Date
    2013-05-14
    Posts
    5
    Rep Power
    0

    Default Re: Can the standby cluster member use the phsyical IP address

    Hi,

    Thanks I will check this out.

    Many thanks!

  5. #5
    Join Date
    2013-05-14
    Posts
    5
    Rep Power
    0

    Default Re: Can the standby cluster member use the phsyical IP address

    Hi,

    It seems both solutions fix the problem, but I am using the first one mentioned ... as it was first. But thanks to all.

    Unfortunately I am one of those annoying people that not only want a solution, but need to understand why. If any one can explain when we have this behaviour: ClusterXL mechanism was improved and in some cases might cause Active member to drop packets that should be forwarded to Standby member. This behaviour is by design.

    It was strange that that for ICMP traffic the Active member would forward the traffic to the standby.
    Also for UDP the Active member would forward the traffic to the standby.
    It was only for TCP (Maybe because TCP is stateful and the active did not see the outgoing packets), that the Active member did not forward the traffic to the standby.

    Thanks to all and to all a good day!

  6. #6
    Join Date
    2006-03-21
    Posts
    87
    Rep Power
    17

    Default Re: Can the standby cluster member use the phsyical IP address

    Quote Originally Posted by mhorne View Post

    Unfortunately I am one of those annoying people that not only want a solution, but need to understand why.
    I think lots of us are in the same boat here, so nothing to regret :)

    In regards to the services working before applying the solution. Probably is due to the fact that by default some services are excluded from clustering fold (most of them UDP)

    Have a read at sk31832 & sk98339

    I hope it helps. If not, keep asking ;)

    Regards

    Ed

  7. #7
    Join Date
    2005-11-25
    Location
    United States, Southeast
    Posts
    857
    Rep Power
    18

    Default Re: Can the standby cluster member use the phsyical IP address

    There are two or three under-the-hood solutions to this problem.

    Personally, I prefer the out-in-the-open solution.

    The table.def changes are hidden, and you have to remember that you did them.. When you preform a Major Version upgrade, you may find that you have to reverse the change, or have to remember you did it so you can re-do it..

    I believe it's best to add a Manual NAT rule to the top of the NAT policy that says something like;

    ClusterMember01ExternalIP -> Any -> Any ; Original -> Original -> Original

    It's out in the open.. it's a part of policy, shows up in the NAT fields in Logs etc.

    Repeat for each cluster member.

Similar Threads

  1. Replies: 0
    Last Post: 2013-10-20, 14:13
  2. top-most member in cluster is still standby
    By matus.cech in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 2
    Last Post: 2009-02-25, 21:41
  3. Standby FW uses cluster address
    By elvinmj in forum Management High Availability
    Replies: 2
    Last Post: 2006-12-21, 10:57
  4. Routing to the standby cluster member
    By lserge in forum Clustering (Security Gateway HA and ClusterXL)
    Replies: 1
    Last Post: 2006-07-11, 15:39
  5. SPLAT High CPU utilization in standby cluster member
    By omahrez in forum Check Point SecurePlatform (SPLAT)
    Replies: 0
    Last Post: 2006-05-19, 12:07

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •