CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it again! He has just released the 2nd edition of "Max Power".
Rather than get into details here, I urge you to check out this announcement post.
It's a massive upgrade, and well worth checking out. -E

 

Results 1 to 10 of 10

Thread: VRRP works on which checkpoint version

  1. #1
    Join Date
    2016-09-03
    Posts
    27
    Rep Power
    0

    Default VRRP works on which checkpoint version

    VRRP works on which checkpoint version ?

  2. #2
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    295
    Rep Power
    13

    Default Re: VRRP works on which checkpoint version

    I believe all GAiA versions support VRRP. What are you trying to accomplish, though? I don't think I've ever seen a situation where it's better to use VRRP than ClusterXL New Mode.
    Zimmie

  3. #3
    Join Date
    2016-09-03
    Posts
    27
    Rep Power
    0

    Default Re: VRRP works on which checkpoint version

    Just want to know since when they have started VRRP and which one is better ClusterXL or VRRP

  4. #4
    Join Date
    2014-09-02
    Posts
    348
    Rep Power
    10

    Default Re: VRRP works on which checkpoint version

    VRRP was introduced in GAIA (which was introduced in R75.40).

    One of the primary reasons for the introduction of GAIA was to consolidate/replacement both SPLAT and IPSO. The goal was to offer all of the features of each, so that everyone could "upgrade" to GAIA. To support this effort, Check Point wanted/needed to support those who had previously been using VRRP on IPSO.

    As to which is better, I break it down to this when teaching (it's still in the curriculum):
    - VRRP offers more granularity/control (think priorities/deltas/routers)
    - That granularity comes at the cost of more complex configuration, making ClusterXL easier to set up

    Keep in mind that the sync component of ClusterXL is still used in either case. The choice of VRRP vs. ClusterXL is only to handle the network-level aspects.

    -E

  5. #5
    Join Date
    2007-06-04
    Posts
    3,295
    Rep Power
    16

    Default Re: VRRP works on which checkpoint version

    The only time that found VRRP better then ClusterXL is down to the Network Environment and the difference between how the two work.

    VRRP uses a Virtual MAC address for the HA IP address, which remains constant no matter which box is active
    ClusterXL uses the Interface MAC of the Active Node for the HA IP address so upon failover the Gratuitous ARP packets are sent out to update surrounding devices that the MAC has changed for the HA IP address. Have come across situations where the surrounding network devices don't accept the G-ARP packet and so continue to try and use the OLD MAC.

    You can however fix this with the use VMAC option which then uses a single Virtual MAC address instead of using the Interface MAC thus the MAC of the HA IP doesn't change upon failover.

    Is the only reason that would use VRRP rather than ClusterXL today, but would be more inclined to use the VMAC option in ClusterXL now and only really find Gaia with VRRP where IPSO Boxes come out and Gaia Boxes gone in.

    Basically less work to do ClusterXL compared with VRRP so that is what I use, not found any real reason today to continue to use VRRP other then if people used to IPSO they feel more comfortable with it.

  6. #6
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,248
    Rep Power
    13

    Default Re: VRRP works on which checkpoint version

    Quote Originally Posted by mcnallym View Post
    The only time that found VRRP better then ClusterXL is down to the Network Environment and the difference between how the two work.

    VRRP uses a Virtual MAC address for the HA IP address, which remains constant no matter which box is active
    ClusterXL uses the Interface MAC of the Active Node for the HA IP address so upon failover the Gratuitous ARP packets are sent out to update surrounding devices that the MAC has changed for the HA IP address. Have come across situations where the surrounding network devices don't accept the G-ARP packet and so continue to try and use the OLD MAC.

    You can however fix this with the use VMAC option which then uses a single Virtual MAC address instead of using the Interface MAC thus the MAC of the HA IP doesn't change upon failover.

    Is the only reason that would use VRRP rather than ClusterXL today, but would be more inclined to use the VMAC option in ClusterXL now and only really find Gaia with VRRP where IPSO Boxes come out and Gaia Boxes gone in.

    Basically less work to do ClusterXL compared with VRRP so that is what I use, not found any real reason today to continue to use VRRP other then if people used to IPSO they feel more comfortable with it.
    The only real use cases for VRRP over ClusterXL are in my opinion:

    1) Have the need to present more than one Cluster or Virtual IP (Backup Address) on a single physical or logical interface. VRRP can do this, ClusterXL can't. Generally this indicates more than one IP subnet in use on the same VLAN/segment which is not exactly solid network design...

    2) Some kind of external entity (load balancing appliance, dynamic routing protocol such as OSPF) is handling the load balancing of traffic between multiple gateways. VRRP supports doing this, but ClusterXL has its own mechanism for balancing traffic and will interfere with the external entity.
    --
    Second Edition of my "Max Power" Firewall Book
    Now Available at http://www.maxpowerfirewalls.com

  7. #7
    Join Date
    2014-09-02
    Posts
    348
    Rep Power
    10

    Default Re: VRRP works on which checkpoint version

    Wow - you guys decided to dive right in to the specific use cases, where I just left it at "granularity/control"

    To add to the specific reasons above, one of the cool "old school" uses was to prioritize interfaces (via deltas). You can have more critical ones (like internet and e-commerce web farm) set with higher delta's than less critical (like testing and guest networks). This could allow a gateway with 2 "less important" failures to stay active over another with only 1 "critical" failure. The reason this is silly, of course, is that it's only a benefit if you to have 2 gateways with simultaneous failures. The better solution is to fix the first failure before there's a second!

    -E

  8. #8
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    295
    Rep Power
    13

    Default Re: VRRP works on which checkpoint version

    Quote Originally Posted by ShadowPeak.com View Post
    The only real use cases for VRRP over ClusterXL are in my opinion:

    1) Have the need to present more than one Cluster or Virtual IP (Backup Address) on a single physical or logical interface. VRRP can do this, ClusterXL can't. Generally this indicates more than one IP subnet in use on the same VLAN/segment which is not exactly solid network design...
    You can actually do this with simple proxy ARP statements. You just need to get the traffic to the firewall, then the firewall rules only care about the IP. Go ahead, ask me how I know.

    I would not use VRRP for a new deployment. If you're tempted to do something which VRRP can do and ClusterXL can't, it's probably a bad idea.
    Zimmie

  9. #9
    Join Date
    2009-04-30
    Location
    Colorado, USA
    Posts
    2,248
    Rep Power
    13

    Default Re: VRRP works on which checkpoint version

    Quote Originally Posted by Bob_Zimmerman View Post
    You can actually do this with simple proxy ARP statements. You just need to get the traffic to the firewall, then the firewall rules only care about the IP. Go ahead, ask me how I know.

    I would not use VRRP for a new deployment. If you're tempted to do something which VRRP can do and ClusterXL can't, it's probably a bad idea.
    Yes you can do that, but my impression is that doing so is not supported. Of course "not supported" isn't the same as "doesn't work" though...
    --
    Second Edition of my "Max Power" Firewall Book
    Now Available at http://www.maxpowerfirewalls.com

  10. #10
    Join Date
    2007-03-30
    Location
    DFW, TX
    Posts
    295
    Rep Power
    13

    Default Re: VRRP works on which checkpoint version

    Quote Originally Posted by ShadowPeak.com View Post
    Yes you can do that, but my impression is that doing so is not supported. Of course "not supported" isn't the same as "doesn't work" though...
    It's fundamentally how VSX works internally. The members get real IPs on automatically-allocated weird networks, then the VIPs are on the network the user specifies and are claimed using proxy ARP. I remember writing documentation on how to set up a cluster with off-net member IPs. I'm about 95% sure it's supported.
    Zimmie

Similar Threads

  1. which version of checkpoint to study
    By cciehemant in forum Beginner
    Replies: 8
    Last Post: 2015-04-25, 07:30
  2. Replies: 6
    Last Post: 2014-09-18, 02:46
  3. Checkpoint UTM-1 Version R75.30 Policy Push Error
    By csabik in forum SmartDashboard
    Replies: 6
    Last Post: 2014-04-09, 04:37
  4. Checkpoint UTM-1 Version R70.20
    By torenhof in forum SmartDashboard
    Replies: 5
    Last Post: 2013-02-19, 14:51
  5. Replies: 2
    Last Post: 2012-05-04, 08:21

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •