Check Point R75 Cluster Setup

Check Point R75 Cluster Setup

In this tutorial we will explore setting up a Check Point R75 Cluster consisting of 1 management server and 2 gateways.


Check Point R75 Cluster Lab

Setting up a Check Point R75 Cluster

1. First up, connect to your management server with smartdashboard. My management status is called cpmgmt. Right click on the Check Point object on the right hand side and select Security Cluster – UTM-1/Power-1/Open Server Cluster/IP series…


Check Point R75 Cluster Setup
2. Let’s select the Wizard Mode below.


Check Point R75 Cluster Setup
3. Give your cluster a name. I will call mine CPCLUSTER and I will assign the cluster the ip address 10.10.10.1. You will see later where this is set. Select Check Point ClusterXL and select High Availability. Click Next.


Check Point R75 Cluster Setup
4. We now add in the gateways that we would like to participate in our cluster. Click Add and select New Cluster Member. I’m select this option because I don’t have any gateways belonging to the management server yet. If you already have your gateways being managed by your management server you can select Add Existing Gateway.


Check Point R75 Cluster Setup
5. Type in the IP address of your Check Point Gateway. The IP address of my first gateway called cpgw1 is 10.10.10.2 Type in the activation key that you setup during installation of your gateway and click initialize. You should see Trust Established in the Trust State field. Click Ok.


Check Point R75 Cluster Setup
6. Do the same for gateway 2. My second gateway is called cpgw2 and has an ip address of 10.10.10.3. Click Ok.


Check Point R75 Cluster Setup
7. The 2 gateways are now added. Click Next.


Check Point R75 Cluster Setup
8. In this section we will configure the topology of the cluster. I have left out the external interface on purpose so I can show you how to add it manually later. Click Next.


Check Point R75 Cluster Setup
9. The first network I’ll setup is the Cluster Synchronization. Select Primary under Clsuter Synchronization. Click Next.


Check Point R75 Cluster Setup
10. The next interface i’ll setup is my internal network. Here i’ll set the cluster ip to 10.10.10.1 with a net mask of 255.255.255.0 Click Next.


Check Point R75 Cluster Setup
11. The cluster is now setup. Click Finish.


Check Point R75 Cluster Setup
12. As you can see on the right hand side, I have my cluster named CPCLUSTER with the 2 gateway members cpgw1 and cpgw2.


Check Point R75 Cluster Setup
13. If you right click on the properties of the CPCLUSTER, you can see the ClusterXL settings that are available.


Check Point R75 Cluster Setup
14. While still in the CPCLUSTER properties click on Topology.


Check Point R75 Cluster Setup
15. Click Edit Topology. As you can see in this screen shot, I have already setup the internal network with the cluster ip 10.10.10.1 and i’ve also setup the Sync network.


Check Point R75 Cluster Setup
16. Now I will add another NIC to my gateways which i’ll use for the external interface. After adding the NIC I will click on Get – All Members’ Interfaces with topology…


Check Point R75 Cluster Setup
17. The third network is added in. However under the CPCLUSTER column I will need to add the cluster IP address for the external network. Here I will add 192.168.1.101 with a subnet mask of 255.255.255.0. I’ve also changed the name of the interface to Outside. I’ve also changed the name for the internal interface to inside. If you right click on the 192.168.1.101 address and select edit, you can set the topology to External. Click Ok.


Check Point R75 Cluster Setup
18. Once your cluster is setup you must install the policy.


Check Point R75 Cluster Setup
Disclaimer:
All the tutorials included on this site are performed in a lab environment to simulate a real world production scenario. As everything is done to provide the most accurate steps to date, we take no responsibility if you implement any of these steps in a production environment.

10 Comments

  1. very nice tut. I m new and it was very helpful, hmm.. I have a query, how many members we can add in cluster? like instead of 2 I want to add another one 3rd. i’m stuck at designing it? specially in sync network. what would be the connection topology? and 4 member clust’ng also??
    Can you help me out?

    thank you!

    Reply

      • i figured it out.. Thanks for your reply btw. in High availability only one firewall will be active(100%) all as standby. in load sharing the load will be equally distributed. successfully ran Quad gateway cluster..
        Now i’m banging my head on remote access vpn frm last 2 days will you help me??

        Reply

  2. This tutorial very helpful to me. But I am in a real case. I have a 4610 Appliance run in Secure Platform OS 75.40. I ‘ve just bought one more appliance, and intend to do a ClusterXL mode sharing. I find out the new one run in GAIA OS 75.40…I ‘m very worry about how to do now, what extactly steps I have to passthrough. I must consider some big risks to my company… CheckPoint is Exterior Firewall, if it down or not working as normal…I may be fined. Could you give me some suggestions for this case???

    Thanks you very much 🙂

    Reply

    • Hi Cong i would first run an image backup within webui, export the image to FTP, scp, or FTP server, then upgrade your existing firewall to Gaia. Make sure you read all the upgrade notes to make sure your device is compatible. You will need to schedule an outage window with your company and perform the upgrade. Then you can setup clustering

      Reply

  3. hi!
    your blog is very informative.
    is it possible to make a cluster with one firewall having the management server too. as if one of the clusters is a stand alone setup and the other one is a normal gateway.

    Reply

    • You can create a cluster and add the host, which can contain gateway and management server. Or you can separate the roles and have one host as the gateway and the other as the management.

      Reply

    • Hi John, not exactly sure what you mean ? As with any gateway there will be a management component otherwise you won’t be able to configure the gateway, this can be a separate server or can be installed on a gateway

      Reply

  5. Hi, I’m having issues setting up clusters in R81.10, HA module not started. I disable, reboot and enable the cluster on cpconfig but still getting the same error.
    Any solution to my issues? Is there any tutorial similar to this for R81.10?

    Reply

Leave a Reply

Your email address will not be published.


*


CAPTCHA

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.