Check Point R75 Cluster Setup

In this tutorial we will explore setting up a Check Point R75 Cluster consisting of 1 management server and 2 gateways.

Setting up a Check Point R75 Cluster

1. First up, connect to your management server with smartdashboard. My management status is called cpmgmt. Right click on the Check Point object on the right hand side and select Security Cluster – UTM-1/Power-1/Open Server Cluster/IP series…

2. Let’s select the Wizard Mode below.

3. Give your cluster a name. I will call mine CPCLUSTER and I will assign the cluster the ip address 10.10.10.1. You will see later where this is set. Select Check Point ClusterXL and select High Availability. Click Next.

4. We now add in the gateways that we would like to participate in our cluster. Click Add and select New Cluster Member. I’m select this option because I don’t have any gateways belonging to the management server yet. If you already have your gateways being managed by your management server you can select Add Existing Gateway.

5. Type in the IP address of your Check Point Gateway. The IP address of my first gateway called cpgw1 is 10.10.10.2 Type in the activation key that you setup during installation of your gateway and click initialize. You should see Trust Established in the Trust State field. Click Ok.

6. Do the same for gateway 2. My second gateway is called cpgw2 and has an ip address of 10.10.10.3. Click Ok.

7. The 2 gateways are now added. Click Next.

8. In this section we will configure the topology of the cluster. I have left out the external interface on purpose so I can show you how to add it manually later. Click Next.

9. The first network I’ll setup is the Cluster Synchronization. Select Primary under Clsuter Synchronization. Click Next.

10. The next interface i’ll setup is my internal network. Here i’ll set the cluster ip to 10.10.10.1 with a net mask of 255.255.255.0 Click Next.

11. The cluster is now setup. Click Finish.

12. As you can see on the right hand side, I have my cluster named CPCLUSTER with the 2 gateway members cpgw1 and cpgw2.

13. If you right click on the properties of the CPCLUSTER, you can see the ClusterXL settings that are available.

14. While still in the CPCLUSTER properties click on Topology.

15. Click Edit Topology. As you can see in this screen shot, I have already setup the internal network with the cluster ip 10.10.10.1 and i’ve also setup the Sync network.

16. Now I will add another NIC to my gateways which i’ll use for the external interface. After adding the NIC I will click on Get – All Members’ Interfaces with topology…

17. The third network is added in. However under the CPCLUSTER column I will need to add the cluster IP address for the external network. Here I will add 192.168.1.101 with a subnet mask of 255.255.255.0. I’ve also changed the name of the interface to Outside. I’ve also changed the name for the internal interface to inside. If you right click on the 192.168.1.101 address and select edit, you can set the topology to External. Click Ok.

18. Once your cluster is setup you must install the policy.

Disclaimer:
All the tutorials included on this site are performed in a lab environment to simulate a real world production scenario. As everything is done to provide the most accurate steps to date, we take no responsibility if you implement any of these steps in a production environment.

This tutorial very helpful to me. But I am in a real case. I have a 4610 Appliance run in Secure Platform OS 75.40. I ‘ve just bought one more appliance, and intend to do a ClusterXL mode sharing. I find out the new one run in GAIA OS 75.40…I ‘m very worry about how to do now, what extactly steps I have to passthrough. I must consider some big risks to my company… CheckPoint is Exterior Firewall, if it down or not working as normal…I may be fined. Could you give me some suggestions for this case???

Thanks you very much 🙂

David Rodriguez says:
June 13, 2013 at 05:24
Hi Cong i would first run an image backup within webui, export the image to FTP, scp, or FTP server, then upgrade your existing firewall to Gaia. Make sure you read all the upgrade notes to make sure your device is compatible. You will need to schedule an outage window with your company and perform the upgrade. Then you can setup clustering
Reply

Pradeep Kashyap says:
January 17, 2013 at 00:24
very nice tut. I m new and it was very helpful, hmm.. I have a query, how many members we can add in cluster? like instead of 2 I want to add another one 3rd. i’m stuck at designing it? specially in sync network. what would be the connection topology? and 4 member clust’ng also??
Can you help me out?
thank you!
- David Rodriguez says:
  January 17, 2013 at 21:25
  Hi Pradeep, it depends, are you wanting to create a High Availability Cluster or a Load Sharing Cluster ?
  - Pradeep Kashyap says:
    January 24, 2013 at 04:50
    i figured it out.. Thanks for your reply btw. in High availability only one firewall will be active(100%) all as standby. in load sharing the load will be equally distributed. successfully ran Quad gateway cluster..
    Now i’m banging my head on remote access vpn frm last 2 days will you help me??
Cong Tran says:
May 18, 2013 at 14:36
This tutorial very helpful to me. But I am in a real case. I have a 4610 Appliance run in Secure Platform OS 75.40. I ‘ve just bought one more appliance, and intend to do a ClusterXL mode sharing. I find out the new one run in GAIA OS 75.40…I ‘m very worry about how to do now, what extactly steps I have to passthrough. I must consider some big risks to my company… CheckPoint is Exterior Firewall, if it down or not working as normal…I may be fined. Could you give me some suggestions for this case???
Thanks you very much 🙂
- David Rodriguez says:
  June 13, 2013 at 05:24
  Hi Cong i would first run an image backup within webui, export the image to FTP, scp, or FTP server, then upgrade your existing firewall to Gaia. Make sure you read all the upgrade notes to make sure your device is compatible. You will need to schedule an outage window with your company and perform the upgrade. Then you can setup clustering
ray says:
November 11, 2013 at 23:05
hi!
your blog is very informative.
is it possible to make a cluster with one firewall having the management server too. as if one of the clusters is a stand alone setup and the other one is a normal gateway.
- David Rodriguez says:
  November 17, 2013 at 11:34
  You can create a cluster and add the host, which can contain gateway and management server. Or you can separate the roles and have one host as the gateway and the other as the management.
john says:
February 15, 2014 at 15:11
Hi, can we using clusterxl as stand alone/ not using management server? thanks
- David Rodriguez says:
  February 16, 2014 at 12:44
  Hi John, not exactly sure what you mean ? As with any gateway there will be a management component otherwise you won’t be able to configure the gateway, this can be a separate server or can be installed on a gateway
Anna says:
June 11, 2022 at 17:33
Hi, I’m having issues setting up clusters in R81.10, HA module not started. I disable, reboot and enable the cluster on cpconfig but still getting the same error.
Any solution to my issues? Is there any tutorial similar to this for R81.10?