RE: [FW1] High Availability module

["Mark Decker" <mdecker@FW1-NOSPAMrainfinity.com>]

Rodney,

1) Yes.
2) In most cases, yes.
3) No. You may be able to do this with a "cold-standby", where the 2nd
firewall is normally powered down and only substituted (manually) for
the primary in the event of a failure, but not with "hot" HA.
4) Not exactly.  CP's HA module uses a shared MAC/IP address for both
machines, similar to the original StoneBeat HA product.
5) No comment due to conflict of interest. ;-)

Suggest you verify all this with your friendly neighborhood Check Point
sales rep.

Hope this helps,

Mark L. Decker
Rainfinity
mdecker@rainfinity.com
www.rainfinity.com> -----Original Message-----
> From: Rodney Lacroix

> In reviewing failover, and looking at the HA module from
> CheckPoint, I have the following questions:
>
> 1) Do you need to purchase another CheckPoint FW1-VPN1
> license for the failover firewall server?
> 2) Do you need to purchase licensing for ALL of the
> additional modules on the failover server (LDAP, SecuRemote, etc.)?
>
> or
>
> 3) Can you simply transfer the licenses from the existing
> firewall to the failover?
> 4) I assume that the public IP's need to be identical (as
> well as the internal, DMZ, etc. interfaces), correct?
> 5) Does it work?  How well?



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================