Re: [FW1] FW-1 syncronization

[CryptoTech <cryptotech@FW1-NOSPAMgmx.de>]

It is enough to create the sync.conf and set keys between the boxes.  If you will be
doing VPN's, you will need to enable gateway clustering.

As to knowing which address to assign to the cluster, it would be
Nokia)- the VRRP Multicast IP for the external (internet side) interface.
Stonebeat)- the IP multicast address, or just the external ip of the firewalls (if
not using multicast)
CheckPoint) - the ip address of the external interface
Rainfinity)- one of your VIPs, or simply the external ip, depending on
configuration.

The essence of this decision is such:  The gateway cluster object must be a common,
always available ip address that any box in the cluster could respond to.  In
configuration where there may be multiple ip addresses on the external side, these
will have to appear in the firewall configuration somewhere.  The remote client must
know about the topology before establishing and IKE session so that if a client
initiates to the Multicast addr and one of the other ip's respond back (as long as
it is defined as part of the cluster,) the packet will not be dropped due to man in
the middle attack.


Cheers,
CryptoTech

Sommariva Graziano wrote:

> Question:
> Is it enoughth to edit the $FWCONFDIR/sync.conf and exchange keys to
> syncronize two or more Firewalls, or it is need to enable "Enable Gateway
> Cluster" and define a "cluster"?
>
> I ask this because I would not know which Ip address assign to the "cluster
> object", couse am making FW-load-balance using two content-switch placed on
> on both side of the firewalls.
>
> Graziano Sommariva
> *Phone:.
> *E-Mail: Graziano.Sommariva@elsag.it
>
> Network Manager
> TLC - Telecomunicazioni
> SSC - Service Unit Servizi Continuativi
> Elsag S.p.A.
>
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>               http://www.checkpoint.com/services/mailing.html
> ================================================================================



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================