NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [FW1] Cluster Gateway definition



  This configuration will not work. There is much more complexity involved
here than a regular VRRP config involving simple Layer 3 devices in which
they can back up each other. The first issue is, FireWall-1 has little
dealings with virtual interfaces. Secondly, there is so much dependence upon
IP addresses and IPSec SA's, objects database, etc... that a firewall module
will be limited to servicing only one virtual router. There are other
reasons but I think you get the idea.

-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Friday, June 08, 2001 9:09 AM
To: [email protected];
[email protected]
Subject: RE: [FW1] Cluster Gateway definition


Thank you, but I need more, can't find anything in the notes, take this
VRRPmc
example.

Each fw has 6 virtual ip's which means creating 6 Gateway Clusters, each
interface has two virtual IP for load sharing.  How does one make the
firewall
a member of all these 6 clusters(imposible). In theory this design is sound,
I
just can't get it right on the rulebase, how do I create these gw clusters.
The fwclean is connected to the Internal network. fwnet connects to the
internet and fwdmz is connected to the DMZ.




	|fwnet						|fwnet2
______________				______|________
|		|  fwclean1		fwclean2|		|
|		|----- ---			_______|		|
|		|				|		|
|_____________|				|____________ |
	|fwdmz1						|fwdmz2
	|						|

fwnet1						fwnet2
ip 10.0.0.1 (real IP)				ip 10.0.0.2
	vr1 10.0.0.3	priority=50			vr1 10.0.0.4 p=50
	vr2 10.0.0.4	priority=40			vr2 10.0.0.3 p=40
fwclean1					fwclean1
 ip  192.168.0.1					ip  192.168.0.2
	vr3  192.168.0.3  priority=50			vr4  192.168.0.4 p=50
	vr4   192.168.0.4 priority=40			vr3  192.168.0.3 p=40
fwdmz1						fwdmz1
ip  172.134.0.1					ip  172.134.0.2
	vr5  172.134.0.3  priority=50			vr6  172.134.0.4  p=50
	vr6  172.134.0.4  priority=40			vr5  172.134.0.3  p=40


Should I Create the Cluster Gateways (CGr1, CGr2....CGr6) objects as a
workstation using the six virtual IP’s (vr1,vr2...vr6) for each
firewall. ??
or Instead of creating (CGr1….CGr6) as above, should I just create
(CGr1  &
CGr2) and defined with all the virtual IP addresses of both firewalls.

in this example the second option of defining CGr1, CGr2....CGr6 means I
have
to install on six cluster gateways, is this the way?

in this design the devices can use any of the two virtual IP as their
default
gateway.




--
Get your firstname@lastname email for FREE at http://Nameplanet.com/?su



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.