VRRP on NOKIA (CheckPoint)

[Guest]

Archived from groups: comp.security.firewalls (More info?)

Hello,

Let's take an example.

On the Main firewall,

eth1c0 is 195.238.10.1/24 (external)
eth2c0 is 195.238.20.1/24 (internal)
eth3c0 is 10.10.10.1/30,

-> VRRP external 195.238.10.3
-> VRRP internal 195.238.20.3

On the other HA machine,

eth1c0 is 195.238.10.2/24 (external)
eth2c0 is 195.238.20.2/24 (internal)
eth3c0 is 10.10.10.2/30,

-> VRRP external 195.238.10.3
-> VRRP internal 195.238.20.3

eth3c0's are directly interconnected through a cross-over cable.

For the VRRP setup, do I have to take into account eth3c0's???

Can anybody copy/paste here the output of ifconfig -a on a cluster
that has been setup like what I need? As a reference.

Many thanks,

Alabama

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

magneto@no-log.org (Alabama Circus) wrote in message news:<f7a1ce09.0406190703.21a6ded3@posting.google.com>...
> Hello,
>
> Let's take an example.
>
> On the Main firewall,
>
> eth1c0 is 195.238.10.1/24 (external)
> eth2c0 is 195.238.20.1/24 (internal)
> eth3c0 is 10.10.10.1/30,
>
> -> VRRP external 195.238.10.3
> -> VRRP internal 195.238.20.3
>
> On the other HA machine,
>
> eth1c0 is 195.238.10.2/24 (external)
> eth2c0 is 195.238.20.2/24 (internal)
> eth3c0 is 10.10.10.2/30,
>
> -> VRRP external 195.238.10.3
> -> VRRP internal 195.238.20.3
>
> eth3c0's are directly interconnected through a cross-over cable.
>
> For the VRRP setup, do I have to take into account eth3c0's???
>
> Can anybody copy/paste here the output of ifconfig -a on a cluster
> that has been setup like what I need? As a reference.
>
> Many thanks,
>
> Alabama


No, you dont have to setup VRRP for the /30. I presume you are using
(or are going to use) VRRP Monitored Circuits. In which case, on the
Primary FW Configure the two data networks to monitor each other. In
the event of a failure of either segment, the Primary FW would
failover to the Secondary (as the monitored network configuration
would decrement the Priority value by the Delta value - which would
now be lower than the value for the same VRID on the Secondary FW).
Once the Primary network is back up, it will preempt (to use a cisco
hsrp term) the Secondary Firewall and become Master again (as its
Priority value will once again be greater).

SysAdm

SysAdm