CloudLabBox
Try the free demo

Check Point CCSE lab 1 of 10

ClusterXL high availability: build a two-gateway cluster

Turn two stand-alone gateways into a ClusterXL High Availability pair: prepare matching interfaces and a sync network, enable cluster membership, create the cluster object with virtual addresses, install a policy, read the result with cphaprob, and fail over with traffic running.

Run this lab

It needs Professional: its 6 nodes are set to 11 vCPU and 19,456 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 01 - ClusterXL high availability - build a two-gateway cluster

Run it on Professional from £7.50 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 11 vCPU and 19,456 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
11 vCPU, 19,456 MB
Smallest plan
Professional

The scenario

Northgate's head office has one gateway, so one failed box takes the whole office offline. The board has approved a second gateway. You will build a High Availability pair, so that the office keeps working when either member fails.

NetworkInterfaceVirtual addressGW1GW2
HQ-LAN 10.0.0.0/24eth010.0.0.10010.0.0.11110.0.0.112
Internet 67.83.0.0/24eth167.83.0.10067.83.0.11167.83.0.112
Sync 192.168.100.0/24eth2none192.168.100.1192.168.100.2

HQ-PC and ADMIN-PC use the virtual address 10.0.0.100 as their default gateway, and the provider routes HQ-LAN to the virtual address 67.83.0.100. Nothing points at a member's own address, and that is what makes a failover invisible to them.

What this course covers. The current CCSE course also has modules on Management High Availability, upgrades and migrations, and ElasticXL. Management High Availability needs a second licensed management server, and ElasticXL exists only on R82, so this course teaches clustering with ClusterXL on R81.20, and doesn't cover those modules.

Licences in this lab. Each image holds an evaluation licence bound to one address: SMS 10.0.0.110, GW1 10.0.0.111, GW2 67.83.0.112. Keep those addresses on a live interface. The images' clocks are held at the end of 2022 so the licences stay valid, so never configure NTP on them.

What you’ll practise

  • Plan a cluster: virtual addresses, member addresses and a sync network
  • Enable cluster membership on a gateway and explain why it needs a reboot
  • Create a ClusterXL HA cluster object in the management API
  • Read cphaprob state, cphaprob -a if and cphaprob syncstat
  • Trigger an administrative failover and prove traffic keeps flowing

The tasks

  1. Prepare the interfaces
  2. Enable cluster membership
  3. Create the cluster object
  4. Install and read the state
  5. Fail over with traffic running

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ClusterXL high availability - build a two-gateway cluster6 nodes and 3 networks, 10 links. Every link is listed as text below the diagram.SMSGW1GW2ISPHQ-PCADMIN-PCHQ-LANInternetSyncGi0/0eth0eth0eth2eth1eth0eth0eth2eth0eth1
6 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • GW1 eth0 to HQ-LAN (network)
  • GW2 eth0 to HQ-LAN (network)
  • GW1 eth1 to Internet (network)
  • GW2 eth1 to Internet (network)
  • GW1 eth2 to Sync (network)
  • GW2 eth2 to Sync (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
Nodes in ClusterXL high availability: build a two-gateway cluster, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
GW1Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
GW2Check Point Security Gateway (cpsg2 template)cpsg2-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 01 - ClusterXL high availability - build a two-gateway cluster and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.