I spoke with a Checkpoint support engineer this afternoon and they told me that to just do HA (not load sharing) that no additional licenses were needed. I currently have the VPN-1 Pro license: VPN-1 Module for an unlimited number of IP addresses CPVP-VFM-U-NG
...and he said that's all I need to do HA. Just enable with cpconfig and then create the cluster objects, etc. I would love to upgrade to IPSO 3.8 and R55 to get VRRP to monitor the fwd process. How nice is that?? Something to work on. Thanks everyone for your responses! -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Will Zegeer Sent: Wednesday, December 08, 2004 3:36 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] FW: [FW-1] High Availability and Nokia IPSO Clustering Yes, Sorry my mistake...They have now lumped the HA license with the second module license, which probably means he is going to have to upgrade or change his second module license (probably at no extra cost). I believe this change must have been made when the CP express licenses were introduced. -Will > -----Original Message----- > From: Gary Scott [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 08, 2004 10:49 AM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] FW: [FW-1] High Availability and Nokia IPSO > Clustering > > Incorrect, Checkpoint has changed this so you do not need a license to > do clusterxl HA but you do if running clusterxl load sharing. > > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED] On Behalf Of Will > Zegeer > Sent: Wednesday, December 08, 2004 9:37 AM > To: [EMAIL PROTECTED] > Subject: [FW-1] FW: [FW-1] High Availability and Nokia IPSO Clustering > > Yes, You need an additional license for either load sharing or HA for > Cluster XL. Cluster XL is enabled for Nokia as well but you don't need > a license for it. With Nokia, Cluster XL is enabled for State Sync > only. > > -Will > > -----Original Message----- > From: Stachowicz,Mark [mailto:[EMAIL PROTECTED] > Sent: Tue 12/7/2004 10:15 AM > To: [EMAIL PROTECTED] > Cc: > Subject: Re: [FW-1] High Availability and Nokia IPSO > Clustering > > > > If I didn't want to do load sharing, only automatic failover, > would I > still need ClusterXL? I currently have VPN-1 Pro gateway > licenses on my > Nokias, I assume that for auto failover capabilities I would > need to > replace those licenses with the "Additional VPN-1 Pro Gateways > for Load > Sharing and High Availability" licenses? Or are these > licenses an > add-on to the VPN-1 Pro license I have now? > > I've tried turning on HA with my current licenses and it does > activate, > however if I attempt to check status, it returns an error > saying the HA > module is not installed. This is why I think I need the > license for > HA. > > Thanks! > > -ms > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED] > On Behalf Of Will > Zegeer > Sent: Tuesday, December 07, 2004 8:05 AM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] High Availability and Nokia IPSO > Clustering > > CP Cluster XL licenses - either HA or Loadsharing. > When NG first came > out (and in the 4.1/4.0 days), it was very cumbersome and > didn't work > well. But now, Post R54 releases work very well and it's very > easy to > set up. I suggest Secureplatform with cluster xl and read the > cluster xl > pdf. > > -Will > > -----Original Message----- > From: Stachowicz,Mark > [mailto:[EMAIL PROTECTED] > Sent: Mon 12/6/2004 11:25 PM > To: [EMAIL PROTECTED] > Cc: > Subject: [FW-1] High Availability and Nokia IPSO > Clustering > > > > I have two Nokia 710 gateways running IPSO > 3.7 and Checkpoint > NG-AI R54 > (FW-1/VPN-1 Pro). I also have a Solaris 2.8 > management > station > that > manages both firewalls. > > I only have Nokia VRRP running now to failover the > firewalls in > the > event of a failure, however this will only work in > the event of > a > hardware failure. This does not help if the master > firewall > software > stops working or the policy fails. > > What are my options for high availability with my > Checkpoint > firewalls > to ensure that I always have a failover? > > Can you also provide licenses that I would need to > purchase? > > Thanks very much in advance.. > > -mark stachowicz > > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > <https://65.242.83.79/http/0/www.checkpoint.com/services/mailing.html> > > <https://65.242.83.79/http/0/www.checkpoint.com/services/mailing.html> > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > <https://65.242.83.79/http/0/www.checkpoint.com/services/mailing.html> > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > > > ================================================= > To set vacation, Out-Of-Office, or away messages, send an email to > [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your subscription options, > email [EMAIL PROTECTED] > ================================================= > > ================================================= > To set vacation, Out-Of-Office, or away messages, send an email to > [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your subscription options, > email [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
