PROBLEM
The following error message occurs when pushing firewall policy to clusters.
There is only one interface defined for object . At least one more interface must be configured for this object in order to use the Anti-Spoofing feature.
The Gateway Cluster Properties is as follows:
Thanks to David Rodriguez who has created Check Point R75 Cluster Setup tutorial here.
http://www.sysadmintutorials.com/tutorials/check-point/check-point-r75-cluster-setup/
Even though my lab in VirtualBox is based on Check Point R65, it shouldn’t be any problem since most of the setup in Check Point series is quite similar.
I’ve followed his tutorial step by step. However, I was experiencing the following issues;
Issue 1: There is a discrepancy in R65 & 75 cluster menu (should not be a big issue)
R60/R65 Check Point Menu
R75 Check Point Menu
Problem 2: Can’t change the topology to External (Not sure if Topology name is important for CPHA)
R75 Edit Topology
R65 Edit Topology
Problem 3: “Installation failed. Reason: Load on Module failed – no memory” during installation (Problem since I can’t push the policy)
Connection cannot be established.
Client and Server versions are incompatible.
Server version: NGX R65
SmartConsole Client version: R70.30
SIMILAR ISSUE
https://www.cpug.org/forums/smartdashboard/12843-r65-smart-dashboard-under-windows-7-a.html
Error Message
Policy Verification and Installation Errors
Installation failed. Reason: Load on Module failed – no memory
SIMILAR ISSUE
https://www.cpug.org/forums/smartdashboard/500-load-module-failed-failed-load-security-policy.html
Basically, there are two main options in configuring Check Point Cluster.
In order to configure Check Point with High Availability (HA) solution, we need to have two identical Check Point machine. Since everything is created in VirtualBox, creating another identical machine is so easy. Just right click on the machine that you wish to copy, and click Clone. You can also use the combination of Ctrl+O to clone it.
Now you already have two identical Check Point machine. Everything is copied exactly as a parent machine including IP Address. Therefore, the first thing you need to do is to change IP Address as it will cause IP conflict issue if both of them are located in the same network. Use sysconfig menu to change IP Address of the Check Point box. Please refer to the link below how to do it.
UPDATE – APRIL 20, 2012 How to change IP Address in Check Point firewall
Once everything is ready, follow the following steps in configuring Check Point Cluster with High Availability solution:
STATUS – April 18, 2012
Currently, I’m still reading the User Guide in figuring out what to do next. :).
I also discussed this matter in CPUG forum to get help from Check Point expert there.
I’ll update this post once I’ve knew what to do in completing HA setup in Check Point cluster
SIMILAR ISSUE
https://www.cpug.org/forums/installing-upgrading/938-clusterxl-win2003-splat.html
I’m new to Check Point firewall and have been searching around to find any guide on internet how to configure Check Point in High Availability Mode but couldn’t find any. Therefore, I would appreciate if you could share any manual/guide about it.
Currently, I’ve been able to configure single firewall as drawn in diagram below.
And now I’m looking forward how to configure it in cluster mode below.
Any help would be highly appreciated. Thanks
SUPPORT
UPDATE – April 18, 2012
A senior member from CPUG, northlandboy has responded to my question above regarding SPLAT R60 High Availability Configuration. He informed that I should read 228 pages of NGX R65 ClusterXL Administration Guide document. Currently I’m still in reading mode in page 34, out of 228 pages. There is lot more to go before I’m able to configure HA correctly in R60.
UPDATE – May 6, 2012
There were a few mistakes on the network diagram above.
Therefore, the correct network diagram should look like below.
I’ve just installed and configured Microsoft ISA 2006 server in Windows Server 2003 in VirtualBox. The topology is as follow:
Installation of Windows Server 2003 and ISA Server 2006 are quite straight forward. If you have experience installing any Microsoft Operating system and know how to install software, you should not experience any issue here.
I’ve found a number of very good tutorial below even for beginner as screenshot is provided with explanation.
ISA Server 2006: Installing ISA 2006 Enterprise Edition (beta) in a Unihomed Workgroup Configuration
http://www.isaserver.org/tutorials/ISA-Server-2006-Installing-ISA-2006-Enterprise-Edition-beta-Unihomed-Workgroup-Configuration.htmlISA Firewall Quick Tip : Installing ISA Server 2006 Remotely
http://www.elmajdal.net/isaserver/installing_isa_server_2006_remotely.aspxStep by Step Guide Installing ISA 2006 Enterprise Edition Part 4
http://www.ahmedgroup.co.uk/articles/17/1/Step-by-Step-Guide-Installing-ISA-2006-Enterprise-Edition-Part-4/Page1.htmlGetting started with Microsoft ISA Server 2006, Part I: Installation
http://www.linglom.com/2007/12/28/getting-started-with-microsoft-isa-server-2006-part-i-installation/ISA Server 2006 Standard Edition Installation Guide
http://technet.microsoft.com/en-us/library/bb794856.aspx
Once the installation completed, I’ve performed ping test to both interfaces in ISA Server to make sure the client can communicate well with Windows Server 2003.
However, I was unable to ping them once ISA installation has completed. This is because ISA will block all ICMP traffic by default.
How to enable ping in ISA Server 2006?
I’ve found a good tutorial here written by Tarek Majdalani. It’s easy to understand with screenshot as well. Thanks Tarek 🙂
PROBLEM
Currently I’m able to ping from Client to internal interface of the ISA, but still having a problem to ping to the external.
I’ve just tested MicroOLAP TCPDUMP for Windows® 3.9.8 and found it’s almost identical to tcpdump in Linux/UNIX. The only problem I have now is how to identify which network card is belong to which one?
In my case, I’ve 3 networks similar in the screenshot below if I run “tcpdump –D” command. Therefore, I have no choice but to run “tcpdump –i 2” & “tcpdump –i 3”, and then ping to the each IP Address.
A Firewall Engineer 