topic Re: Checkpoint identity collector pxgrid integration and HA in Network Access Control

Checkpoint identity collector pxgrid integration and HA

jerkessl — Sat, 09 Mar 2019 03:13:49 GMT

Hi,

I am looking for building an HA solution for Checkpoint identity collector and I was thinking of configuring:

Two Checkpoint identity collectors with each having two pxgrid nodes, so 4 PXGs but it is only supported on v2 pxGrid.

Do someone know if Checkpoint identity collector is v1 or v2 ? If v1 only, will it work in active standby if we use 4 PXG nodes?

Regards,

Re: Checkpoint identity collector pxgrid integration and HA

Jason Kunst — Sat, 23 Feb 2019 19:01:40 GMT

I have forwarded this to our SME

Re: Checkpoint identity collector pxgrid integration and HA

Damien Miller — Sat, 23 Feb 2019 23:42:47 GMT

I'm replying here because I'm also curious about this. I scoured the checkpoint docs and they make no reference to the pxgrid version the feature leverages.

For your design though, is there a reason you need 4 pxgrid nodes? Wouldn't two pxgrid nodes accomplish the same task of HA.

Re: Checkpoint identity collector pxgrid integration and HA

jeppich — Sun, 24 Feb 2019 23:47:40 GMT

Hi,

Checkpoint was developed using pxGrid 1.0. You can only have 2 pxGrid nodes in an Active/Standby scenario per ISE deployment.

Thanks,

John

jeppich@cisco.com

Re: Checkpoint identity collector pxgrid integration and HA

jerkessl — Mon, 25 Feb 2019 13:48:49 GMT

purpose was to have 2 CP identity collector and two pxgrid nodes by CP identity collector

but as John said not supported on v1

Re: Checkpoint identity collector pxgrid integration and HA

jerkessl — Mon, 25 Feb 2019 13:50:20 GMT

so the two extra PXGs active nodes are only v2 ?

Re: Checkpoint identity collector pxgrid integration and HA

jeppich — Mon, 25 Feb 2019 14:56:06 GMT

Hi,

Yes, Active/Active is only supported in pxGrid ver 2.0.

Thanks,

John

jeppich@cisco.com