9500 Stackwise Virtual with a pair of Checkpoint Firewall in Active/Standby mode

[latenaite2011]

Does anyone know if can connect to Checkpoint Firewall in active/standby mode using two different port-channel groups to (each port-channel to a different 9500) to a pair of 9500 configured with SWV?

When running on the primary Checkpoint, there are some performance issues and when failing to the standby, it works fine. The topology is provided here. 

 

[balaji.bandi]

Cat 9500 StackWise virtual means (Physically 2, but logically 1)

So you will not get high availability based on the diagram

instead, i suggest making a dual-homed connection will be good from the design point of view.

CP Primary - 2 Link to to SWITCH1

CP Primary - 2 Link to to SWITCH2

CP Secondary  - 2 Link to to SWITCH1

CP Secondary  - 2 Link to SWITCH2

This will give high resilience in terms of connectivity and failure of Stachwise virtual.

If they are all in 1 Location, Make sure your SYNC Link dedicated between CP Primary to CP Seconday.

[latenaite2011]

Thanks Balaji, why not? the CP firewall is in active standby mode.

If the primary switch should fail, the it will fail to the standby switch
and at that point, the standby firewall may take over because the primary
firewall will detect some issues and failover.

[balaji.bandi]

Sure that also consider as a Failure case - i agree with you,  since we dont know rest of the network, in general practice we do dual home for suggested design, some case we consider.

is your cp cluster xl ? secure xl ? core xl ? design also refer them your vss / svl.