# R82 ClusterXL Administration Guide

# Introduction to ClusterXL

## The Need for Clusters

Security Gateways and VPN connections are business critical devices. The [failure](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) of a [Security Gateway](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) or VPN connection can result in the loss of [active](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) connections and access to critical data. The Security Gateway between the organization and the world must remain open under all circumstances.

## ClusterXL Solution

[ClusterXL](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) is a Check Point software-based [cluster](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) solution for Security Gateway redundancy and [Load Sharing](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#). A ClusterXL Security Cluster contains identical Check Point Security Gateways.

- A [High Availability](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) Security Cluster ensures Security Gateway and VPN connection redundancy by providing transparent [failover](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) to a [backup](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) Security Gateway in the event of failure.

- A Load Sharing Security Cluster provides reliability and also increases performance, as all members are active.

| Item | Description |
| --- | --- |
| 1 | Internal network |
| 2 | Switch for internal network |
| 3 | Security Gateways with ClusterXL |
| 4 | Switch for external networks |
| 5 | Internet |

## How ClusterXL Works

ClusterXL uses _State Synchronization_ to keep active connections alive and prevent data loss when a [Cluster Member](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) fails. With [State Synchronization](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#), each Cluster Member "knows" about connections that go through other Cluster Members.

ClusterXL uses virtual IP addresses for the cluster itself and unique physical IP and MAC addresses for the Cluster Members. Virtual IP addresses do not belong to physical interfaces.

|     |     |
| --- | --- |
|  | Note - This guide contains information only for Security Gateway clusters. For additional information about the use of ClusterXL with [VSX](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#), see the [R82 VSX Administration Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_VSX_AdminGuide/Default.htm). |

## The Cluster Control Protocol

The [Cluster Control Protocol](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) (CCP) packets are the glue that links together the members in the Security Cluster. CCP runs on UDP port 8116 between the Cluster Members, and has the following roles:

- It allows Cluster Members to report their own states and learn about the states of other members by sending keep-alive packets.

- State Synchronization ( [Delta Sync](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#)).

The Check Point CCP is used by all ClusterXL modes.

|     |     |
| --- | --- |
|  | Important - There is no need to add an explicit [rule](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) to the [Security Policy](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Introduction-to-ClusterXL.htm#) that accepts CCP packets. |

For more information, see [Configuring the Cluster Control Protocol (CCP) Settings](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_ClusterXL_AdminGuide/Content/Topics-CXLG/Configuring-CCP-Settings.htm).