Check Point UTM-1 Edge User Manual page 259

Note: To use a WAN virtual IP address, the Internet connection method must be
"Static IP". PPP-based connections and dynamic IP connections are not supported.
Before configuring HA, the following requirements must be met:
•
You must have at least two identical UTM-1 appliances.
•
The appliances must have identical firmware versions and firewall rules.
•
The appliances' internal networks and bridges must be the same.
•
The appliances must have different real internal IP addresses, but share the same
virtual IP address.
•
The appliances' synchronization interface ports must be connected either
directly, or via a hub or a switch. For example, if the DMZ is the
synchronization interface, then the DMZ/WAN2 ports on the appliances must be
connected to each other.
The synchronization interface need not be dedicated for synchronization only. It may
be shared with an active internal network or bridge.
You can configure HA for the WAN interface, for any bridge, and for any internal network
except wireless networks and the OfficeMode network.
Note: You can enable the DHCP server in all UTM-1 appliances. A Passive
Gateway's DHCP server will start answering DHCP requests only if the Active
Gateway fails.
Note: If you configure HA for the primary WLAN network:
•
A passive appliance's wireless transmitter will be disabled until the
gateway becomes active.
•
The two primary WLAN networks can share the same SSID and
wireless frequency.
•
Wireless interfaces cannot serve as the synchronization interface.
Chapter 8: Configuring High Availability
Overview
245