topic Re: fwkern.conf is missing on device standby in Firewall and Security Management

fwkern.conf is missing on device standby

rochim — Tue, 12 Jan 2021 12:23:53 GMT

Hi All,

i have HA Checkpoint 16000 using VSX mode. i found this difference file fwkern.conf is exist on active device but not on standby device. this is mandatory by design or not?

any some one else same this issue?

[Expert@Active_Device-03:0]# cat /opt/CPsuite-R80.30/fw1/boot/modules/fwkern.conf

fwha_enable_state_machine_by_vs=0

[Expert@Active_Device-03:0]#

[Expert@Standby_Device-03:0]# less /opt/CPsuite-R80.30/fw1/boot/modules/fwkern.conf

/opt/CPsuite-R80.30/fw1/boot/modules/fwkern.conf: No such file or directory

thanks.

Re: fwkern.conf is missing on device standby

Vincent_Bacher — Tue, 12 Jan 2021 14:03:35 GMT

This file is created/modified manually. This does not exist after clean-installation. All kernel values have to be set on both nodes.
So just create it on second node and add the same values as already given in node 1

Re: fwkern.conf is missing on device standby

G_W_Albrecht — Tue, 12 Jan 2021 14:07:21 GMT

According to sk26202, fwkern.conf does not exist - it has to be created manually if used. Kernel parameter fwha_enable_state_machine_by_vs can not be found in any documentation / sk, so i assume you would need CP to know why it was used here at all, and only on one cluster node...

Re: fwkern.conf is missing on device standby

firewall1-gx — Tue, 12 Jan 2021 14:07:51 GMT

Rochim,

Fwkern.conf is a file created manually. In your case, just create the file on missing cluster member.

More details you can see on: Changing the kernel global parameters for Check Point Security Gateway

Regards,

Alisson Lima

Re: fwkern.conf is missing on device standby

Alex- — Tue, 12 Jan 2021 14:22:49 GMT

Could it be something linked to the 16K series though? I operate some in VSX (R80.40) and fwkern.conf exists with fwha_enable_state_machine_by_vs set to 1.

Edit: might be a Kernel 3.10 or something linked to some HFA thing. I checked another cluster of high-end VSX appliances running up-to-date R80.30 and the file is also there with the value set to 1.

Re: fwkern.conf is missing on device standby

rochim — Tue, 12 Jan 2021 14:34:20 GMT

thanks for your reply.

do you know function fwkern.conf? any document explain it?

Re: fwkern.conf is missing on device standby

rochim — Tue, 12 Jan 2021 14:36:42 GMT

hi,

the file existing on both device? i only missing on standby device.

Re: fwkern.conf is missing on device standby

rochim — Tue, 12 Jan 2021 14:38:02 GMT

thanks for your reply, i want to know what function fwker and what means attribute "fwha_enable_state_machine_by_vs=0"

Re: fwkern.conf is missing on device standby

Vincent_Bacher — Tue, 12 Jan 2021 14:43:40 GMT

When kernel values to be set, file has to exist on both nodes to be effective as well when failover node gets active.

Re: fwkern.conf is missing on device standby

Vincent_Bacher — Tue, 12 Jan 2021 14:46:21 GMT

@Alex- Just had a look on a 23k device on our side running R80.10 and this value is present here as well. Don't have the function of this value in mind as well.

Re: fwkern.conf is missing on device standby

G_W_Albrecht — Tue, 12 Jan 2021 15:57:17 GMT

I would assume this to be about machine state - active or standby - being different per VS, a feature that sounds more like VSLS, not HA VSX...

Re: fwkern.conf is missing on device standby

Vincent_Bacher — Tue, 12 Jan 2021 16:00:30 GMT

Yes, agree. The key message was just to have it not just on one side 🙂

Re: fwkern.conf is missing on device standby

Václav_Brožík — Wed, 19 Jan 2022 09:36:59 GMT

@firewall1-gx wrote:
...Fwkern.conf is a file created manually...

That is not completely true. To my knowledge the file could be created by cpconfig.

fwha_enable_state_machine_by_vs indicates if VSLS is enabled or not which is a property controllable by cpconfig.