topic Re: ClusterXL inactive or machine is down in Firewall and Security Management

ClusterXL inactive or machine is down

fabiofabio — Tue, 06 Jul 2021 08:14:50 GMT

hi,

I have created a small environment in which to test gaia, I am still in the beginning, I have not learned much, yet.
this environment consists of two physical machines (open servers) with two gaia 80.40 installations as gateway and one virtual machine as management
I am stuck with a gateway cluster problem, in device status I only see "ClusterXL inactive or machine is down", I have read about it but I have not found anything that can help me.
can you help me out of this situation? I leave some screens so that my situation can be clearer.
(since it is a test environment I cannot reach the internet. it is a closed environment. I cannot ping the two gateways while the management does. despite not being able to ping them, I can reach the web interface without problems)
thank you very much

Re: ClusterXL inactive or machine is down

_Val_ — Tue, 06 Jul 2021 09:41:13 GMT

Did you push policy on them yet?

Re: ClusterXL inactive or machine is down

fabiofabio — Tue, 06 Jul 2021 09:49:13 GMT

it fail every time, looking at the details it says nothing in particular

Re: ClusterXL inactive or machine is down

_Val_ — Tue, 06 Jul 2021 09:55:45 GMT

What are the parameters of your GW VMs? RAM and HDD size? How many CPUs?

Re: ClusterXL inactive or machine is down

Cyber_Serge — Tue, 06 Jul 2021 12:24:47 GMT

If you use cli to bring up cluster member, what does it say?

Are the cable connected properly for the sync interface?

Re: ClusterXL inactive or machine is down

_Val_ — Tue, 06 Jul 2021 13:04:00 GMT

He will not be able to bring cluster up before policy is installed. He cannot install policy, let him figure out this part first :-), before anything else.

Re: ClusterXL inactive or machine is down

_Val_ — Tue, 06 Jul 2021 13:11:56 GMT

@fabiofabio One of the most common issues when playing on VMware is not setting enough HW power on your VMs. Look here and make sure your virtual machines have at least required minimum, as mentioned in the article: https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/Part-2-Preparing-the-Lab/ba-p/88055?cat=2

Re: ClusterXL inactive or machine is down

Timothy_Hall — Tue, 06 Jul 2021 13:30:09 GMT

From the policy installation failure screen, click the "V" symbol next to the first "Failed" to expand the actual failure error message, and post a screenshot of that. It is also possible that clustering has not been enabled from cpconfig on one or both of the cluster members, and as Val said the cluster state will report "problem" until policy is successfully installed.

Re: ClusterXL inactive or machine is down

fabiofabio — Wed, 07 Jul 2021 12:47:34 GMT

i have both fisical GW with 1 CPU Intel Xeon E5-2665 2.40GHz, 32 gb ram, 900 gb HDD and 2 network card. 1 is connected to the switch and the other is connected to the other gw for the HA.

the management WM have 2 cpu with 2 core per socket (4 core), 8 gb ram, 80 gb HDD and 1 network adapter.

Re: ClusterXL inactive or machine is down

fabiofabio — Wed, 07 Jul 2021 13:13:21 GMT

I have enabled both GWs for clustering while installing gaia but for safety I have now checked by cli and it is enabled.

thanks for the tip of the "V", I leave attached the screen, I have already tried to reinstall the SIC on both GWs, restarted the GWs and re-established the communication of the cluster members. what can i still do?

Re: ClusterXL inactive or machine is down

Timothy_Hall — Wed, 07 Jul 2021 13:24:10 GMT

You need to provision a third interface on both your gateways, connect them, and set it to be the cluster sync network.

Re: ClusterXL inactive or machine is down

fabiofabio — Wed, 07 Jul 2021 13:29:15 GMT

the GWs are already part of the cluster members.

thanks for the sync cable tip, it wasn't. now I have configured the IP on the network cards of both WGs from the web interface and then I have configured the interfaces from the cluster. I leave a screen attached because I'm not sure I have configured it well.

now every time I exit the cluster settings I get this screen that I leave attached and I do not understand what it is.

Re: ClusterXL inactive or machine is down

fabiofabio — Wed, 07 Jul 2021 13:37:34 GMT

I leave attached a screen with the network interfaces and configuration. was that what you meant?
I also leave the screen of a warning that appears to me every time I exit the cluster settings

Re: ClusterXL inactive or machine is down

Timothy_Hall — Wed, 07 Jul 2021 14:16:22 GMT

Read my prior post again. You need a third NIC interface provisioned in Gaia on both cluster members, then define that third interface as 1st Sync in the cluster topology.

Re: ClusterXL inactive or machine is down

fabiofabio — Thu, 08 Jul 2021 08:54:10 GMT

I did it but the same error remained, so I tried to disable the antispoofing and it allowed me to install the policies. at that point the cluster was ok but I can no longer reach the web interface of the gateways. if now I try to re-enable antispoofing it does not allow me to install the policies with the same error as before (asking to install a second cable for the cluster, although there are already one for the cluster and one for the sync)

Re: ClusterXL inactive or machine is down

_Val_ — Thu, 08 Jul 2021 09:14:47 GMT

Which points to the topology misconfiguration. Fix it, and all will work

Re: ClusterXL inactive or machine is down

fabiofabio — Thu, 08 Jul 2021 12:56:42 GMT

i looked for the solution but i can't get out of it for now. looking for the error i came across sk138132 but it didn't solve the problem and i didn't find anything else about it. any suggestions? 🙂

Re: ClusterXL inactive or machine is down

the_rock — Thu, 08 Jul 2021 13:20:53 GMT

Can you run below commands on both members from ssh and send us the output?

cphaprob state

cphaprob -a if

cphaprob list

cphaprob syncstat

Re: ClusterXL inactive or machine is down

_Val_ — Thu, 08 Jul 2021 13:21:04 GMT

In the topology page on the GW, make sure your interfaces and topology for those are correctly defined. External interface is one where default GW is set. The rest are internal. Make sure the first policy you apply is ANY-ANY-ANY-ACCEPT.

On your fw gws, to on ssh/console and run "fw unloadlocal". After you did, on MGMT check SIC is working. If it is, fetch interfaces with policy, then push policy as described above.

Best, look into Check Point for Beginners series, we discuss setting up GWs there in the Network security section. I have provided you the links already.

Re: ClusterXL inactive or machine is down

_Val_ — Thu, 08 Jul 2021 13:21:40 GMT

no need, @the_rock he is struggling to push policy.