topic Re: sync interfaces going up and down (partially up) in Firewall and Security Management

sync interfaces going up and down (partially up)

fabiofabio — Wed, 15 Dec 2021 14:03:15 GMT

Hello,
this morning I replaced one of the two nodes in HA, the new one was configured and tested in a test environment and in fact now it has no problems. the problem occurs in the two interfaces (ETH4 and 5) that deal with the sync. these keep going up and down

from the smart console are partially up

ETH4 is set as secondary in sync while ETH5 is primary.
node 1 (the old one) restarted by itself when I attacked node 2 (new) and node 1 was not restarting for a year. at this moment node 1 is running and has no problems, but due to the problems on the interfaces there is no node 2 among the members of the HA

I read that I should broadcast the network cards to solve the problem but I don't want to, as it has worked so far. the problem shouldn't be here.

any suggestion?

thanks

Re: sync interfaces going up and down (partially up)

the_rock — Wed, 15 Dec 2021 15:25:04 GMT

I cant say this 100%, but I believe it was never recommended to use 2 sync interfaces. Regardless, you can try below steps. I always use to do this when someone had issues with sync in the cluster.

Andy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk37030&partition=Advanced&product=ClusterXL%22

Re: sync interfaces going up and down (partially up)

Chris_Atkinson — Wed, 15 Dec 2021 15:31:41 GMT

Which GW version is this?

Note the use of more than one dedicated physical interface for synchronization redundancy is not supported. You can use Bonding for synchronization interface redundancy.

Re: sync interfaces going up and down (partially up)

the_rock — Wed, 15 Dec 2021 15:34:58 GMT

Also, to add what @Chris_Atkinson said, I dont know if it says anywhere its not officially supported, but either way, all I can tell you from my experience is that I had customers run it and it does work, BUT, when it breaks, tough fixing it...its NOT an easy task, thats for sure.

Re: sync interfaces going up and down (partially up)

Timothy_Hall — Wed, 15 Dec 2021 16:17:49 GMT

Backing up what Chris said here, I even mentioned in my book that adding a second physical interface as a 2nd sync is not a good idea and to use a bond instead:

If you elect to add a second sync network, bond the original physical interface with
another physical interface via the Gaia web interface (or clish) and declare the new
bonded aggregate interface as “1 st Sync” in the cluster object topology settings. DO
NOT simply add a new non-bonded interface and declare it as “2nd sync” in the cluster
topology, as this setup will severely degrade cluster performance. Check
netstat -ni statistics as well for the physical sync interfaces to ensure zero values
for RX-ERR and RX-OVR.

Re: sync interfaces going up and down (partially up)

the_rock — Wed, 15 Dec 2021 16:24:38 GMT

I think I will buy your book @Timothy_Hall , one of my colleagues said he got it on Amazon and loved it :- ). Any discount code for checkmates peeps? haha

Re: sync interfaces going up and down (partially up)

Timothy_Hall — Wed, 15 Dec 2021 19:44:32 GMT

Unfortunately I have no ability to create discount codes at Amazon for the hardcopy edition.

However discount codes for the PDF edition and the self-guided video series offerings do tend to pop up during CPX season every year so stay tuned.

Re: sync interfaces going up and down (partially up)

the_rock — Wed, 15 Dec 2021 20:30:54 GMT

Just bought it on amazon, pays to be prime member : )

Re: sync interfaces going up and down (partially up)

fabiofabio — Thu, 16 Dec 2021 12:07:33 GMT

this configuration works since 2014, I have no idea at this point how they made it work, however, can this modification to create the bonding be done hot? taking into account that I only have a functioning node and that I can no longer afford down periods.

Re: sync interfaces going up and down (partially up)

the_rock — Thu, 16 Dec 2021 12:20:06 GMT

You can do sync debug from the link I sent, hope that helps, as it should give you a clue why its failing.

Re: sync interfaces going up and down (partially up)

Chris_Atkinson — Fri, 17 Dec 2021 01:10:59 GMT

For reference it's explained in the Cluster XL admin guide here:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ClusterXL_AdminGuide/Topics-CXLG/Synchronized-Cluster-Restrictions.htm

Re: sync interfaces going up and down (partially up)

the_rock — Fri, 17 Dec 2021 02:44:13 GMT

Thank you for that.

Re: sync interfaces going up and down (partially up)

PhoneBoy — Fri, 17 Dec 2021 07:51:46 GMT

The top of this SK suggests you should, except in a few unique cases, only use bonded sync interfaces if you want redundancy.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk66761&partition=Basic&product=Identity

Re: sync interfaces going up and down (partially up)

Chris_Atkinson — Fri, 17 Dec 2021 08:01:14 GMT

sk92804: Sync Redundancy in ClusterXL