topic cphaprob status showing down cause by routed in Firewall and Security Management

cphaprob status showing down cause by routed

Abeja_huhuhu — Tue, 01 Jan 2019 03:38:58 GMT

Hi Team, wishing you guys happy new year. i need some help. i have deployed checkpoint firewall HA using clusterXL . this firewall also having BGP routing configured. i can see that only one firewall will have BGP peer status establish. secondary firewall will have peer status as idle. cphaprob status as per below:

cphaprob state

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 192.168.8.196 0% DOWN amadelo01-new
2 (local) 192.168.8.197 100% ACTIVE amadelo02-new

on the the secondary node, we can see that the cluster is down due to routed pnote:

Active PNOTEs: ROUTED

Last member state change event:
   Event Code:                 CLUS-111700
   State change:               INIT -> DOWN
   Reason for state change:    ROUTED PNOTE
   Event time:                 Mon Dec 31 18:51:03 2018

Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     Reboot
   Event time:                 Mon Dec 31 18:47:01 2018

Cluster failover count:
Failover counter: 3
Time of counter reset: Mon Dec 31 18:51:03 2018 (reboot)

output of cphaprob list:

cphaprob list

Registered Devices:

Device Name: routed
Registration number: 2
Timeout: none
Current state: problem
Time since last report: 59996.3 sec

i have try reinstall policy to the firewall but still the status showing down. is there anything that we could use to force it to be Standby again instead of showing down.?

Re: cphaprob status showing down cause by routed

PhoneBoy — Tue, 01 Jan 2019 07:22:56 GMT

Did you check this SK?

Standby Cluster member in "Down" state with routed PNOTE in problematic state

Re: cphaprob status showing down cause by routed

Abeja_huhuhu — Fri, 04 Jan 2019 07:17:42 GMT

Hi Daemon,

thanks for the suggestion. i have check the SK and not much help on that. but i can confirm the issue happened due to the standby node does not get the default route from BGP. so most probably the route is not identical for both firewall node which causing the routed process state change to problem. However, i notice after leaving it running for a while the standby node starting to import the default route advertise by BGP peers even though the status of peers is idle. The only changes that i have made is to disabled cluster fold which allow each node to connect using its own ip instead of using cluster ip.

for me this can considered as working.

Re: cphaprob status showing down cause by routed

Alessandro_Marr — Fri, 04 Jan 2019 10:23:59 GMT

Is your bgp peer a router Cisco?

When peers send routes advertises can you see if any special parameters are been sending too?

DO you have a capability like a route-refresh on other side?

Re: cphaprob status showing down cause by routed

Abeja_huhuhu — Sat, 05 Jan 2019 03:41:07 GMT

Hi Alessandro,

yes, peer is using cisco. you may find below are the capabilities introduce to us.

State                         Established (Uptime: 02:33:22)
Peer Type                     eBGP Peer
Remote AS                     45352
Local AS                      2.7076 (138148)
Peer Capabilities             InetUnicast,RouteRefresh,CiscoRouteRefresh,4-Byte AS Extension
Our Capabilities              InetUnicast,RouteRefresh,4-Byte AS Extension
Authentication                None
Multihop                      Off
Reachability Detection        Off
Graceful Restart              Off
Keepalives
    Last Received             32s
    Last Sent                 24s
    Interval                  60s
    Holdtime                  180s
Received
    IPv4 Routes               1 (1 active)
    IPv6 Routes               0 (0 active)
Sent
    IPv4 Routes               3
    IPv6 Routes               0

the same capabilities introduce for IPv6 peers.

based on above, i believed it does have route-refresh capabilities.

i notice in the logs i can see it also sending us unrecognize capabilities. below are portion of the logs.

(proto) received unrecognized capability 70. Ignoring capability 70

Re: cphaprob status showing down cause by routed

Alessandro_Marr — Sat, 05 Jan 2019 17:48:55 GMT

you need disable on cisco this proprietary feature, ciscorouterefresh... when the gateway receive a route advertisement or any message of BGP with any proprietary feature it become instable.

in one of my routers I couldn´t because I could not update his IOS, if it is not possible, you could try using OSPF

Re: cphaprob status showing down cause by routed

Abeja_huhuhu — Thu, 10 Jan 2019 23:48:31 GMT

Thanks for your suggestion. we manage to get the upstream to disable the capabilities and now i can see the gateway is much more stable. so far no more firewall flapping cause by routed. i think this should be solved the issue.

Re: cphaprob status showing down cause by routed

Alessandro_Marr — Fri, 11 Jan 2019 13:05:39 GMT

thank you!!

Re: cphaprob status showing down cause by routed

zhangchuang — Wed, 07 Dec 2022 08:15:56 GMT

What features of Cisco are you turning off? I have a similar problem now.

Re: cphaprob status showing down cause by routed

DZ_KB — Sun, 12 Mar 2023 20:17:41 GMT

Hi @Alessandro_Marr , @PhoneBoy ,

Is there an SK that talks about this issue ?

Thx

Re: cphaprob status showing down cause by routed

Chris_Atkinson — Sun, 12 Mar 2023 22:21:42 GMT

Are you also seeing an error as listed in sk117598 or just a general pnote due to routed?

Is graceful restart configured/used to improve failover behavior?

Refer also:

https://community.checkpoint.com/t5/Management/BGP-Peering/td-p/15260

Re: cphaprob status showing down cause by routed

DZ_KB — Mon, 13 Mar 2023 10:34:48 GMT

yes graceful restart is configured.