topic Re: Failover root-cause detection in ClusterXL HA in Firewall and Security Management

Failover root-cause detection in ClusterXL HA

Matlu — Tue, 10 Oct 2023 00:07:18 GMT

Hello everyone.

Today our ClusterXL HA, had a FAILOVER from "one moment to another", without any intervention from the administrators.

We would like to detect if the root-cause of this FAILOVER is the responsibility of the GW (I would say no).

I have reviewed the following, and I would like to know the opinion of people more experienced with these diagnoses.

I get the impression that at the time of the FAILOVER, there was an error with the VLAN that was being monitored, but possibly the root-cause is in a different equipment than the GW Check Point.

Cheers . 🙂

Re: Failover root-cause detection in ClusterXL HA

the_rock — Tue, 10 Oct 2023 00:43:19 GMT

Bro, as I stated in my email, best is to review routed.log and messages file, but based on what you show, it apears issue was with interface bond12.62

Is customer using ospf/bgp? MAKE SURE below value is set to 0 and not 1

fw ctl get int fwha_monitor_all_vlan

Andy

Re: Failover root-cause detection in ClusterXL HA

Matlu — Tue, 10 Oct 2023 00:48:25 GMT

Hey,

I'm not sure yet, if you use "dynamic routing".

The command you share with me, shows me the following.

[Expert@SG1:0]# fw ctl get int fwha_monitor_all_vlan
fwha_monitor_all_vlan = 0
[Expert@SG1:0]#

Cheers. 🙂

Re: Failover root-cause detection in ClusterXL HA

the_rock — Tue, 10 Oct 2023 00:54:20 GMT

I do use it lol, but you should check if customer does hehe.

Anyway, you can verify via web UI, ospf and bgp tabs or from clish, just run show ospf and show bgp and when you hit tab, gives all the options.

Andy

Re: Failover root-cause detection in ClusterXL HA

Matlu — Tue, 10 Oct 2023 00:59:27 GMT

I checked, and no, it does not use either of the 2 protocols.

LOL 🤣

I suspect it may also be a problem with "other equipment" on the network, perhaps the switches.

What do you think?

Re: Failover root-cause detection in ClusterXL HA

the_rock — Tue, 10 Oct 2023 01:05:24 GMT

Its possible, but you would need them to check the switches.

Andy