topic Secondary gateway cannot ping its default gateway. in Firewall and Security Management

Secondary gateway cannot ping its default gateway.

khodgson_bts — Mon, 23 Oct 2023 10:19:03 GMT

Situation as follows: 2 x 3200 appliances on R80.30 jhfa take 237 (yes, I know). They were relocated over the weekend, external IPs changed, all good. Both appliances are up, active member is fine and passing traffic, ClusterXL reports all is well. The secondary appliance cannot ping its own default gateway, interface is up and topology is correct, no ARP entries at all, default route won't become active. Management cannot reach the box to put policy on (fw unloadlocal doesn't help). The link to the ISP is working, we've put a laptop on the same cable the FW was plugged into and given it the same IP and it works no problem.

Re: Secondary gateway cannot ping its default gateway.

_Val_ — Mon, 23 Oct 2023 10:21:30 GMT

Can it ping if it becomes active?

Re: Secondary gateway cannot ping its default gateway.

khodgson_bts — Mon, 23 Oct 2023 10:22:22 GMT

We've not tried that yet. At the moment the site is live and we cannot have any downtime.

Re: Secondary gateway cannot ping its default gateway.

_Val_ — Mon, 23 Oct 2023 10:35:23 GMT

This may be normal, depending on the details of your configuration. With R80.40 and up, traffic from standby goes through sync interface towards the active member, see sk167453.

Try running traces to see where packets are "lost".

Re: Secondary gateway cannot ping its default gateway.

khodgson_bts — Mon, 23 Oct 2023 10:45:05 GMT

All we are getting is "network unreachable" from traces and pings. Regardless of active/standby status, the device should be able to ping its own default gateway. The route is not even showing as active in the routing table.

Re: Secondary gateway cannot ping its default gateway.

_Val_ — Mon, 23 Oct 2023 11:06:01 GMT

Please look into the SK I already provided, you will see that it is a bit more complicated with ClusterXL

Assuming you have policy installed on the new appliance, and the cluster is running in Active/Standby, it should be all good.

However, by traces I mean, try to understand where exactly ICMP is broken. You can do that by running "fw monitor" on both standby and active cluster members. You can also check logs for drops of the relevant traffic.

Re: Secondary gateway cannot ping its default gateway.

_Val_ — Mon, 23 Oct 2023 11:11:35 GMT

Oh boy, I just re-read your post, you are running an unsupported R80.30. This changes everything.

Please look into a similar thread in the community: https://community.checkpoint.com/t5/Security-Gateways/ClusterXL-standby-cannot-reach-gateway/m-p/25712#M1953