https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209076#M39619 <P>At the beginning, CP_B is the active and CP_A is the backup, after executing clusterXL_admin down,clusterXL_admin up on CP_B, the clients to access the server's business are all disconnected, and then executing clusterXL_admin down,clusterXL_admin up on CP_A, the clients to access the server's business are also disconnected. admin up on CP_A, the client to access the server is also disconnected. After looking at the messages, the status of HA is normal in both switchovers and there is also traffic to the firewall.<BR />The topology diagram is as below:</P> Tue, 19 Mar 2024 02:44:11 GMT xiemb 2024-03-19T02:44:11Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209076#M39619 <P>At the beginning, CP_B is the active and CP_A is the backup, after executing clusterXL_admin down,clusterXL_admin up on CP_B, the clients to access the server's business are all disconnected, and then executing clusterXL_admin down,clusterXL_admin up on CP_A, the clients to access the server's business are also disconnected. admin up on CP_A, the client to access the server is also disconnected. After looking at the messages, the status of HA is normal in both switchovers and there is also traffic to the firewall.<BR />The topology diagram is as below:</P> Tue, 19 Mar 2024 02:44:11 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209076#M39619 xiemb 2024-03-19T02:44:11Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209084#M39620 <P>&nbsp;</P> <P>That is possible for services that are not synchronized on the cluster. If connections are not set to keep data or rematch they will be disconnected. To check and synchronize a service, double click it =&gt; Advanced =&gt; Sync on cluster.</P> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 19 Mar 2024 08:16:13 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209084#M39620 G_W_Albrecht 2024-03-19T08:16:13Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209085#M39621 <P>Sync on cluster is on, I see traffic logs coming through the firewall, but noticed that new and concurrent connections are more than 3-4 times more than usual when switching over</P> Tue, 19 Mar 2024 08:22:19 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209085#M39621 xiemb 2024-03-19T08:22:19Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209108#M39625 <P>The increased amount of connections reflect the high load on both members.</P> <P>Would further investigate the issue related to system load.</P> <P>High load could impact cluster functionality.&nbsp;</P> Tue, 19 Mar 2024 12:26:05 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209108#M39625 Lesley 2024-03-19T12:26:05Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209116#M39629 <P>I would definitely open TAC case to investigate this further. Just generate cpinfo files, as well as /var/log/messages*</P> <P>Andy</P> Tue, 19 Mar 2024 13:56:45 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209116#M39629 the_rock 2024-03-19T13:56:45Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209120#M39630 <P>Thanks for your reply! I have exported the cpinf file the day after the failure. However, I see on the messages file that the firewall status is normal after switching active and standby twice.</P> Tue, 19 Mar 2024 14:22:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209120#M39630 xiemb 2024-03-19T14:22:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209121#M39631 <P>You can decide for every service if and how to sync between cluster nodes.</P> Tue, 19 Mar 2024 14:25:16 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209121#M39631 G_W_Albrecht 2024-03-19T14:25:16Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209125#M39632 <P>Is clustering working right?</P> <P>Please send below:</P> <P>cphaprob state</P> <P>cphaprob -a if</P> <P>cphaprob roles</P> <P>cphaprob -i list</P> <P>cphaprob -l list</P> <P>cphaprob syncstat</P> <P>Andy</P> Tue, 19 Mar 2024 14:36:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209125#M39632 the_rock 2024-03-19T14:36:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209741#M39756 <P>Maybe the network devices do not learn the ARP change of the VIP fast enough.</P> <P>You can see if traffic still flowing on the GW after you run clusterXL_admin down</P> <P>vmac might help if this is the case.</P> Tue, 26 Mar 2024 18:16:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/The-network-was-all-down-during-the-HA-active-standby-switchover/m-p/209741#M39756 AmirArama 2024-03-26T18:16:33Z