topic Re: R81.10 after upgrade cluster not able to sync in Firewall and Security Management

R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Mon, 12 Aug 2024 12:20:28 GMT

HI All,

I have made a setup for a cluster of 5600 series devices with Gateway and management. have some policies installed. While doing the clean image installation and hotflix, I am not able to peer or sync my FW01 to FW02.

1) I have made my FW01 as active before doing the clean image on FW02.

2) Install the R81.10_T335 and Check_Point_R81_10_JUMBO_HF_MAIN_Bundle_T150_FULL.

3) Make my FW02 a secondary while running the wizard. also given IP the same as given before.

4) After clean image installation is complete, I am able to sync with my FW01, but after clean image installation of my FW01, I am not able to sync with my FW02. Also, it is asking to run the new cluster wizard.

Re: R81.10 after upgrade cluster not able to sync

PhoneBoy — Mon, 12 Aug 2024 21:32:16 GMT

What options were selected during First Time Wizard when fresh installing FW02?
What specific errors are shown when you try to sync?

Re: R81.10 after upgrade cluster not able to sync

G_W_Albrecht — Tue, 13 Aug 2024 08:17:13 GMT

This is a duplicate ! Can you delete this one ?

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Tue, 13 Aug 2024 09:17:35 GMT

Ho @VIKASH_GIRI

What do the following commands say?

cphaprob stat

cphaprob -a if

The SIC is Ok between the GW-s and MGMT?

Ákos

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Wed, 14 Aug 2024 06:24:55 GMT

sory for delay response, error when doing clean image on FW01 and connecting to smart console, it's asking to create new cluster. when we connect to FW02 smart console then there will be no option to sync FW01 due to SIC

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Wed, 14 Aug 2024 07:04:06 GMT

Hi @VIKASH_GIRI

Do you van to create a new cluster, or you have a cluster object, and you want to sync the newly installed member into this object?
If you want to SIC the newly installed member into an existing cluster object, you need to reinitiate teh SIC.

Do you want to do this, or I misunderstood something?

Akos

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Wed, 14 Aug 2024 08:13:10 GMT

I want same cluster and sync with new clean image FW01 and FW02, also when i am doing the clean image on my FW01 (primary cluster) my all policy getting erase.

i can't reinitiate the SIC to my FW01 bcz it done have SIC. (while running wizard i am selecting FW01 as primary on cluster)

snap attached

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Wed, 14 Aug 2024 08:26:34 GMT

Hi @VIKASH_GIRI

First clarify the setup, before I give wrong advise.

Do you have indivitual MGMT server?
You reinstall two gateways (i don't know why "Security Managegement" tick enabled)
You want to arrange them into one new cluster

First, and most important to clarify this.

Akos

Re: R81.10 after upgrade cluster not able to sync

emmap — Wed, 14 Aug 2024 08:42:59 GMT

You can't sync a freshly installed primary management instance back from an existing secondary one, the product doesn't work that way. The primary instance is the CA for all the SIC, it's the one that manages all the certs for the communication. If there's no primary then there's no SIC.

You can look to promote your secondary to become the primary, then rebuild FW01 to be the new secondary.

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Wed, 14 Aug 2024 09:08:21 GMT

Do you have indivitual MGMT server? No (both device GW and MGM)
You reinstall two gateways (i don't know why "Security Managegement" tick enabled) -- doing clean image for both GW & MGMT to get free space and install new hotflix

3) You want to arrange them into one new cluster. Yes

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Wed, 14 Aug 2024 09:17:42 GMT

hi @VIKASH_GIRI

Now the setup is clear.

Have you read this guide?

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Installing-Full-HA-Cluster.htm?Highlight=Installing%20Full%20High%20Availability%20Cluster

Akos

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Wed, 14 Aug 2024 09:45:34 GMT

Thanks, I will go through the guide. also, i don't want to lose my connectivity while performing this activity.

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Wed, 14 Aug 2024 09:58:24 GMT

@VIKASH_GIRI

But you wrote that, you don't have enough free space to install a hotfix. What consumes a lof of space on a disk?

Did you try to find the files, directories?

Akos

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Wed, 14 Aug 2024 10:10:57 GMT

Nop, setup running on client place and i am testing this on my lab.

Re: R81.10 after upgrade cluster not able to sync

AkosBakos — Wed, 14 Aug 2024 10:18:28 GMT

Hi @VIKASH_GIRI

I thought that it is a live environment. 🙂 In this case, I wish you a good testing.

Bear in mind, the fullHA setup seems to be a good thing for the first sight, but is had only bad experiences with that.
I prefer the distributed setup to Full-HA. Much more easier, and failureproof

Akos

Re: R81.10 after upgrade cluster not able to sync

VIKASH_GIRI — Fri, 16 Aug 2024 06:20:12 GMT

thnks for update, i tried all way but not able to complete, i think we need to make on standby device and take backup for old device.

Re: R81.10 after upgrade cluster not able to sync

emmap — Fri, 16 Aug 2024 07:46:56 GMT

You should probably fresh install the new kit and follow the Advanced Migration steps in the Install guide linked earlier in this thread.

Re: R81.10 after upgrade cluster not able to sync

the_rock — Fri, 16 Aug 2024 13:31:19 GMT

Keep in mind, as LOTS of people always confuse these things. You canNOT promote secondary to be primary or demote primary into secondary. Primary mgmt will ALWAYS be primary and SECONDARY will ALWAYS be secondary, UNLESS rebuilt. Standby can become active and active can be set as backup.

Anyway, please send send commands @AkosBakos mentioned:

cphaprob state

cphaprob -a if

cphaprob -i list

cphaprob -l list

cphaprob syncstat

cpstat mg

Andy

Though, seems you could do this to promote secondary to primary:

To promote a Secondary server to become the Primary server:

On the Secondary Server that you will promote, run:
#$FWDIR/bin/promote_util
#cpstop
Remove the $FWDIR/conf/mgha* files. They contain information about the current Secondary settings. These files will be recreated when you start the Check Point services.
Make sure you have a mgmtha license on the newly promoted server.
Note - All licenses must have the IP address of the promoted Security Management Server.
Run cpstart on the promoted server.
Open SmartConsole, and:
1. Make the secondary server active.
2. Remove all instances of the old Primary Management object. To see all of the instances, right-click the object and select Where Used.
  Note - When you remove the old Primary server, all previous licenses are revoked.
3. Install database.

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_SecurityManagement_AdminGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_SecurityManagement_AdminGuide/162643

My primary mgmt lab (does NOT matter if its active or standby)

[Expert@CP-MANAGEMENT:0]# grep Primary $CPDIR//registry/HKLM_registry.data
:Primary ("[4]1")
[Expert@CP-MANAGEMENT:0]#

secondary:

[Expert@CP-MANAGEMENT-HA:0]# grep Primary $CPDIR//registry/HKLM_registry.data
:Primary ("[4]0")
[Expert@CP-MANAGEMENT-HA:0]#