Checkpoint 26000 Cluster XL Down

an_technical — Sat, 21 Jun 2025 07:05:03 GMT

Hi Team,

I hope you are doing well

We are migrating from old hardware to new hardware and made the new hardware ready so during migration we just need to move cables.

At the moment, there is only cable on SYNC and MGMT interface and no cables on data port.

We are seeing one of the cluster is down:

FW2:

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 12.12.12.1 100% ACTIVE(!) XXX-XXX-FW1
2 (local) 12.12.12.2 0% DOWN XXX-XXX-FW2

Active PNOTEs: LPRB, IAC

Last member state change event:
Event Code: CLUS-110205
State change: ACTIVE(!) -> DOWN
Reason for state change: Interface eth3-01 is down (disconnected / link down)
Event time: Sat Jun 21 12:09:16 2025

Last cluster failover event:
Transition to new ACTIVE: Member 2 -> Member 1
Reason: Interface eth3-01 is down (disconnected / link down)
Event time: Sat Jun 21 12:10:21 2025

Cluster failover count:
Failover counter: 4
Time of counter reset: Mon Jun 16 11:24:25 2025 (reboot)

FW1:

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 (local) 12.12.12.1 100% ACTIVE(!) XXX-XXX-FW1
2 12.12.12.2 0% DOWN XXX-XXX-FW2

Active PNOTEs: LPRB, IAC

Last member state change event:
Event Code: CLUS-110205
State change: ACTIVE -> ACTIVE(!)
Reason for state change: Interface eth2-04.56 is down (disconnected / link down)
Event time: Sat Jun 21 12:10:21 2025

Last cluster failover event:
Transition to new ACTIVE: Member 2 -> Member 1
Reason: Interface eth3-01 is down (disconnected / link down)
Event time: Sat Jun 21 12:10:21 2025

Cluster failover count:
Failover counter: 4
Time of counter reset: Mon Jun 16 11:24:25 2025 (reboot)

the eth03 module and eth02 module are fibre port and last time I got to know DC engineer didn't inserted SFP on eth03-01. I got to know from them they have inserted SFP but I am waiting for pictures from them.

Can cluster be down if the fibre port has no SFP installed?

FW2:

Device Name: Interface Active Check
Current state: problem

Device Name: Recovery Delay
Current state: OK

Device Name: CoreXL Configuration
Current state: OK

Registered Devices:

Device Name: Fullsync
Registration number: 0
Timeout: none
Current state: OK
Time since last report: 2171.2 sec

Device Name: Policy
Registration number: 1
Timeout: none
Current state: OK
Time since last report: 503 sec

Device Name: routed
Registration number: 2
Timeout: none
Current state: OK
Time since last report: 2392.3 sec

Device Name: cxld
Registration number: 3
Timeout: 30 sec
Current state: OK
Time since last report: 64955.2 sec
Process Status: UP

Device Name: fwd
Registration number: 4
Timeout: 30 sec
Current state: OK
Time since last report: 64954.5 sec
Process Status: UP

Device Name: cphad
Registration number: 5
Timeout: 30 sec
Current state: OK
Time since last report: 64887.4 sec
Process Status: UP

Device Name: Init
Registration number: 6
Timeout: none
Current state: OK
Time since last report: 64882.4 sec

Device Name: Local Probing
Registration number: 7
Timeout: none
Current state: problem
Time since last report: 2169.9 sec

Device Name: cvpnd
Registration number: 8
Timeout: none
Current state: OK
Time since last report: 1.4 sec

Device Name: DSD
Registration number: 9
Timeout: none
Current state: OK
Time since last report: 439.7 sec

FW-2
CCP mode: Manual (Unicast)
Required interfaces: 2
Required secured interfaces: 1

Interface Name: Status:

eth3-01 (P) DOWN (867.6 secs)
Mgmt UP
Sync (S) UP
eth2-04.56 (P) DOWN (2351 secs)
bond1.50 (LS) DOWN
eth1-03.100 (P) DOWN (2351 secs)
eth2-03.54 (P) DOWN (2351 secs)
bond1.53 (LS) DOWN
eth2-03.90 (P) DOWN (2351 secs)
eth1-01.172 (P) DOWN (2351 secs)

============================================================================

FW1:

Built-in Devices:

Device Name: Interface Active Check
Current state: problem (non-blocking)

Device Name: Recovery Delay
Current state: OK

Device Name: CoreXL Configuration
Current state: OK

Registered Devices:

Device Name: Fullsync
Registration number: 0
Timeout: none
Current state: OK
Time since last report: 2406.6 sec

Device Name: Policy
Registration number: 1
Timeout: none
Current state: OK
Time since last report: 707.8 sec

Device Name: routed
Registration number: 2
Timeout: none
Current state: OK
Time since last report: 1486.2 sec

Device Name: cxld
Registration number: 3
Timeout: 30 sec
Current state: OK
Time since last report: 2781.7 sec
Process Status: UP

Device Name: fwd
Registration number: 4
Timeout: 30 sec
Current state: OK
Time since last report: 2780.9 sec
Process Status: UP

Device Name: cphad
Registration number: 5
Timeout: 30 sec
Current state: OK
Time since last report: 2699.6 sec
Process Status: UP

Device Name: Init
Registration number: 6
Timeout: none
Current state: OK
Time since last report: 2694.5 sec

Device Name: Local Probing
Registration number: 7
Timeout: none
Current state: problem
Time since last report: 2401.9 sec

Device Name: cvpnd
Registration number: 8
Timeout: none
Current state: OK
Time since last report: 0.3 sec

Device Name: DSD
Registration number: 9
Timeout: none
Current state: OK
Time since last report: 642.2 sec

FW1:

CCP mode: Manual (Unicast)
Required interfaces: 2
Required secured interfaces: 1

Interface Name: Status:

eth3-01 (P) DOWN (962.1 secs)
Mgmt UP
Sync (S) UP
eth2-04.56 (P) DOWN (2472.7 secs)
bond1.50 (LS) DOWN
eth2-03.54 (P) DOWN (2472.7 secs)
bond1.53 (LS) DOWN
eth2-03.90 (P) DOWN (2472.7 secs)
eth1-01.172 (P) DOWN (2472.7 secs)
eth1-03.100 (P) DOWN (2472.7 secs)

Re: Checkpoint 26000 Cluster XL Down

an_technical — Sat, 21 Jun 2025 07:10:53 GMT

I got the picture from DC team and SFP is installed on eth3-01 port on both firewalls

Re: Checkpoint 26000 Cluster XL Down

Chris_Atkinson — Sat, 21 Jun 2025 11:12:52 GMT

You said there are no data port cables connected so the cluster cannot be up.

Re: Checkpoint 26000 Cluster XL Down

the_rock — Sat, 21 Jun 2025 13:00:25 GMT

Make sure as Chris said that cables are connected and you see green lit up. If thats the case and you still see the same, try cphastop; cphastart and see what happens. If no change, reboot and test. If even afer that no change, please send following:

cphaprob state

cphaprob -a if

cphaprob -i list

cphaprob -l list

cphaprob syncstat

cphaconf mvc

From both members please.

Andy

Re: Checkpoint 26000 Cluster XL Down

Martijn — Mon, 23 Jun 2025 08:50:54 GMT

Hi,

When only Sync and Mgmt are connected (which is OK when getting ready before migration), I always ignore cluster state.
There are no production interfaces connected, so cluster down seems to be the correct state.

When you have migrated and all interfaces (Sync, Mgmt and production) are connected and switch ports are configured correctly cluster state should be OK. If not, then it is time to investigate.

Regards,
Martijn

Re: Checkpoint 26000 Cluster XL Down

the_rock — Mon, 23 Jun 2025 10:00:56 GMT

Valid points @Martijn

topic Re: Checkpoint 26000 Cluster XL Down in Firewall and Security Management

Checkpoint 26000 Cluster XL Down

Re: Checkpoint 26000 Cluster XL Down

Re: Checkpoint 26000 Cluster XL Down

Re: Checkpoint 26000 Cluster XL Down

Re: Checkpoint 26000 Cluster XL Down

Re: Checkpoint 26000 Cluster XL Down