topic Re: ipv6 broke sic in Firewall and Security Management

ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 16:47:43 GMT

After I enabled ipv6, I rebooted. After the reboot I could NOT connect to the gateway at all. The box lost its cluster status. I also lost SIC. New day, new issue. 🙂

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 16:49:43 GMT

Really? Thats odd...is it R81.20, R82? I had ipv6 enabled on both versions in the lab, never had an issue.

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 16:51:34 GMT

R81.20. Yeah, it's a new one for me too.

I disabled ipv6 and everything is fine again.

Tried it again - same issue...

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 16:55:06 GMT

What was the process you followed? I just tested on abother lab gw with set ipv6-state on and save config, rebooted, no issues. R81.20 jumbo 111

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 16:57:10 GMT

I tried it with set ipv6-state on as well as in the web ui same issue. JHF105

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 16:58:38 GMT

Here is my question. When you do this and reboot, what does fw stat show? If its initial policy, just run fw unloadlocal, test SIC, if green, try policy.

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 17:15:07 GMT

ytmnd

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 17:15:21 GMT

Funny enough, just tested on R82 standalone and same happened. But then since it showed initial policy, I did fw unloadlocal, was able to log into smart console and install policy that was there before.

Rebooted again, still fine with ipv6 on

Andy

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 17:16:31 GMT

Since I did not google that abbreviation, no clue what it means, but glad we can help lol

Andy

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 17:39:43 GMT

Who knew there is dedicated page to that abbreviation 🤣

Andy

https://en.wikipedia.org/wiki/YTMND#:~:text=YTMND%2C%20an%20initialism%20for%20%22You,zooming%20text%20and%20a%20looping

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 18:04:54 GMT

I now have the Check Point ClusterXL for Bridge Active/Standby in cpconfig set to enable for one cluster and not in another. Is it recommended or not? I'm using a dedicated SYNC interface as well.

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 18:07:53 GMT

I would make sure they match. Just verified in my clusterxl lab and they are same on both.

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 18:10:55 GMT

So, they do match per cluster. I have it enabled in this new cluster. Not in an older one.

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 18:13:00 GMT

Personally, as long as cluster is used and processing traffic, I would ensure those settings are the same on both members.

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 18:22:43 GMT

Agreed, just wondering if there was a preference. This is the first I'm running it on bridge mode.

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 18:26:53 GMT

I can tell you that even if certain things do not match 100%, cluster will still work, but me personally, to keep it consistent, I always recommend double checking settings do indeed match. Last thing you want if there is a failover is to find out the hard way something was missing.

Andy

Re: ipv6 broke sic

Daniel_Kavan — Wed, 20 Aug 2025 19:01:13 GMT

Yes, both member of the cluster have the same settings.

Re: ipv6 broke sic

the_rock — Wed, 20 Aug 2025 19:04:58 GMT

Then, all I have to say is...

ytmnd : - )

Andy