topic Re: ClusterXl issue on 3920 82.10 in Firewall and Security Management

ClusterXl issue on 3920 82.10

VIKAS1 — Tue, 18 Nov 2025 05:36:49 GMT

Hello,

We have recent setup our 3920 gateways with R82.10. I am facing issue with 2nd Gateway not coming up , it's show down.

when i check with error massage it's show Bond1 interface is down, but physical when i login Gaia it's show up.

We are using Aruba 6300M switches to connect Firewall where Aruba Switches are running on VSF configuration with Lag.

i have attached snap for the bond1 configuration, cphaprob stat output, also Aruba Switch configuration snap.

Re: ClusterXl issue on 3920 82.10

Chris_Atkinson — Tue, 18 Nov 2025 06:44:33 GMT

Which JHF take is this machine deployed with and what is the output of "cphaprob -a if" ?

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Tue, 18 Nov 2025 07:08:30 GMT

Hello

FW01> cpinfo -y all

This is Check Point CPinfo Build 914000219 for GAIA
[CPshared]
No hotfixes..
[IDA]
No hotfixes..
[CPFC]
No hotfixes..
[MGMT]
No hotfixes..
[FW1]
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_INEXT_NANO_EGG_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R82.10 - Build 407
kernel: R82.10 - Build 422
[SecurePlatform]
No hotfixes..
[CPinfo]
No hotfixes..
[PPACK]
No hotfixes..
[AutoUpdater]
HOTFIX_INFRA_CONFIG_AUTOUPDATE
[DIAG]
No hotfixes..
[CVPN]
No hotfixes..
[cpsdc_wrapper]
HOTFIX_CPSDC_AUTOUPDATE
[CPUpdates]
BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE Take: 21
BUNDLE_CPOTLPAGENT_AUTOUPDATE Take: 131
BUNDLE_CPOTELCOL_AUTOUPDATE Take: 210
BUNDLE_INEXT_NANO_EGG_AUTOUPDATE Take: 38
BUNDLE_CPVIEWEXPORTER_AUTOUPDATE Take: 75
BUNDLE_QUID_AUTOUPDATE Take: 53
BUNDLE_HCP_AUTOUPDATE Take: 88
BUNDLE_INFRA_CONFIG_AUTOUPDATE Take: 10
BUNDLE_GOT_TPCONF_AUTOUPDATE Take: 158
BUNDLE_CPSDC_AUTOUPDATE Take: 40
[hcp_wrapper]
HOTFIX_HCP_AUTOUPDATE
[CPquid]
HOTFIX_QUID_AUTOUPDATE
[CPviewExporter]
HOTFIX_OTLP_GA
[CPotelcol]
HOTFIX_OTLP_GA
[CPotlpAgent]
HOTFIX_OTLP_GA

FW01> cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 3
Required secured interfaces: 1

Interface Name: Status:

Mgmt Non-Monitored
eth1 UP
eth8 (S) UP
bond1 (LS-P) UP
maas_tunnel Non-Monitored

S - sync, HA/LS - bond type, LM - link monitor, P - probing

Virtual cluster interfaces: 2

eth1 50.200.58.244
bond1 192.20.15.5

FW01>

FW02 output-----

FW02> cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 2
Required secured interfaces: 1

Interface Name: Status:

Mgmt Non-Monitored
eth1 UP
eth8 (S) UP
bond1 (LS-P) DOWN (61634.2 secs)
maas_tunnel Non-Monitored

S - sync, HA/LS - bond type, LM - link monitor, P - probing

Virtual cluster interfaces: 2

eth1 50.200.58.244
bond1 192.20.15.5

FW02>

Re: ClusterXl issue on 3920 82.10

Chris_Atkinson — Tue, 18 Nov 2025 08:07:01 GMT

Is the cabling correct to the switch, have you investigated the lacp-block ?

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Tue, 18 Nov 2025 08:27:27 GMT

cabling has been done as below

FW01- port 3 to core01 23

FW01 - port 4 to core02 23

FW02 - port 3 to core01 24

FW02 - port 4 to core02 24

Re: ClusterXl issue on 3920 82.10

emmap — Tue, 18 Nov 2025 08:46:36 GMT

It seems like all 4 ports are in the same LAG on the switch site? Should be separate LAGs per gateway.

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Tue, 18 Nov 2025 11:18:52 GMT

Might be, I have asked my vendor to check from Aruba switched end.

is there anything to check from checkpoint side

Re: ClusterXl issue on 3920 82.10

the_rock — Tue, 18 Nov 2025 12:05:37 GMT

In your screenshots, shows Mgmt interface is down, not bond.

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Tue, 18 Nov 2025 12:17:49 GMT

Yes, but in another Firewall 02 it's show bond interface.

Re: ClusterXl issue on 3920 82.10

the_rock — Tue, 18 Nov 2025 12:21:03 GMT

I dont see bond anywhere. hey, do you allow remote? Im just doing some lab work now, but dont start till later, so happy to try help you.

Re: ClusterXl issue on 3920 82.10

the_rock — Tue, 18 Nov 2025 13:22:49 GMT

Hey guys,

Just to update, Vikas and I had zoom remote and below are my notes from it. @VIKAS1 , I would certainly check Aruba switch end, as config is 100% correct on CP side.

*************************************

-new 3920 cluster on R82.10
-managed by smart-1 cloud
-in sv monitor, shows bond interface is down

checked cphaprob -a if

this did work fine before, just started today

Aruba switch appears fine

ran cphastop and cphastart on affected member fw02

we also bounced the interface, verified topology, same issue, still shows down from cphaprob state

rebooted fw02 member
verified -> same state, shows as down and bond is down as well

to me, this definitely appears to be Aruba switch related, as config is the same on both members, including bond interface

Re: ClusterXl issue on 3920 82.10

the_rock — Tue, 18 Nov 2025 15:55:31 GMT

Hey Vikas,

I did some more lab tests on this and when I had topology set the way you did, I had exact same problem. I then changed it to setting per routing (cant recall the exact name now, but its 2nd last option I believe) and then all worked when I installed policy.

Re: ClusterXl issue on 3920 82.10

the_rock — Tue, 18 Nov 2025 16:19:15 GMT

@VIKAS1 This is the setting I meant. BUT, please be careful, better try this in short maintenance window.

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Wed, 19 Nov 2025 04:57:11 GMT

Sure, will try and update. thnks for quick zoom call.

Re: ClusterXl issue on 3920 82.10

the_rock — Wed, 19 Nov 2025 11:49:29 GMT

Please let us know, thanks mate!

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Thu, 20 Nov 2025 08:33:08 GMT

I hv tried on down window but there was no changes , same output.

FW02:0]# cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 2
Required secured interfaces: 1

Interface Name: Status:

Mgmt Non-Monitored
eth1 UP
eth8 (S) UP
bond1 (LS-P) DOWN (87301.8 secs)
maas_tunnel Non-Monitored

S - sync, HA/LS - bond type, LM - link monitor, P - probing

Virtual cluster interfaces: 2

FW01:0]# cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 3
Required secured interfaces: 1

Interface Name: Status:

Mgmt Non-Monitored
eth1 UP
eth8 (S) UP
bond1 (LS-P) UP
maas_tunnel Non-Monitored

S - sync, HA/LS - bond type, LM - link monitor, P - probing

Virtual cluster interfaces: 2

FW02:0]# cphaprob stat

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 20.20.20.11 100% ACTIVE FW01
2 (local) 20.20.20.12 0% DOWN FW02

Active PNOTEs: LPRB, IAC

Last member state change event:
Event Code: CLUS-117500
State change: INIT -> DOWN
Reason for state change: PNOTE DSD
Event time: Tue Nov 18 18:47:59 2025

Last cluster failover event:
Transition to new ACTIVE: Member 2 -> Member 1
Reason: Interface Mgmt is down (disconnected / link down)
Event time: Thu Nov 13 22:30:35 2025

Cluster failover count:
Failover counter: 3485
Time of counter reset: Sat Nov 8 16:57:23 2025 (reboot)

Re: ClusterXl issue on 3920 82.10

the_rock — Thu, 20 Nov 2025 12:05:19 GMT

Can you send a screenshot of how topology is set for that interface now?

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Thu, 20 Nov 2025 12:17:35 GMT

Hello, attached

Re: ClusterXl issue on 3920 82.10

the_rock — Thu, 20 Nov 2025 12:19:00 GMT

Hey brother,

I was thinking change it to defined per routes option, thats what I mentioned.

Re: ClusterXl issue on 3920 82.10

VIKAS1 — Thu, 20 Nov 2025 12:45:48 GMT

i have changed but there was no any changes on clusterxl..find the snap topology changes made as you said