topic Re: Cluster member showing ACTIVE(!) state in Firewall and Security Management

Cluster member showing ACTIVE(!) state

nilanjan_lahiri — Wed, 04 Feb 2026 13:43:31 GMT

Hello All,

We were having Checkpoint 6400 (R80.40) in Active Active mode. Because of electrical surge, the Active member blew out and the Standby one took the role of Active. However, when we are trying to login to the now Active firewall, it is logging in Read Only mode and we are not able to make any changes to the firewall.

We are seeing the following output while executing the "cphaprob state" command. Please could you assist with the possible solution. All the options in Smart Console are greyed out as well.

[Expert@HAL-VPN-FW3:0]# cphaprob state

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

2 (local) x.x.x.x 100% ACTIVE(!) HAL-VPN-FW3

Active PNOTEs: IAC

Last member state change event:
Event Code: CLUS-116505
State change: INIT -> ACTIVE(!)
Reason for state change: All other machines are dead (timeout), FULLSYNC P NOTE
Event time: Mon Jan 5 00:51:05 2026

Cluster failover count:
Failover counter: 0
Time of counter reset: Mon Jan 5 00:50:37 2026 (reboot)

Re: Cluster member showing ACTIVE(!) state

Danny — Wed, 04 Feb 2026 14:21:51 GMT

R80.40 is long out of support and should be migrated to R82, which is currently Check Point's recommended release.

That said, I have a couple questions:

Is this a Full-HA or standalone deployment (management + gateway) on both appliances?
If you have Management-HA, did you try to make the standby management active?
Do you have vendor support of these machines, i.e. what does cplic print -x show?

As everything is grayed out in SmartConsole, did you verify that you are logging in with a read-write account? Try to use the standard Gaia admin account in SmartConsole or add it via cpconfig (2 - Administrator) in expert mode. If even the admin account does not log in into SmartConsole in ReadWrite more (SuperUser) permission, I suggest to open a service request.

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 14:10:04 GMT

Active(!) means that the node is active and forwarding packets but there is a cluster issue.

explained here:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/CXLG/Viewing-Cluster-State.htm

so as the second device seems to be out of order, state is showing what its expected to show.

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 14:35:41 GMT

Hey,

Mind sending output of below commands from both members?

cphaprob -a if

cphaprob -i list

cphaprob -l list

cphaprob syncstat

cphaprob roles

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 14:45:41 GMT

And on top of that: I'm still a bit confused about the issue.

You said that the active member blew out because of an electrical surge. So, is this node totally gone? Or is it up again? Could you let me know what's going on with this device?

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 14:47:51 GMT

Good point, Vince. Thats what sort of confused me as well when I read the post.

Re: Cluster member showing ACTIVE(!) state

nilanjan_lahiri — Wed, 04 Feb 2026 19:18:22 GMT

Apologies, I should have been more elaborate. The previous Active firewall blew away and is gone. It is physically damaged beyond repair. The previous Standby has now taken the role of Active but Smart Console is opening in Read Only mode. cphaprob_state shows as ACTIVE(!)

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 19:30:45 GMT

Ah, so sorry to hear that : - (. So without it even being connected, makes sense why other one shows that.

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 19:37:32 GMT

Correct. The output in cphaprob stat is therefore entirely correct.
The question remains regarding the read-only behaviour; we would need more details for that. I haven't quite figured that out yet.

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 20:00:08 GMT

Yea, that baffles me a bit as well.

Re: Cluster member showing ACTIVE(!) state

Danny — Wed, 04 Feb 2026 20:16:45 GMT

@the_rock , @Vincent_Bacher : As outlined in my first reply, this was probably an old and outdated Full HA cluster. As the primary cluster node, including the active management, died during the electrical surge, the secondary cluster node automatically went into active (!) mode and nobody made the standby management active yet, as this needs to be done manually. In result, the remaining management still runs in standby mode and is therefore read-only.

@nilanjan_lahiri : Make your management active and login with a superuser account, typically the Gaia admin account, or use cpconfig to configure it. If none of this helps, open a service request with Check Point Support.

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 20:15:48 GMT

Blimey! Now I get it. Management and gateway on the cluster itself. Good heavens.

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 20:18:35 GMT

Ah, I get what you meant Danny. And yes, R80.40 is out of support, so even opening TAC case might not do much.

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 20:23:50 GMT

Maybe he can try this

# cpstop

# cpprod_util FwSetActiveManagement 1

# cpstart

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 20:25:03 GMT

Excellent idea!

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 20:35:27 GMT

Since the second device is irretrievably broken anyway, you could perhaps also enter the following:

cp_conf fullha del_peer

cp_conf fullha disable

But I've never played around with it before.

Re: Cluster member showing ACTIVE(!) state

the_rock — Wed, 04 Feb 2026 20:37:29 GMT

Now you got me so curious about it, I may build a lab just to test it myself.

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 20:40:42 GMT

Keep me posted.

Re: Cluster member showing ACTIVE(!) state

Danny — Wed, 04 Feb 2026 21:07:42 GMT

@the_rock , @Vincent_Bacher : Don't forget that he doesn't have a cluster anymore and cpstop would also stop his only active cluster node causing a full production outage and maybe even kill his connection to the system.

In a standalone Check Point cluster node (where both the Security Gateway and the Security Management Server run on the same machine), if @nilanjan_lahiri wants to stop only the management services without affecting the firewall/gateway traffic, he should only stop the management processes.

@nilanjan_lahiri : Use SmartConsole to make your management active or run cpwd_admin to stop the management processes, make it active via cpprod_util and then start your management services again:

cpwd_admin stop -name FWM -path "$FWDIR/bin/fw" -command "fw kill fwm"
cpwd_admin:
Process FWM (pid=27613) stopped with command "fw kill fwm". Exit code 0.
cpprod_util FwSetActiveManagement 1 cpprod_util FwIsPrimary
1
cpwd_admin start -name FWM -path "$FWDIR/bin/fwm" -command "fwm"
cpwd_admin:
Process FWM started successfully (pid=28833)

Re: Cluster member showing ACTIVE(!) state

Vincent_Bacher — Wed, 04 Feb 2026 21:14:53 GMT

Yes sure you’re right