topic Active Standby switched in HA in General Topics

Active Standby switched in HA

C_M — Sat, 01 Feb 2020 19:51:33 GMT

I got an alert that the HA status changed on a cluster of Check Point firewalls. cphaprob stat confirms this. I'm sort of new to Check Point. What are some next steps to troubleshooting why it changed?

This happened about 12 hours ago. So /var/log/messages doesn't show that far back.

Re: Active Standby switched in HA

PhoneBoy — Sat, 01 Feb 2020 21:04:04 GMT

What about /var/log/messages.*?

Re: Active Standby switched in HA

mdjmcnally — Mon, 03 Feb 2020 08:09:25 GMT

There may also be some logs in the regular Check Point logs regarding the Failover.

Re: Active Standby switched in HA

G_W_Albrecht — Mon, 03 Feb 2020 11:04:14 GMT

Extract the ClusterXL logs from the SmartView Tracker:

- #Go to the right-most column "Information"

- #Right click on the name of the column

- #Click on "Edit filter"

- #Under "Specific" choose "Contains"

- #In "Text" type the word "cluster_info" (do not check any boxes)

- #Click on "OK"

- #Go to all the empty columns:

- #"Source", "Destination", "Rule", "Curr Rule Number", #"Rule Name", "Source Port", "User"

- #Right click on the name of the column

- #Click on "Hide Column" (After closing and re-opening SmartView Tracker the columns will re-appear)

- #Go to menu "File"

- click on "Export…"

- This will save all the Cluster messages

Re: Active Standby switched in HA

Timothy_Hall — Mon, 03 Feb 2020 13:25:34 GMT

Use log filter type:Control in the SmartConsole to show all ClusterXL messages caused by a failover. It will also show some other non-ClusterXL messages but is a good place to start. The solution posted by @G_W_Albrecht will work as well. If you are using R80.20+ cphaprob stat should provide a terse reason for the last failover, the command cphaprob show_failover can be used as well.

Re: Active Standby switched in HA

C_M — Mon, 03 Feb 2020 16:01:33 GMT

Thanks all!

fwha_report_id_problem_status: Try to update state to DOWN due to pnote Interface Active Check (desc Mgmt interface is down, 5 interfaces required, only 4 up)

Why are "5 interfaces required"? or is just saying an interface went down.

Re: Active Standby switched in HA

mdjmcnally — Tue, 04 Feb 2020 07:18:21 GMT

The number of interfaces required depends upon the number of interfaces in the cluster in use. Without knowing the topology then no-one can really comment on how many interfaces you would need up in a cluster.

The important part in the message is that the Mgmt Interface went down for some reason.

Would check the switch that the interface connects too, see if any events/logs from that may correspond with the Firewall swapover.