topic Re: Issue with Checkpoint cluster in General Topics

Issue with Checkpoint cluster

Ravindra_Yadav — Tue, 17 Sep 2019 13:33:01 GMT

Dear Team,

I am facing connectivity issue for one of my server. When I point Cluster IP as gateway, I am not able to reach the device but when I configure individual cluster member as gateway, It is working perfectly fine. What could be the issue. My Checkpoint cluster is in HA mode.

Re: Issue with Checkpoint cluster

FedericoMeiners — Tue, 17 Sep 2019 13:47:00 GMT

Ravindra,
Can you please share with us which Gaia version and JHG are you running?

Is this happening only with this server?
Please use the fw monitor and fw ctl zdebug drop | grep ip (ie: fw ctl zdebug drop | grep 10.0.0.1) to check if there are any drops or if the traffic is reaching or leaving the firewall.

Re: Issue with Checkpoint cluster

Ravindra_Yadav — Tue, 17 Sep 2019 13:51:05 GMT

It R80.10 with latest hotfix.
Traffic is reaching for sure when I point it to individual cluster member as gateway. But It didn't not work I use cluster IP as gateway.

Re: Issue with Checkpoint cluster

Maarten_Sjouw — Tue, 17 Sep 2019 14:21:41 GMT

Check with cphaprob stat
which of the 2 members is the active member.
Then you can use cphaprob -a if
to check the interfaces that are active.

Re: Issue with Checkpoint cluster

Nick_Doropoulos — Tue, 17 Sep 2019 14:40:12 GMT

Hello Ravindra,

In addition to what has already been suggested, could you please give us some background information on the setup of the cluster? In other words, did you configure a cluster right from the start (while going through the first time configuration wizard) or did you start with a single gateway and then tried to configure it as a cluster with another gateway?

Many thanks.

Re: Issue with Checkpoint cluster

Ravindra_Yadav — Wed, 18 Sep 2019 05:58:32 GMT

Hi Nick,
This cluster is already working since last 2 year. All other devices in the same segment has gateway as cluster IP and they are working fine. Only specific to these 2 new server I am facing issue.

Thanks.

Re: Issue with Checkpoint cluster

Maarten_Sjouw — Wed, 18 Sep 2019 09:18:16 GMT

Have you looked at the ARP table for these servers? When you try to ping the VIP, do you see the MAC for that IP? Have you enabled vMAC on the cluster object? If not please try this, sometimes an OS could be to intelligent and say: hey there are 2 IP's with the same MAC, I will not allow that...

Re: Issue with Checkpoint cluster

Ravindra_Yadav — Thu, 19 Sep 2019 08:36:20 GMT

I got one observation. On my server, I am getting MAC of standby firewall again cluster IP. Why is this happening, I should get active firewall MAC against cluster IP, correct ? We are not using vMAC on cluster.

Re: Issue with Checkpoint cluster

Tracy_Hazlett — Wed, 22 Apr 2020 12:39:14 GMT

We are having a similar issue, did you find a resolution for this? Thanks.