topic Re: Full HA cluster with MGMT sync not working in General Topics

Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 14:57:20 GMT

Hi!

I've recently installed a Full HA Cluster configuration in R81.10. Everything went well with the primary, installation, wizard, configuration of the policy...

Then I installed the secondary, wizard selecting Secondary MGMT and ClusterXL, and initial SIC password. Then SIC completed on the FW object, policy installation...

And everything OK on the gateway part. Cluster is working, connections synchronized, etc...

But on the MGMT part, the sync is not working. When you try to do a full sync the primary says it can't contact with its peer.

And checking on Monitor, the Secondary complains that the Security Management CA is not running.

And if you do a cpstat mg, on the part of Internal CA status you get a "?"

Licenses are OK, and as I said I did nothing special during the installation (because it really doesn't give you choices where to fail).

Any ideas?

Thanks

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 14:58:12 GMT

Did you try reboot?

Andy

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 14:59:47 GMT

Hi!

Of course! 🙂 First a cpstop / cpstart and then a reboot after it didn't change anything

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 15:00:44 GMT

Fair enough. Can you send screenshot of the error?

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 15:06:54 GMT

Hi again

You get this error

And then on Monitor

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 15:39:23 GMT

https://community.checkpoint.com/t5/Management/Security-Management-Server-CA-is-not-running/td-p/126212

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 15:39:51 GMT

https://community.checkpoint.com/t5/Management/Security-Management-Server-is-not-running/td-p/82915

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 15:54:48 GMT

Hi!

Checked this posts. About the first ones, both machines are using NTP and have the same time. About the second one, the first two checks ok, ports up, but

ps -aux | grep solr-solrj > check if the CPM service is running --> there's no CPM process

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 15:56:28 GMT

What does api status show?

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 16:04:59 GMT

[Expert@FW-IRL-2:0]# api status

API Settings:
---------------------
Accessibility: Require local
Automatic Start: Disabled

Processes:

Name State PID More Information
-------------------------------------------------
API Started 21881
CPM Started 21881 Check Point Security Management Server is running and ready
FWM Started 22568
APACHE Started 11789

Port Details:
-------------------
JETTY Internal Port: 54286
JETTY Documentation Internal Port: 57453
APACHE Gaia Port: 443

Profile:
-------------------
Machine profile: Small Medium env resources profile
CPM heap size: 1280m

Apache port retrieved from: dbget http:ssl_port

--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Correction about the last post, there's indeed CPM process, what fails is what the post suggests, ps -aux | grep solr-solrj shows no results

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 16:06:11 GMT

What does below show?

$FWDIR/scripts/./cpm_status.sh

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Wed, 05 Jun 2024 16:09:30 GMT

[Expert@FW-IRL-2:0]# ./cpm_status.sh
Check Point Security Management Server is running and ready

Re: Full HA cluster with MGMT sync not working

the_rock — Wed, 05 Jun 2024 16:19:47 GMT

Can you try log into that member and see if it syncs?

Re: Full HA cluster with MGMT sync not working

the_rock — Thu, 06 Jun 2024 00:31:17 GMT

@Jose_Luis_Mart1 Did you try log into smart console on fw2?

Andy

Re: Full HA cluster with MGMT sync not working

Jose_Luis_Mart1 — Thu, 06 Jun 2024 06:53:20 GMT

No, you can't log into FW2 with Smartconsole

Re: Full HA cluster with MGMT sync not working

Hugo_vd_Kooij — Thu, 06 Jun 2024 09:13:33 GMT

To be honest. That is a setup that has a number of limitations and issues that you don't want to find out the hard way.

So SmartCenter always goes on seperate system and not on the gateway in a cluster setup.

Not sure why you have choosen for this setup as it is a pain.

Re: Full HA cluster with MGMT sync not working

the_rock — Thu, 06 Jun 2024 11:00:51 GMT

I will never forget what customer told me ages ago about full HA "When it works, its heaven, but when it breaks, its a true nightmare"

But then I guess then can be said for most things lol

Anyway, @Hugo_vd_Kooij , I totally get what you are saying.

Andy