topic Re: Checkpoint Security Gateway in General Topics

Checkpoint Security Gateway

gemechis — Thu, 23 Jan 2025 07:58:24 GMT

We have deployed checkpoint maestro in our environment. 2 MHO-140's and 2 Security Gateways.

The security gateway's were sharing a load with 50%, 50%. But last week when I checked the gateway status using asg monitor, it shows on of the gateways Down. One Active. We tried to troubleshoot, we removed the gateway from Maestro and tried to add it again, but after we removed it we could not get it on the maestro, as it is not there under unassigned gateways. All the DAC cables were connected to Maestro & SG and functioning well.

Any help on this is appreciated.

Re: Checkpoint Security Gateway

AkosBakos — Thu, 23 Jan 2025 08:44:55 GMT

Hi @gemechis

Maybe basic question, but what is the output of the lldpctl?

have you tried to FCD the affected appliance (I know, you are remote, but maybe LOM is installed on the SGM) and then put the into the SG again?
what is the lldpclt output?

Akos

Re: Checkpoint Security Gateway

gemechis — Thu, 23 Jan 2025 09:35:50 GMT

@AkosBakos

The output for lldpctl is attahched here with. It shows only the other Maestro on downlink port 48, and the Activve Gateway on port 31.

Re: Checkpoint Security Gateway

AkosBakos — Thu, 23 Jan 2025 09:50:23 GMT

Hi,

Maybe a dummy thing, have you tried to plug and unplug the DAC?

Akos

Re: Checkpoint Security Gateway

gemechis — Thu, 23 Jan 2025 10:55:22 GMT

@AkosBakos

Yes, even we have tried by changing a new DAC cable. But it didn't workout.

Re: Checkpoint Security Gateway

AkosBakos — Thu, 23 Jan 2025 11:55:10 GMT

Hi @gemechis

We can't see the appliance in the #lldpctl. Do you see the same on both MHO?

Can you share the outputs of the MHO:

orch_stat -a
lldpctl

Can you reach the appliamce via LOM?

I had issues with with interface card. Tha solution was the RMA of card.

That is 100% sure the appliance up and running?

Akos

Re: Checkpoint Security Gateway

gemechis — Mon, 03 Feb 2025 06:41:22 GMT

Hello @AkosBakos

Sorry for the late reply.
I have done both commands on both MHO's. On both MHO's gateway's are plugged on port 31 & 32. port 48 is a sync port for MHO's. Find the output of both MHO's orch_stat -a and lldpctl.

The device up and running. We are 100% sure.

We haven't tried the LOM Port. How does it work? Is it different from console one.

Re: Checkpoint Security Gateway

AkosBakos — Mon, 03 Feb 2025 08:22:32 GMT

Hi,

Maybe a dummy question: Because you removed from the Security Group -> this caues an FCD -> Maybe the version of SGM not reverted to R81.10?

Akos

Re: Checkpoint Security Gateway

gemechis — Mon, 03 Feb 2025 08:40:11 GMT

@AkosBakosyes we have removed it from the group on MHO. then now we can not able to discover it.

Does it needs to be reverted to 81.10

Re: Checkpoint Security Gateway

AkosBakos — Mon, 03 Feb 2025 08:43:01 GMT

Hi @gemechis

Summerize it:

The MHOs: R81.20
The SGM in the working SG: R81.20
what version has the failing member?

Akos

Re: Checkpoint Security Gateway

gemechis — Mon, 03 Feb 2025 08:48:09 GMT

@AkosBakos

Yes you right.

The failing member also has the same version R81.201

Re: Checkpoint Security Gateway

AkosBakos — Mon, 03 Feb 2025 08:52:30 GMT

And one more "dummy" question. When you reimaged the SGM, did you use the correct .iso?

Re: Checkpoint Security Gateway

gemechis — Mon, 03 Feb 2025 11:01:56 GMT

@AkosBakos Both MHO's and Both Security Gateways are reimaged during our migration to Maestro on April.

Re: Checkpoint Security Gateway

AkosBakos — Mon, 03 Feb 2025 11:03:49 GMT

Now I run out of ideas. Have you open a ticket by TAC already?

Re: Checkpoint Security Gateway

gemechis — Tue, 04 Feb 2025 06:43:46 GMT

@AkosBakos

Thanks for all the ideas. Now i will open a TAC ticket.

Re: Checkpoint Security Gateway

AkosBakos — Tue, 04 Feb 2025 07:26:33 GMT

Hi,

Please Keep us updated.

akos

Re: Checkpoint Security Gateway

gemechis — Tue, 18 Feb 2025 07:04:55 GMT

@AkosBakos

Hope you are well. This issue has been solved after doing aa reboot of the faulty gateway. Then we have moved it to the security group and now everything is working well.

Thanks for the support.

Re: Checkpoint Security Gateway

gemechis — Tue, 18 Feb 2025 07:05:39 GMT