topic Re: Both security gateways are active in the Full HA cluster in General Topics

Both security gateways are active in the Full HA cluster

Muhammad_Ali — Wed, 09 Jan 2019 03:19:02 GMT

Hi All,

I have configured two Checkpoint Gateways using GAIA R80.20 and added both security gateways in the Full HA cluster. After configuring the sync interface when I have check the High Availability state using "cphaprob state" command both gateways are appearing as "Active". It is not displaying secondary gateway as "Stand by" gateway. Is there any settings or configuration change required to change the secondary gateway as "Stand by"?

Thanks.

Re: Both security gateways are active in the Full HA cluster

_Val_ — Wed, 09 Jan 2019 06:21:00 GMT

Make sure they are communicating on both Sync and other production interfaces. It looks like a clear split brain situation.

Another guess is that you are not using Full HA but Load Sharing physical cluster instead. In that case, it is normal.

Please post output of "cphaprob stat" command here

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Wed, 09 Jan 2019 06:38:35 GMT

Output of "cphaprob stat"

Gateway 1:

Gateway 2:

Re: Both security gateways are active in the Full HA cluster

_Val_ — Wed, 09 Jan 2019 07:15:26 GMT

Okay. It is a split brain. They do not see each other. Are they connected to the same network on at least 1 of the interfaces?

Re: Both security gateways are active in the Full HA cluster

_Val_ — Wed, 09 Jan 2019 07:18:32 GMT

Please also post "cphaconf cluster_id" get from both of them

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Wed, 09 Jan 2019 07:52:19 GMT

Yes they both are connected to the same network

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Wed, 09 Jan 2019 07:55:28 GMT

I am using R80.20 and I believe from R80.10 onwards there is a new algorithm introduced which does automatic selection for the MAC magic

Re: Both security gateways are active in the Full HA cluster

_Val_ — Wed, 09 Jan 2019 09:44:35 GMT

Okay, need output from each for this:

fw ctl get int fwha_mac_magic

do it from expert shell

Re: Both security gateways are active in the Full HA cluster

Maarten_Sjouw — Wed, 09 Jan 2019 12:03:49 GMT

Are these gateways production appliances? or do you have them setup in test in VM-Ware?

If the latter, please disable all port security features of the switch ports leading to the FW's.

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Thu, 10 Jan 2019 01:46:47 GMT

I get this result on both gateways when I run fw ctl get int fwha_mac_magic

If you are after ClusterXL detail for both gateways then it is shown below:

Gateway 1

Gateway 2

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Thu, 10 Jan 2019 01:52:37 GMT

Gateways are not production appliances yet but they will be deployed soon once HA starts working.

Yes they are running in virtual environment and I have disable all port security features but no luck.

Re: Both security gateways are active in the Full HA cluster

Martin_Raska — Thu, 10 Jan 2019 07:05:16 GMT

The LOST state says - The peer cluster member lost connectivity to this local cluster member (for example, while the peer cluster member is rebooted).

check policy install - fw stat, check the license and cluster membership enabled in cpconfig but it looks like a connectivity issue.

POST: cphaprob -a if, cphaprob -l list

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Thu, 10 Jan 2019 07:36:51 GMT

Currently there are no policies installed as it is new setup. Cleanup rule has been set to allow all traffic. And cluster membership is enabled in cpconfig. It can be connectivity issue but couldn't figure out where the problem will be.

The output of "cphaprob -a if" and "cphaprob -l list":

Gateway 1:

Gateway 2:

Re: Both security gateways are active in the Full HA cluster

_Val_ — Thu, 10 Jan 2019 07:44:23 GMT

Okay, that explains it... You need to push policy for cluster to work properly. Before that, any checks are pointless.

Re: Both security gateways are active in the Full HA cluster

Martin_Raska — Thu, 10 Jan 2019 07:59:07 GMT

I see policy installed with time and date, and pnote also shows Policy = OK, but try to install one more time, if it helps.

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Thu, 10 Jan 2019 08:31:04 GMT

I have also tested to push the policy for cluster but it didn't help either.

Re: Both security gateways are active in the Full HA cluster

Muhammad_Ali — Thu, 10 Jan 2019 08:33:09 GMT

Have tried to install policies number of times by making different changes but no joy.

Re: Both security gateways are active in the Full HA cluster

Maarten_Sjouw — Thu, 10 Jan 2019 08:47:32 GMT

Reboot both members and also check on the Switches if they allow Multicast.

Last but not least check with cpconfig if cluster membership is enabled.

Re: Both security gateways are active in the Full HA cluster

Martin_Raska — Thu, 10 Jan 2019 08:47:34 GMT

Try to switch to a different mode than unicast, cphaconf set_ccp broadcast, both nodes and reboot.

Send section Sync from fw ctl pstat

And also:

cphaprob syncstat
cphaprob mmagic

Re: Both security gateways are active in the Full HA cluster

HristoGrigorov — Thu, 10 Jan 2019 12:36:10 GMT

Why don't you try to use a dedicated interface for sync? It appears that you are using Cluster + Sync on eth0 and may be that is somehow confusing it?