topic Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE in General Topics

MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

leonardo_silva1 — Mon, 14 Jan 2019 18:54:48 GMT

I have a cluster with active member and standby member, the member management interface on standby is not accessible by ping or ssh, the process of contigencia of the members has been validated and always the member that is in standby is with the door of management inacessivel. Has anyone ever had this problem?

Can I access the standby member through ssh through another interface

Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

Kim_Moberg — Mon, 14 Jan 2019 19:03:23 GMT

Have you tried entering # fw ctl set int fwha_forw_packet_to_not_active 1

if that works, enable on permanent in fwkern.conf.

Best regards

Kim

Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

leonardo_silva1 — Mon, 14 Jan 2019 19:26:27 GMT

Kim Moberg,

I tested it on fw standby and the member is still inaccessible.

Thanks for the tip.

Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

Kim_Moberg — Mon, 14 Jan 2019 19:46:33 GMT

Sorry Aleksei Shelepov

I used some of your text without given you credit. But I have tried the same solution on one of my cluster gateways were i works.

Best regards

Kim

Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

Kim_Moberg — Mon, 14 Jan 2019 20:24:26 GMT

It have to be done on active cluster unit so it forwards packets to you passive/stand-by node

Enable

fw ctl set int fwha_forw_packet_to_not_active 1

Disable

fw ctl set int fwha_forw_packet_to_not_active 0

Re: MANAGEMENT INTERFACE OF THE CLUSTER STANDBY IN STANDBY NON-ACCESSIBLE

Kaspars_Zibarts — Fri, 21 Jun 2019 09:12:20 GMT

Depending on which interface you're trying to access standby member. You might want to read this old discussion.

https://community.checkpoint.com/message/21555-re-problem-accessing-standby-cluster-member-from-non-local-network

In nutshell - if you're trying to connect to standby member via IP that's on the "other" side of the firewall, adding static /32 route to the router in front of the fw might help