topic Re: Cluster of two SMB 1900 in Spark Firewall (SMB)

Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 16:48:50 GMT

Hello,

I've configured a cluster of two SMB 1900, but it seems something is missing:

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 17:25:49 GMT

Can you provide what I asked in the other post?

Andy

cphaprob roles

cphaprob state

cphaprob -l list

cphaprob -i list

cphaprob syncstat

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 17:48:17 GMT

the new node:

[Expert@fw01-3]# cphaprob roles ID Role 1 Master 2 (local) Non-Master cphaprob state Cluster Mode: High Availability (Active Up) ID Unique Address Assigned Load State Name 1 10.231.149.1 100% ACTIVE(!) fw01-2 2 (local) 10.231.149.2 0% DOWN fw01-3 cphaprob -l list Built-in Devices: Device Name: Interface Active Check Current state: OK Device Name: Recovery Delay Current state: OK Device Name: CoreXL Configuration Current state: problem Registered Devices: Device Name: Fullsync Registration number: 0 Timeout: none Current state: OK Time since last report: 339.9 sec Device Name: Policy Registration number: 1 Timeout: none Current state: OK Time since last report: 335.2 sec Device Name: cphad Registration number: 2 Timeout: 30 sec Current state: OK Time since last report: 4020.2 sec Process Status: UP Device Name: routed Registration number: 3 Timeout: none Current state: OK Time since last report: 3971.7 sec Device Name: Init Registration number: 4 Timeout: none Current state: OK Time since last report: 4015.9 sec Device Name: cxld Registration number: 5 Timeout: 30 sec Current state: OK Time since last report: 4011.4 sec Process Status: UP Device Name: ConnMonitor Registration number: 6 Timeout: none Current state: problem Time since last report: 332.4 sec Device Name: Local Probing Registration number: 7 Timeout: none Current state: OK Time since last report: 315.3 sec Active PNOTEs: ConnMonitor, COREXL Last member state change event: Event Code: CLUS-114000 State change: INIT -> DOWN Reason for state change: Member state has been changed due to restart of the Cluster module Event time: Thu Apr 10 18:24:50 2025 Cluster failover count: Failover counter: 0 Time of counter reset: Tue Apr 8 21:21:52 2025 (reboot) cphaprob -i list Built-in Devices: Device Name: CoreXL Configuration Current state: problem Registered Devices: Device Name: ConnMonitor Registration number: 6 Timeout: none Current state: problem Time since last report: 424.5 sec cphaprob syncstat Delta Sync Statistics Sync status: OK Drops: Lost updates................................. 0 Lost bulk update events...................... 0 Oversized updates not sent................... 0 Sync at risk: Sent reject notifications.................... 0 Received reject notifications................ 0 Sent messages: Total generated sync messages................ 351552 Sent retransmission requests................. 1 Sent retransmission updates.................. 131 Peak fragments per update.................... 1 Received messages: Total received updates....................... 239847 Received retransmission requests............. 48 Sync Interface: Name......................................... LAN2 Link speed................................... 2500Mb/s Rate......................................... 94440 [Bps] Peak rate.................................... 94440 [Bps] Link usage................................... 0% Total........................................ 374467[KB] Queue sizes (num of updates): Sending queue size........................... 512 Receiving queue size......................... 256 Fragments queue size......................... 50 Timers: Delta Sync interval (ms)..................... 100 Reset on Thu Apr 10 18:25:12 2025 (triggered by fullsync).

the old node:

[Expert@fw01-2]# cphaprob roles ID Role 1 (local) Master 2 Non-Master cphaprob state Cluster Mode: High Availability (Active Up) ID Unique Address Assigned Load State Name 1 (local) 10.231.149.1 100% ACTIVE(!) fw01-2 2 10.231.149.2 0% DOWN fw01-3 Active PNOTEs: COREXL Last member state change event: Event Code: CLUS-113905 State change: ACTIVE -> ACTIVE(!) Reason for state change: Mismatch in the number of CoreXL FW instances has been detected Event time: Thu Apr 10 19:07:45 2025 Cluster failover count: Failover counter: 0 Time of counter reset: Tue Apr 8 21:21:52 2025 (reboot) cphaprob -l list Built-in Devices: Device Name: Interface Active Check Current state: OK Device Name: Recovery Delay Current state: OK Device Name: CoreXL Configuration Current state: problem (non-blocking) Registered Devices: Device Name: Fullsync Registration number: 0 Timeout: none Current state: OK Time since last report: 591 sec Device Name: Policy Registration number: 1 Timeout: none Current state: OK Time since last report: 591 sec Device Name: cphad Registration number: 2 Timeout: 30 sec Current state: OK Time since last report: 151691 sec Process Status: UP Device Name: cxld Registration number: 3 Timeout: 30 sec Current state: OK Time since last report: 151691 sec Process Status: UP Device Name: routed Registration number: 4 Timeout: none Current state: OK Time since last report: 2025.5 sec Device Name: Init Registration number: 5 Timeout: none Current state: OK Time since last report: 151686 sec Device Name: Local Probing Registration number: 6 Timeout: none Current state: OK Time since last report: 2015.3 sec cphaprob -i list Built-in Devices: Device Name: CoreXL Configuration Current state: problem (non-blocking) cphaprob syncstat Delta Sync Statistics Sync status: OK Drops: Lost updates................................. 0 Lost bulk update events...................... 0 Oversized updates not sent................... 0 Sync at risk: Sent reject notifications.................... 0 Received reject notifications................ 0 Sent messages: Total generated sync messages................ 626210 Sent retransmission requests................. 48 Sent retransmission updates.................. 2 Peak fragments per update.................... 2 Received messages: Total received updates....................... 23075 Received retransmission requests............. 1 Sync Interface: Name......................................... LAN2 Link speed................................... 2500Mb/s Rate......................................... 0 [Bps] Peak rate.................................... 0 [Bps] Link usage................................... 0% Total........................................ 391464[KB] Queue sizes (num of updates): Sending queue size........................... 512 Receiving queue size......................... 256 Fragments queue size......................... 50 Timers: Delta Sync interval (ms)..................... 100 Reset on Thu Apr 10 18:25:05 2025 (triggered by fullsync).

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 18:28:15 GMT

I can tell right away where the issue is, says corexl configuration. Can you make sure it matches from cpconfig menu, like below in my lab.

Andy

[Expert@CP-FW-01:0]# cpconfig
This program will let you re-configure
your Check Point products configuration.

Configuration Options:
----------------------
(1) Licenses and contracts
(2) SNMP Extension
(3) PKCS#11 Token
(4) Random Pool
(5) Secure Internal Communication
(6) Disable cluster membership for this gateway
(7) Enable Check Point Per Virtual System State
(8) Enable Check Point ClusterXL for Bridge Active/Standby
(9) Check Point CoreXL
(10) Automatic start of Check Point Products

(11) Exit

Enter your choice (1-11) :9

Configuring Check Point CoreXL...
=================================

CoreXL is currently enabled with 6 IPv4 firewall instances.

(1) Change the number of firewall instances
(2) Disable Check Point CoreXL
(3) Change firewall mode

(4) Exit
Enter your choice (1-4) :

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 18:37:38 GMT

🤷‍

cpconfig -bash: cpconfig: command not found

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 18:42:38 GMT

Try fw ctl multik stat?

Andy

Re: Cluster of two SMB 1900

skandshus — Thu, 10 Apr 2025 18:47:03 GMT

did you do cpconfig in expert mode?

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 18:47:48 GMT

After I restarted the new node and some erros are gone. The old node has now errors at all. The new node has now.

Question: how many cables must be used for Syncing? I have only one

cphaprob state Cluster Mode: High Availability (Active Up) ID Unique Address Assigned Load State Name 1 10.231.149.1 100% ACTIVE fw01-2 2 (local) 10.231.149.2 0% DOWN fw01-3 Active PNOTEs: ConnMonitor Last member state change event: Event Code: CLUS-112100 State change: INIT -> DOWN Reason for state change: FULLSYNC PNOTE Event time: Thu Apr 10 20:31:10 2025 Cluster failover count: Failover counter: 0 Time of counter reset: Tue Apr 8 21:21:52 2025 (reboot) cphaprob -i list Registered Devices: Device Name: ConnMonitor Registration number: 6 Timeout: none Current state: problem Time since last report: 786.3 sec

Re: Cluster of two SMB 1900

skandshus — Thu, 10 Apr 2025 18:48:38 GMT

did you add a SYNC interface? only 1 is needed for SYNC. 2 could be better but you only need one 🙂

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 18:49:10 GMT

Just normal straight through cable. In the old days, people would use cross-over cable, but not sure anyone even keeps any of those any more lol

Andy

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 18:53:49 GMT

yes i did in expert mode

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 18:55:03 GMT

Yes, I added one sync interface, the cluster will not be created without it.

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 18:56:23 GMT

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 18:57:01 GMT

both FW have the same:

fw ctl multik stat ID | Active | CPU | Connections | Peak ---------------------------------------------- 0 | Yes | 0 | 25 | 45 1 | Yes | 1 | 35 | 52 2 | Yes | 2 | 44 | 73 3 | Yes | 3 | 32 | 89 4 | Yes | 4 | 39 | 74 5 | Yes | 5 | 48 | 84 6 | Yes | 6 | 40 | 75 7 | Yes | 7 | 44 | 78 8 | Yes | 8 | 47 | 81 9 | Yes | 9 | 40 | 73 10 | Yes | 10 | 52 | 93 11 | Yes | 11 | 43 | 72 12 | Yes | 12 | 34 | 74 13 | Yes | 13 | 29 | 74 14 | Yes | 14 | 40 | 93 15 | Yes | 15 | 35 | 91 16 | Yes | 16 | 31 | 64 17 | Yes | 17 | 31 | 74

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 19:24:44 GMT

after I restarted the old node the new one became green (no errors), but the old node got same errors...:

cphaprob state Cluster Mode: High Availability (Active Up) ID Unique Address Assigned Load State Name 1 (local) 10.231.149.1 0% DOWN fw01-2 2 10.231.149.2 100% ACTIVE fw01-3 Active PNOTEs: ConnMonitor Last member state change event: Event Code: CLUS-112100 State change: INIT -> DOWN Reason for state change: FULLSYNC PNOTE Event time: Thu Apr 10 21:05:48 2025 Last cluster failover event: Transition to new ACTIVE: Member 1 -> Member 2 Reason: Reboot Event time: Thu Apr 10 21:01:42 2025 Cluster failover count: Failover counter: 1 Time of counter reset: Tue Apr 8 21:21:52 2025 (reboot)

Re: Cluster of two SMB 1900

Exonix — Thu, 10 Apr 2025 19:36:14 GMT

My friend Ivan gave me a link, which solved Cluster issue (but fully working cluster didn't resolve RAS VPN ussie...)

Re: Cluster of two SMB 1900

the_rock — Thu, 10 Apr 2025 19:39:47 GMT

Good to know!