topic Re: error establishing trust in Spark Firewall (SMB)

error establishing trust

Askey_oot — Tue, 04 Nov 2025 23:49:30 GMT

Hi All,

I'm trying to connect two Checkpoint Spark devices locally manage into one cluster HA, both hardware platform running the same firmware version, license, with GAiA Embedded 81.10.17. I'm getting an "error establishing trust" message on secondary device. Both devices are connected directly to each other with a short patchcord cable LAN2<>LAN2

Example error when click Establish trust:

Re: error establishing trust

Tom_Hinoue — Wed, 05 Nov 2025 00:13:30 GMT

Are your firewall settings on both members set to strict? If so, you will need an incoming policy rule to allow ccp packets (UDP/8116) to communicate with each other.

Re: error establishing trust

Askey_oot — Wed, 05 Nov 2025 00:50:17 GMT

First device call as primary have an strict mode firewall with two manual create policy incoming/outgoing beetwen sync IP address and service ALL with action accept . Second device working firewall blade with standard mode but i create the same firewall 2 manual policy as primary . Same issue without changes

fw ctl zdebug + drop, that show massive logs on secondary device :

handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;

Re: error establishing trust

the_rock — Wed, 05 Nov 2025 00:50:19 GMT

Run fw stat, make sure its not showing initial policy or default filter, if so, just run fw unloadlocal.

Re: error establishing trust

Askey_oot — Wed, 05 Nov 2025 01:23:47 GMT

Hi the_rock,

on secondary device i run these commands fw stat and fw unloadlocal then reebot device and get same logs:

@;14756;[cpu_14];[fw4_0];fw_log_drop_ex: Packet proto=6 172.29.149.1:39577 -> 172.29.149.2:18208 dropped by vpnktcpt_erase_model Reason: vpnk_tcpt erasing model;
@;14760;[cpu_14];[fw4_2];fw_log_drop_ex: Packet proto=6 172.29.149.1:18210 -> 172.29.149.2:59467 dropped by vpnktcpt_erase_model Reason: vpnk_tcpt erasing model;
@;14760;[cpu_14];[fw4_3];fw_log_drop_ex: Packet proto=6 172.29.149.1:18210 -> 172.29.149.2:32991 dropped by vpnktcpt_erase_model Reason: vpnk_tcpt erasing model;
@;14764;[cpu_14];[fw4_14];fw_log_drop_ex: Packet proto=6 172.29.149.1:45961 -> 172.29.149.2:18208 dropped by vpnktcpt_erase_model Reason: vpnk_tcpt erasing model;
@;14764;[cpu_14];[fw4_15];fw_log_drop_ex: Packet proto=6 172.29.149.1:33301 -> 172.29.149.2:18208 dropped by vpnktcpt_erase_model Reason: vpnk_tcpt erasing model;
@;14764;[cpu_22];[SIM74122841];handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;
@;14764;[cpu_22];[SIM74122841];handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;
@;14764;[cpu_22];[SIM74122841];handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;
@;14764;[cpu_22];[SIM74122841];handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;
@;14764;[cpu_22];[SIM74122841];handle_packet_do: invalid interface -1, conn <0.0.0.0,8116,172.29.149.0,8116,17>, type/state Network/Network, vsid 0, pkt_offset 14, protocol 0x0800;

Re: error establishing trust

the_rock — Wed, 05 Nov 2025 03:43:53 GMT

Dont reboot, just run fw stat and IF it shows initial or defaultfilter policy, then run fw unloadlocal and try again.

Re: error establishing trust

Tom_Hinoue — Wed, 05 Nov 2025 07:07:49 GMT

@Askey_oot
Can you temporary change the primary firewall settings to recommended(standard) policy to see if it resolves?
It does seem to be CCP packets not able to communicate with each other.

Re: error establishing trust

Askey_oot — Wed, 05 Nov 2025 07:31:36 GMT

On secondary device it shows

[Expert@Secondary]# fw stat
HOST POLICY DATE
localhost local 5Nov2025 3:52:36 : [>LAN17] [<LAN17] [>SYNCBOND] [<SYNCBOND]