topic Re: SMB Cluster Member Probing Failed in Spark Firewall (SMB)

SMB Cluster Member Probing Failed

tspunkt — Wed, 23 Feb 2022 12:41:35 GMT

Hi Checkmates,

in a central managed 1800er cluster I suddenly found the problem, that the StandBy Member is unable to test Internet Connection. Status says "No Internet Acces (Probing failed)". Internet is configured with static IP. I believe that after the policy install the gateway shows to this error.

Default gateway is not able to ping, other servers e.g 1.1.1.1 are not able to ping, other gateway member is able to ping. Public IP is able to ping from outside.

From the Active Gateway everything is working fine.

Packet Capture shows ICMP request, but never shows a reply on WAN port.

Any idea what I can do for deeper analysis?

R80.20.35 is installed. Newest firmware does not change anything.

Thank you.

Re: SMB Cluster Member Probing Failed

_Val_ — Fri, 25 Feb 2022 14:10:17 GMT

Please look into sk172884

Re: SMB Cluster Member Probing Failed

tspunkt — Fri, 25 Feb 2022 14:31:31 GMT

Thanks, but this is not the behavior. The cluster isn't able to make a switch of active member, because the standby member is in error state during internet connection loss (caused by this probing error).

SmartView says "Error: Refer to the Notification and Interfaces tables for information about the problem".

In details there is: ConnMonitor | Problem | 0.

Is it possible, that Spoofing on WAN interfaces causing this problem? VMAC is disabled.

Re: SMB Cluster Member Probing Failed

the_rock — Fri, 25 Feb 2022 14:53:38 GMT

Just to clarify, are you saying this was never problem before, until you pushed the policy today? I think sk @_Val_ provided makes sense.

Also, below link may provide some insight.

https://community.checkpoint.com/t5/SMB-Gateways-Spark/WAN-Probing-failed-no-internet/m-p/133335#M5984

Andy

Re: SMB Cluster Member Probing Failed

_Val_ — Fri, 25 Feb 2022 16:03:05 GMT

Just to make sure, both SMB cluster members have their external interfaces with a routable IP? Or just VIP?

Re: SMB Cluster Member Probing Failed

tspunkt — Fri, 25 Feb 2022 16:04:54 GMT

Well, it's the first time the standby member goes to "red" in management after policy install. Maybe it is coincidence.

The point is, that the cluster worked as expected before,

Connection Monitoring on WAN is testing the connectivity very 5 seconds, and suddenly the standby member was in down state.

From another cluster (3600 appliance) in a complete different network ping to external works normal, from both devices.

Re: SMB Cluster Member Probing Failed

tspunkt — Fri, 25 Feb 2022 16:06:30 GMT

I have 2 devices, and 3 public IPs. Configured as "Cluster" in topology.

Re: SMB Cluster Member Probing Failed

_Val_ — Fri, 25 Feb 2022 16:10:15 GMT

Understood. I suggest you open a TAC request

Re: SMB Cluster Member Probing Failed

the_rock — Fri, 25 Feb 2022 16:16:05 GMT

Yes, definitely contact TAC, something is broken with that cluster, for sure.

Re: SMB Cluster Member Probing Failed

tspunkt — Fri, 25 Feb 2022 16:28:36 GMT

ok, thanks. I will open a case for this.

Re: SMB Cluster Member Probing Failed

Amir_Ayalon — Wed, 02 Mar 2022 08:02:07 GMT

please install latest R80.20.35 firmware Build 992002614 which will probably solve the issue.

if not, please share SR number.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk174683&partition=Basic&product=Quantum

Re: SMB Cluster Member Probing Failed

tspunkt — Wed, 02 Mar 2022 08:24:38 GMT

latest firmware already installed.

Case is running under 6-0003182182.