Solved: Re: Check Point Maestro SGM2 showing down in clust...

RPawar · ‎2025-07-03

So we have 2 MHO-140 orchestrators and 2 quantum force 9300 appliances for Security group.

Now all the devices are connected based on a single site architecture.

We have connected the MHO-140 devices with respective uplinks and have connected the 2 quantum force appliances with downlink port dl27 dl28 respectively.

When we check HA status it shows "Down" for second SGM.

tried rebooting the device and reinstalling the policy still same issue, however the appliance inherits the last installed policy as checked with "cpstat fw"

Further checking on the fabric layer i got to know that we have connected MHO1 to SGM1 with DAC and MHO2 with SGM1 with fiber on port dl27 similarly for MHO1 to SGM2 with fiber and MHO2 to SGM2 with DAC on port dl28(this connectivity was done due to length challenge between the devices, length was above 3 meters hence fiber was used).

Now i want to know if this type of connectivity is supported in Maestro setup?, can this be the root cause of the issue?

Would be very much helpful if someone clarifies with some official documentation.

Thank You.

RPawar · ‎2025-07-04

Hello eemap & loyd,

I would like to thank you guys for your assistance,

The issue is now solved.

After viewing the logs I got to know that there was a file which was missing named "fwaccel_dos_rate_on_install" on both the SGMs due to which the There was a problem Ponte 11 on Configuration, I manually created the file with same name and with same permissions on both the SGMs and after reboot of Active SGM it automatically made the Second SGM as Active and First SGM as down. After this I manually rebooted the First SGM and post reboot the cluster was up and in Active-Active state.

View solution in original post

Lloyd_Braun · ‎2025-07-03

Not sure if that is supported in a Maestro setup but running "cphaprob list" and identifying which pnote(s) are not healthy may help point to whether this is the root cause of the issue or not.

RPawar · ‎2025-07-03

Thanks for your reply Loyd,

I did check the pnotes aswell and I can see that there is one problem pnote with number 11 and name Configuration.

Can you assist as to how I can further isolate as to what configuration exactly is giving this problem pnote?

Lloyd_Braun · ‎2025-07-03

There is some good info up here on configuration pnote indicating /config/active mismatches: sk181887 - Configuration mismatch in a Maestro environment

emmap · ‎2025-07-03

The pull_config command from that article is the way to go here for sure. You'll need to add the Sync IP of the active SGM on the end of it, for example if SGM1 is active and SGM2 is down, run cpha_blade_config pull_config 192.0.2.1 on SGM2. This will sync the config and likely reboot the SGM. If it doesn't resolve the issue you can add a 'force' switch to the command, run just 'cpha_blade_config' to check the usage.

RPawar · ‎2025-07-03

Hello Emap,

Thanks for your response, i tried the pull config method on the problem SGM and rebooted it manually its still in down state

RPawar · ‎2025-07-03

Hello Loyd,

As suggested in the document i did search the /var/log/configuration_reboot_reason file below is the output from both problem SGM & Active SGM

Problem SGM Logs

Reboot was performed due to configuration mismatch: