Remote Syslog server not receiving logs from Checkpoint Gateway Physical Interface IP add

[Roshan_Sinha]

Hi Team,

can someone help me to know why Checkpoint gateway is not sending Syslog to Remote log server from its physical interface IP add but sending from its cluster (Virtual) IP add. My gateway is having R80.40

[PhoneBoy]

Because that’s the default.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Roshan_Sinha]

This has started just after the Gaia OS upgrade with R80.40, however i have upgraded my other cluster gateway with same OS but they are not hiding their physical IP behind virtual IP Add.  What would be specific reason with this cluster gateway which using Virtual IP add instead of Physical IP. i checked all the require config and did not find any deviation in configuration.

Any suggestion will be appreciable.

[PhoneBoy]

What release did you upgrade from specifically?
If it was prior to R80.20, there are some pretty significant changes in how SecureXL operates.
Also I believe there is a kernel variable that can account for this difference as well.
I would review the different gateway to see if there are different kernel variables set: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Otherwise I recommend a TAC case.
However the SK I referenced previously should resolve the issue.