Active Member of ClusterXL unable to reach updates.checkpoint.com

[JoaT]

I was having this problem under R80.40, and upgraded to R81.10 and problem still exists.  The Active (call it B1) gateway is receiving an error Anti-Bot-Update Failed. Contract Entitlement check failed.  Could not reach 'updates.checkpoint.com'. Check DNS and Proxy Configuration on gateway.

The Standby (call it B2) member has no errors.  Now, if I do a force failover between the two, B1 now has no errors after about 2 minutes, it is able to check, and B2 now gets the error.

I have explicit rules allowing the Cluster object, and each cluster member access to the internet via the required ports on both the Security ruleset and the Application ruleset.

What else can I check?

[PhoneBoy]

Usually, it's the backup gateway that is problematic to reach the update servers, not the primary.
In any case, recommend a TAC case to assist: https://help.checkpoint.com