After updating to 81.10 HA module not started

[Quadra]

Hi

After updating our Security gateway from 80.40 to 81.10 it shows "HA module not started" when querying for cphaprob state.
Gaia is also not available anymore.
Cphastart, reboot, ... does not seem to fix the issue.

[PhoneBoy · Accepted solution]

When you do a version upgrade on a gateway, the relevant object must be changed to the target version and the policy installed after the upgrade completes.
This is documented in the Install and Upgrade Guide and is a mandatory step.
Without doing it, you will experience exactly what you're seeing since the previously installed policy is no longer valid. 
In this case, the DefaultFilter loads and the gateway will be generally inaccessible over the network until the policy is installed again.

[Quadra]

Thank you for your reply.

I've followed the white page "Upgrade Options and Prerequisites" and "Upgrade of Security Gateways and Clusters".
I didn't see any mention of updating the cluster object.

Now I have a gateway on R81.10 and 1 on R80.40 with the R80.40 the only one working at this moment.
So I have to set the Cluster Object to R81.10 and the R81.10 gateway will work again?

[Quadra]

Here I have found that you only need to update the object version after updating the secondary server (step 9). https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Installation_and_Upgrade_Gui...

[_Val_ · Accepted solution]

You are looking to the wrong part of the upgrade guide. Look into the Cluster Upgrade chapter: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Installation_and_Upgrade_Gui...

You need to install policy to the new upgraded Cluster Member, it can only be done after updating the cluster object version on the management side.

[jacobog]

You do have to put the cluster object in SmartConsole in R81.10. And install policy in the cluster unchecking the box of installing in all members or not install. (In fact the installation will fail in the member still in R80.40, it´s normal).

After installing the policy you will see the member in the cluster with cphaprob stat (it will be in ready state because of another member with older version).

If the policy installation fails in the R81.10 member use the fw unloadlocal and retry

[the_rock]

Make sure as @PhoneBoy said to confirm that cluster object is indeed set to R81.10 on smart console for the cluster. If you can ssh into the appliance, verify the policy by running fw stat.

IF it shows initial policy, that should let person at least ssh into the box AND also web UI, but only on port 443, nothing else. If you use a different port for web UI, then you can just run fw unloadlocal and access it,

However, if fw stat shows defaultfilter, you have no choice but to run fw unloadlocal, as defaultfilter blocks everything.

Hope that helps.

Andy

[Blason_R]

What does your tail -f $FWDIR/log/cpconf.elg log says? and cphamcset.elg?