Cluster member showing ACTIVE(!) state

[nilanjan_lahiri]

Hello All,

We were having Checkpoint 6400 (R80.40) in Active Active mode. Because of electrical surge, the Active member blew out and the Standby one took the role of Active. However, when we are trying to login to the now Active firewall, it is logging in Read Only mode and we are not able to make any changes to the firewall.

We are seeing the following output while executing the "cphaprob state" command. Please could you assist with the possible solution. All the options in Smart Console are greyed out as well. 

[Expert@HAL-VPN-FW3:0]# cphaprob state

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

2 (local) x.x.x.x 100% ACTIVE(!) HAL-VPN-FW3

Active PNOTEs: IAC

Last member state change event:
Event Code: CLUS-116505
State change: INIT -> ACTIVE(!)
Reason for state change: All other machines are dead (timeout), FULLSYNC P NOTE
Event time: Mon Jan 5 00:51:05 2026

Cluster failover count:
Failover counter: 0
Time of counter reset: Mon Jan 5 00:50:37 2026 (reboot)

[Danny]

R80.40 is long out of support and should be migrated to R82, which is currently Check Point's recommended release.

That said, I have a couple questions:

• Is this a Full-HA or standalone deployment (management + gateway) on both appliances?
• If you have Management-HA, did you try to make the standby management active?
• Do you have vendor support of these machines, i.e. what does cplic print -x show?

As everything is grayed out in SmartConsole, did you verify that you are logging in with a read-write account? Try to use the standard Gaia admin account in SmartConsole or add it via cpconfig (2 - Administrator) in expert mode. If even the admin account does not log in into SmartConsole in ReadWrite more (SuperUser) permission, I suggest to open a service request.

[Vincent_Bacher]

Active(!) means that the node is active and forwarding packets but there is a cluster issue.

explained here:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/CXL...

so as the second device seems to be out of order, state is showing what its expected to show.

[the_rock]

Hey,

Mind sending output of below commands from both members?

cphaprob -a if

cphaprob -i list

cphaprob -l list

cphaprob syncstat

cphaprob roles

[Vincent_Bacher]

And on top of that: I'm still a bit confused about the issue.

You said that the active member blew out because of an electrical surge. So, is this node totally gone? Or is it up again? Could you let me know what's going on with this device?

[the_rock]

Good point, Vince. Thats what sort of confused me as well when I read the post.

[nilanjan_lahiri]

Apologies, I should have been more elaborate. The previous Active firewall blew away and is gone. It is physically damaged beyond repair. The previous Standby has now taken the role of Active but Smart Console is opening in Read Only mode. cphaprob_state shows as ACTIVE(!) 

[the_rock]

Ah, so sorry to hear that : - (. So without it even being connected, makes sense why other one shows that. 

[Vincent_Bacher]

Correct. The output in cphaprob stat is therefore entirely correct.
The question remains regarding the read-only behaviour; we would need more details for that. I haven't quite figured that out yet.

[the_rock]

Yea, that baffles me a bit as well.

[Danny]

@the_rock , @Vincent_Bacher : As outlined in my first reply, this was probably an old and outdated Full HA cluster. As the primary cluster node, including the active management, died during the electrical surge, the secondary cluster node automatically went into active (!) mode and nobody made the standby management active yet, as this needs to be done manually. In result, the remaining management still runs in standby mode and is therefore read-only.

@nilanjan_lahiri : Make your management active and login with a superuser account, typically the Gaia admin account, or use cpconfig to configure it. If none of this helps, open a service request with Check Point Support.

[Vincent_Bacher]

Blimey! Now I get it. Management and gateway on the cluster itself. Good heavens.

[the_rock]

Ah, I get what you meant Danny. And yes, R80.40 is out of support, so even opening TAC case might not do much.

[Vincent_Bacher]

Maybe he can try this 

# cpstop

# cpprod_util FwSetActiveManagement 1

 # cpstart

[the_rock]

Excellent idea!

[Vincent_Bacher]

Since the second device is irretrievably broken anyway, you could perhaps also enter the following:

cp_conf fullha del_peer

cp_conf fullha disable

But I've never played around with it before.

[the_rock]

Now you got me so curious about it, I may build a lab just to test it myself.

[Vincent_Bacher]

Keep me posted.

[Danny]

@the_rock , @Vincent_Bacher : Don't forget that he doesn't have a cluster anymore and cpstop would also stop his only active cluster node causing a full production outage and maybe even kill his connection to the system.

In a standalone Check Point cluster node (where both the Security Gateway and the Security Management Server run on the same machine), if @nilanjan_lahiri  wants to stop only the management services without affecting the firewall/gateway traffic, he should only stop the management processes.

@nilanjan_lahiri : Use SmartConsole to make your management active or run cpwd_admin to stop the management processes, make it active via cpprod_util and then start your management services again:

cpwd_admin stop -name FWM -path "$FWDIR/bin/fw" -command "fw kill fwm"
cpwd_admin:
Process FWM (pid=27613) stopped with command "fw kill fwm". Exit code 0.
cpprod_util FwSetActiveManagement 1
cpprod_util FwIsPrimary
1
cpwd_admin start -name FWM -path "$FWDIR/bin/fwm" -command "fwm"
cpwd_admin:
Process FWM started successfully (pid=28833)

[Vincent_Bacher]

Yes sure you’re right 

[the_rock]

 

[Vincent_Bacher]

@nilanjan_lahiri 

I'll keep my fingers crossed that it works for you and that you can continue working for the time being.
Nevertheless, I would strongly recommend that you seriously consider a refresh and then, ideally, distributed or dedicated management. With backups and everything that goes with it, of course.

[the_rock]

I could not agree more. Distributed environment is a way to go. I only know one customer we manage that always used standalone config, but its most likely because they are pretty small shop.

[the_rock]

I was able to replicate it in the lab and yes, you are 100% right @Danny