ClusterXL - Local probing problem after adding new VLAN

[snf]

Hi!

I have 2xCheck Point 6400 Plus clustered and fail to add a new VLAN to an interface.

8 VLANs on that interface are working normally.

I followed the steps in this article sk57100.

I can ping the Box-IPs and the Virutal Interface IP from my client, but in the shell:

'cphaprob -a if' shows 'eth2.40 (P) Status DOWN' on both boxes.
The new VLAN has the highest ID, is monitored and so in SmartConsole I see:

Error: Refer to the Notification and Interfaces tables for information about the problem.

In Notification Table I see 'Local Probing - problem'

I checked article sk171844 and noticed that there is no (!) CCP traffic on that interface.
tcpdump -i eth2.40 port 8116 -> nothing

Why are interfaces DOWN and how can I bring them UP? In Gaia Portal the Link Status is 'Up' and I can ping the interface-IPs as mentioned before. In shell 'set interface IF_NAME state on' or 'ifconfig IF_NAME up' did not help.

Thanks for any ideas 🙂

[_Val_]

Make sure you have defined this interface in the cluster objects and pushed the policy.

[snf]

Hi!

Thanks for you reply.

Just for completeness of information - I am running on R81.10.

Yes, I also definded the interface and published the policy as it is described in article sk57100

1. Perform these steps in SmartConsole:

   1. Open Cluster object properties.

   2. Go to 'Network Management' pane - click on 'Get Interfaces' and select 'Get Interfaces Without Topology'

   3. Configure the Network Objective for the new interface, as well as the security zone and address spoofing settings.

   4. Configure the Virtual IP address the new interface, if needed.

   5. Click on 'OK' to apply the changes.

   6. Install relevant policy onto the cluster object.

Actually, this is the moment where the error starts. So, just adding the interfaces on the boxes - no error, but as soon as I define the interface in the cluster, the behaviour starts.

BR

[_Val_ · Accepted solution]

Are you sure you configured VLAN for this interface correctly on the adjacent switches? If the answer is yes, please open a TAC case. This should work out of the box, with the steps above.

[snf]

Thanks for leading me in the right direction. Indeed I missed to add the new VLAN to one of the interfaces.

[_Val_]

Happy to hear it is resolved for you

[_Val_]

Also, did you reboot your FWs after adding a VLAN?

[the_rock · Accepted solution]

Actually @snf , @_Val_ brings up very good point about the switch. Im just making an educated guess here obviously, since I know nothing about your network, but I had customer with similar issue and after weeks of checking and TAC case, it actually turned out to be their switch that was the problem. I checked the email they sent about this to me back few months ago, but all it said was that there was VLAN misconfiguration on the switch and once that was fixed, all worked fine.

Happy to do remote and check this for you...NOT saying it is the switch, but definitely worth verifying everything.

[snf]

Thanks for leading me in the right direction. Indeed I missed to add the new VLAN to one of the interfaces.