Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
fabiofabio
Collaborator
Jump to solution

ClusterXL inactive or machine is down

hi,

I have created a small environment in which to test gaia, I am still in the beginning, I have not learned much, yet.
this environment consists of two physical machines (open servers) with two gaia 80.40 installations as gateway and one virtual machine as management
I am stuck with a gateway cluster problem, in device status I only see "ClusterXL inactive or machine is down", I have read about it but I have not found anything that can help me.
can you help me out of this situation? I leave some screens so that my situation can be clearer.
(since it is a test environment I cannot reach the internet. it is a closed environment. I cannot ping the two gateways while the management does. despite not being able to ping them, I can reach the web interface without problems)
thank you very much

 

 

0 Kudos
1 Solution

Accepted Solutions
_Val_
Admin
Admin

In the topology page on the GW, make sure your interfaces and topology for those are correctly defined. External interface is one where default GW is set. The rest are internal. Make sure the first policy you apply is ANY-ANY-ANY-ACCEPT. 

On your fw gws, to on ssh/console and run "fw unloadlocal". After you did, on MGMT check SIC is working. If it is, fetch interfaces with policy, then push policy as described above.

Best, look into Check Point for Beginners series, we discuss setting up GWs there in the Network security section. I have provided you the links already. 

 

View solution in original post

0 Kudos
(1)
24 Replies
_Val_
Admin
Admin

Did you push policy on them yet?

0 Kudos
fabiofabio
Collaborator

it fail every time, looking at the details it says nothing in particular

0 Kudos
_Val_
Admin
Admin

What are the parameters of your GW VMs? RAM and HDD size? How many CPUs?

0 Kudos
fabiofabio
Collaborator

i have both fisical GW with 1 CPU Intel Xeon E5-2665 2.40GHz, 32 gb ram, 900 gb HDD and 2 network card. 1 is connected to the switch and the other is connected to the other gw for the HA.

the management WM have 2 cpu with 2 core per socket (4 core), 8 gb ram, 80 gb HDD and 1 network adapter.

 

0 Kudos
_Val_
Admin
Admin

@fabiofabio One of the most common issues when playing on VMware is not setting enough HW power on your VMs. Look here and make sure your virtual machines have at least required minimum, as mentioned in the article: https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/Part-2-Preparing-the-Lab/ba-p/8805...

 

0 Kudos
(1)
Timothy_Hall
Champion
Champion

From the policy installation failure screen, click the "V" symbol next to the first "Failed" to expand the actual failure error message, and post a screenshot of that.  It is also possible that clustering has not been enabled from cpconfig on one or both of the cluster members, and  as Val said the cluster state will report "problem" until policy is successfully installed.

Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com
0 Kudos
fabiofabio
Collaborator

I have enabled both GWs for clustering while installing gaia but for safety I have now checked by cli and it is enabled.

thanks for the tip of the "V", I leave attached the screen, I have already tried to reinstall the SIC on both GWs, restarted the GWs and re-established the communication of the cluster members. what can i still do?

0 Kudos
Timothy_Hall
Champion
Champion

You need to provision a third interface on both your gateways, connect them, and set it to be the cluster sync network.

Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com
0 Kudos
fabiofabio
Collaborator

I leave attached a screen with the network interfaces and configuration. was that what you meant?
I also leave the screen of a warning that appears to me every time I exit the cluster settings

0 Kudos
Timothy_Hall
Champion
Champion

Read my prior post again.  You need a third NIC interface provisioned in Gaia on both cluster members, then define that third interface as 1st Sync in the cluster topology.

Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com
0 Kudos
fabiofabio
Collaborator

I did it but the same error remained, so I tried to disable the antispoofing and it allowed me to install the policies. at that point the cluster was ok but I can no longer reach the web interface of the gateways. if now I try to re-enable antispoofing it does not allow me to install the policies with the same error as before (asking to install a second cable for the cluster, although there are already one for the cluster and one for the sync)

0 Kudos
_Val_
Admin
Admin

Which points to the topology misconfiguration. Fix it, and all will work 

0 Kudos
fabiofabio
Collaborator

i looked for the solution but i can't get out of it for now. looking for the error i came across sk138132 but it didn't solve the problem and i didn't find anything else about it. any suggestions? 🙂

0 Kudos
_Val_
Admin
Admin

In the topology page on the GW, make sure your interfaces and topology for those are correctly defined. External interface is one where default GW is set. The rest are internal. Make sure the first policy you apply is ANY-ANY-ANY-ACCEPT. 

On your fw gws, to on ssh/console and run "fw unloadlocal". After you did, on MGMT check SIC is working. If it is, fetch interfaces with policy, then push policy as described above.

Best, look into Check Point for Beginners series, we discuss setting up GWs there in the Network security section. I have provided you the links already. 

 

0 Kudos
(1)
fabiofabio
Collaborator

thank you very much, I finally succeeded. the problem was the main gw interface set to private. setting it in cluster, setting the virtual ip and putting it in external I succeeded. it's not something to do in a production environment but oh well, it's just a laboratory. but now I have no idea what I did, the cluster communicates with the management but the gw are no longer reachable from the web interface or even via ssh. I must also say that the gw have never been able to ping them. any idea?

0 Kudos
fabiofabio
Collaborator

@_Val_  sorry, my fault. now everything works. thanks again for the support!

0 Kudos
_Val_
Admin
Admin

No need to be sorry, we are here to help everybody out, @fabiofabio 

0 Kudos
Cyber_Serge
Collaborator

If you use cli to bring up cluster member, what does it say?

Are the cable connected properly for the sync interface?

0 Kudos
(1)
_Val_
Admin
Admin

He will not be able to bring cluster up before policy is installed. He cannot install policy, let him figure out this part first :-), before anything else.

 

fabiofabio
Collaborator

the GWs are already part of the cluster members.

thanks for the sync cable tip, it wasn't. now I have configured the IP on the network cards of both WGs from the web interface and then I have configured the interfaces from the cluster. I leave a screen attached because I'm not sure I have configured it well.

now every time I exit the cluster settings I get this screen that I leave attached and I do not understand what it is.

0 Kudos
the_rock
Legend
Legend

Can you run below commands on both members from ssh and send us the output?

cphaprob state

cphaprob -a if

cphaprob list

cphaprob syncstat

0 Kudos
_Val_
Admin
Admin

no need, @the_rock he is struggling to push policy. 

the_rock
Legend
Legend

Yes, correct, sorry.

0 Kudos
the_rock
Legend
Legend

Maybe sharing a screenshot of your topology would help (you can blur out public IP addresses, thats fine).

0 Kudos