ClusterXL inactive or machine is down

[fabiofabio]

hi,

I have created a small environment in which to test gaia, I am still in the beginning, I have not learned much, yet.
this environment consists of two physical machines (open servers) with two gaia 80.40 installations as gateway and one virtual machine as management
I am stuck with a gateway cluster problem, in device status I only see "ClusterXL inactive or machine is down", I have read about it but I have not found anything that can help me.
can you help me out of this situation? I leave some screens so that my situation can be clearer.
(since it is a test environment I cannot reach the internet. it is a closed environment. I cannot ping the two gateways while the management does. despite not being able to ping them, I can reach the web interface without problems)
thank you very much

[_Val_]

Did you push policy on them yet?

[fabiofabio]

it fail every time, looking at the details it says nothing in particular

[_Val_]

What are the parameters of your GW VMs? RAM and HDD size? How many CPUs?

[fabiofabio]

i have both fisical GW with 1 CPU Intel Xeon E5-2665 2.40GHz, 32 gb ram, 900 gb HDD and 2 network card. 1 is connected to the switch and the other is connected to the other gw for the HA.

the management WM have 2 cpu with 2 core per socket (4 core), 8 gb ram, 80 gb HDD and 1 network adapter.

[_Val_]

@fabiofabio One of the most common issues when playing on VMware is not setting enough HW power on your VMs. Look here and make sure your virtual machines have at least required minimum, as mentioned in the article: https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/Part-2-Preparing-the-Lab/ba-p/8805...

[Timothy_Hall]

From the policy installation failure screen, click the "V" symbol next to the first "Failed" to expand the actual failure error message, and post a screenshot of that.  It is also possible that clustering has not been enabled from cpconfig on one or both of the cluster members, and  as Val said the cluster state will report "problem" until policy is successfully installed.

[fabiofabio]

I have enabled both GWs for clustering while installing gaia but for safety I have now checked by cli and it is enabled.

thanks for the tip of the "V", I leave attached the screen, I have already tried to reinstall the SIC on both GWs, restarted the GWs and re-established the communication of the cluster members. what can i still do?

[Timothy_Hall]

You need to provision a third interface on both your gateways, connect them, and set it to be the cluster sync network.

[fabiofabio]

I leave attached a screen with the network interfaces and configuration. was that what you meant?
I also leave the screen of a warning that appears to me every time I exit the cluster settings

[Timothy_Hall]

Read my prior post again.  You need a third NIC interface provisioned in Gaia on both cluster members, then define that third interface as 1st Sync in the cluster topology.

[fabiofabio]

I did it but the same error remained, so I tried to disable the antispoofing and it allowed me to install the policies. at that point the cluster was ok but I can no longer reach the web interface of the gateways. if now I try to re-enable antispoofing it does not allow me to install the policies with the same error as before (asking to install a second cable for the cluster, although there are already one for the cluster and one for the sync)

[_Val_]

Which points to the topology misconfiguration. Fix it, and all will work 

[fabiofabio]

i looked for the solution but i can't get out of it for now. looking for the error i came across sk138132 but it didn't solve the problem and i didn't find anything else about it. any suggestions? 🙂

[_Val_ · Accepted solution]

In the topology page on the GW, make sure your interfaces and topology for those are correctly defined. External interface is one where default GW is set. The rest are internal. Make sure the first policy you apply is ANY-ANY-ANY-ACCEPT. 

On your fw gws, to on ssh/console and run "fw unloadlocal". After you did, on MGMT check SIC is working. If it is, fetch interfaces with policy, then push policy as described above.

Best, look into Check Point for Beginners series, we discuss setting up GWs there in the Network security section. I have provided you the links already. 

[fabiofabio]

thank you very much, I finally succeeded. the problem was the main gw interface set to private. setting it in cluster, setting the virtual ip and putting it in external I succeeded. it's not something to do in a production environment but oh well, it's just a laboratory. but now I have no idea what I did, the cluster communicates with the management but the gw are no longer reachable from the web interface or even via ssh. I must also say that the gw have never been able to ping them. any idea?

[fabiofabio]

@_Val_  sorry, my fault. now everything works. thanks again for the support!

[_Val_]

No need to be sorry, we are here to help everybody out, @fabiofabio 

[Cyber_Serge]

If you use cli to bring up cluster member, what does it say?

Are the cable connected properly for the sync interface?

[_Val_]

He will not be able to bring cluster up before policy is installed. He cannot install policy, let him figure out this part first :-), before anything else.

[fabiofabio]

the GWs are already part of the cluster members.

thanks for the sync cable tip, it wasn't. now I have configured the IP on the network cards of both WGs from the web interface and then I have configured the interfaces from the cluster. I leave a screen attached because I'm not sure I have configured it well.

now every time I exit the cluster settings I get this screen that I leave attached and I do not understand what it is.

[the_rock]

Can you run below commands on both members from ssh and send us the output?

cphaprob state

cphaprob -a if

cphaprob list

cphaprob syncstat

[_Val_]

no need, @the_rock he is struggling to push policy. 

[the_rock]

Yes, correct, sorry.

[the_rock]

Maybe sharing a screenshot of your topology would help (you can blur out public IP addresses, thats fine).