Outgoing packets from cluster member NAT issue

[Nandhakumar]

Having weird issue in Checkpoint Cluster member. 

We have configured cluster member but when i try to do telnet one of our internal server from Active node its getting succeed but same not getting succeed from Standby node.

When i analyzed logs, it seems active node physical interface ip is hidden behind respective interface cluster VIP IP as source.

In standby node, NAT not happening and it uses physical interface IP. 

Now my question, how can we make config so that standby node also nat its physical ip with cluster vip for outgoing interface. i created manual NAT rule but there is no luck.

Same works when i make standby node to active by failover traffic. At the same active will become standby, so in this case it will fail in this node.

[Juan_]

I suggest to set your standby member as a "Silent Standby"

Set these Kernel parameters:

fwha_silent_standby_mode=1
fwha_cluster_hide_active_only=0

Set the same parameters in both members.

You can set them on the fly:

fw ctl set int fwha_silent_standby_mode 1

fw ctl set int  fwha_cluster_hide_active_only 0

More info:

SK169154 

To make it permanent see sk26202 

If your management is below R80.40 you will need rules for the standby to initiate connections, as these will be evaluated in policy on the active.

[Nandhakumar]

Thanks for your help but unfortunately this doesn't helped me to resolve my issue.