- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Hi Guys, not sure if this output is normal when dealing in active standby VSX.
when I do "cphaprob state" in the VS0 it shows that it is active standby. But, when I enter a specific VS such as VS1 then I do "cphaprob state" it shows that this VS is in active active in both VSX gateways.
is this the normal scenario? Is this means the both VAX gateways forwards traffic in that VS?
thank you.
In VS0 you should always see the status of the VSX ClusterXL. For example the following is normal for VSX LS:
GW1: active GW2: standby GW3: standby
The virtual systems VS1, VS2,... can have different status informations.
For example:
VS on GW1: active
VS on GW2: standby (full session and tabel sync with the active VS gateway)
VS on GW3: backup (no session and tabel sync with the active VS gateway)
Here a list with cluster states:
If you are running a bridge mode, it will be shown active-active, as it is supposed to be.
Please share with us your "cphaprob stat" from VS0 and also "vsx stat -v" output, then we can be sure what's going on
In VS0 you should always see the status of the VSX ClusterXL. For example the following is normal for VSX LS:
GW1: active GW2: standby GW3: standby
The virtual systems VS1, VS2,... can have different status informations.
For example:
VS on GW1: active
VS on GW2: standby (full session and tabel sync with the active VS gateway)
VS on GW3: backup (no session and tabel sync with the active VS gateway)
Here a list with cluster states:
Hi @HeikoAnkenbrand , thanks for the feedback and help. But why mine is when I do cphaprob state in VS0 it shows that active/standby in each cluster members but when I go inside a specific VS then do cphaprob state, I can see active/active for both cluster members.
What is the meaning of it? Thanks
Am running some VSX in HA and all of the members are active/standby same with the VS atleast for R80.10 and up.
Same with VR that are active/standby, VSW complains if you do that command.
In VSLS it should show active / standby on all members when everything is OK.
The active will be on diff member depending what vs you check for.
Regards
Magnus
Hi @Magnus-Holmberg , which means my current status right now is abnormal. Is the Monitoring blade needs to be enabled for the clusterXL monitoring that will help for this? thanks
For HA the standard should be Active / Standby.
If there is something else there is an issue.
@HeikoAnkenbrand did post a list of all statuses 🙂
Regards
Magnus
Hi @Magnus-Holmberg , yup I saw @HeikoAnkenbrand's posts. Do you have any idea why my VS goes active/active in both cluster members? Thanks
If you are running a bridge mode, it will be shown active-active, as it is supposed to be.
Please share with us your "cphaprob stat" from VS0 and also "vsx stat -v" output, then we can be sure what's going on
Hi @CyberBreaker,
I agree with @_Val_.
In which mode do you use the VS?
- Bride mode a/a (I think active/active)
- Bridge mode a/s
In the virtual system general properties page of the virtual system object, you can see the selected mode! Maybe a screenshot of this as well.
Can you send a screenshot of "cphaprob stat" in "vsenv 0"
Hi @_Val_ @HeikoAnkenbrand , sorry I forgot to include it in my first statement. Yes, my VSX' are running in bridge mode.
The cphaprob stat in VS0 states that FW1 is Active and FW2 is Standby. The cphaprob in VS1 and VS2 states that both FW1 and FW2 are Active.
So meaning, this scenario is normal?
Thanks
yes, it is normal
Hi @_Val_ , thanks for the confirmation 😁.
@_Val_ was two seconds faster.
Yes, that's normal.
Thanks also @HeikoAnkenbrand for the help 😁
lol, there is no competition here 🙂
Hi @_Val_ just a follow up question. Even if the VS shows active/active, it will still follow the cluster role which is active/standby state, correct? So if I failover, the VS will now pass traffic to the new active VSX gateway, correct?
The state is per VS. If a VS fails over, then yes, traffic will be handled as you say
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY