cphaprob status showing down cause by routed

[Abeja_huhuhu]

Hi Team, wishing you guys happy new year.  i need some help. i have deployed checkpoint firewall HA using clusterXL . this firewall also having BGP routing configured. i can see that only one firewall will have BGP peer status establish. secondary firewall will have peer status as idle. cphaprob status as per below:

cphaprob state

Cluster Mode:   High Availability (Active Up) with IGMP Membership

ID         Unique Address  Assigned Load   State          Name                                              

1          192.168.8.196   0%              DOWN           amadelo01-new
2 (local)  192.168.8.197   100%            ACTIVE         amadelo02-new

on the the secondary node, we can see that the cluster is down due to routed pnote:

Active PNOTEs: ROUTED

Last member state change event:
   Event Code:                 CLUS-111700
   State change:               INIT -> DOWN
   Reason for state change:    ROUTED PNOTE
   Event time:                 Mon Dec 31 18:51:03 2018

Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     Reboot
   Event time:                 Mon Dec 31 18:47:01 2018

Cluster failover count:
   Failover counter:           3
   Time of counter reset:      Mon Dec 31 18:51:03 2018 (reboot)

output of cphaprob list:

cphaprob list

Registered Devices:

Device Name: routed
Registration number: 2
Timeout: none
Current state: problem
Time since last report: 59996.3 sec

i have try reinstall policy to the firewall but still the status showing down. is there anything that we could use to force it to be Standby again instead of showing down.?

[PhoneBoy]

Did you check this SK? 

Standby Cluster member in "Down" state with routed PNOTE in problematic state 

[Abeja_huhuhu]

Hi Daemon,

thanks for the suggestion. i have check the SK and not much help on that. but i can confirm the issue happened due to the standby node does not get the default route from BGP. so most probably the route is not identical for both firewall node which causing the routed process state change to problem. However, i notice after leaving it running for a while the standby node starting to import the default route advertise by BGP peers even though the status of peers is idle. The only changes that i have made is to disabled cluster fold which allow each node to connect using its own ip instead of using cluster ip.

for me this can considered as working.

[Alessandro_Marr]

Is your bgp peer a router Cisco?

When peers send routes advertises can you see if any special parameters are been sending too?

DO you have a capability like a route-refresh on other side?

[Abeja_huhuhu]

Hi Alessandro,

yes, peer is using cisco. you may find below are the capabilities introduce to us.

State                         Established (Uptime: 02:33:22)  
Peer Type                     eBGP Peer  
Remote AS                     45352     
Local AS                      2.7076 (138148)  
Peer Capabilities             InetUnicast,RouteRefresh,CiscoRouteRefresh,4-Byte AS Extension  
Our Capabilities              InetUnicast,RouteRefresh,4-Byte AS Extension  
Authentication                None      
Multihop                      Off       
Reachability Detection        Off       
Graceful Restart              Off       
Keepalives                              
    Last Received             32s       
    Last Sent                 24s       
    Interval                  60s       
    Holdtime                  180s      
Received                                
    IPv4 Routes               1 (1 active)  
    IPv6 Routes               0 (0 active)  
Sent                                    
    IPv4 Routes               3         
    IPv6 Routes               0         

the same capabilities introduce for IPv6 peers.

based on above, i believed it does have route-refresh capabilities.

i notice in the logs i can see it also sending us unrecognize capabilities. below are portion of the logs.

(proto) received unrecognized capability 70. Ignoring capability 70

[Alessandro_Marr · Accepted solution]

you need disable on cisco this proprietary feature, ciscorouterefresh...  when the gateway receive a route advertisement or any message of BGP with any proprietary feature it become instable. 

in one of my routers I couldn´t because I could not update his IOS, if it is not possible, you could try using OSPF

[Abeja_huhuhu]

Thanks for your suggestion. we manage to get the upstream to disable the capabilities and now i can see the gateway is much more stable. so far no more firewall flapping cause by routed. i think this should be solved  the issue.

[Alessandro_Marr]

thank you!!

[zhangchuang]

What features of Cisco are you turning off? I have a similar problem now.

[DZ_KB]

Hi @Alessandro_Marr , @PhoneBoy ,

Is there an SK that talks about this issue ?

Thx

[Chris_Atkinson]

Are you also seeing an error as listed in sk117598 or just a general pnote due to routed? 

Is graceful restart configured/used to improve failover behavior?

Refer also:

https://community.checkpoint.com/t5/Management/BGP-Peering/td-p/15260

[DZ_KB]

yes graceful restart is configured.