Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
snf
Participant
Jump to solution

ClusterXL - Local probing problem after adding new VLAN

Hi!

I have 2xCheck Point 6400 Plus clustered and fail to add a new VLAN to an interface.

8 VLANs on that interface are working normally.

I followed the steps in this article sk57100.

I can ping the Box-IPs and the Virutal Interface IP from my client, but in the shell:

'cphaprob -a if' shows 'eth2.40 (P) Status DOWN' on both boxes.
The new VLAN has the highest ID, is monitored and so in SmartConsole I see:

Error: Refer to the Notification and Interfaces tables for information about the problem.

In Notification Table I see 'Local Probing - problem'


I checked article sk171844 and noticed that there is no (!) CCP traffic on that interface.
tcpdump -i eth2.40 port 8116 -> nothing

Why are interfaces DOWN and how can I bring them UP? In Gaia Portal the Link Status is 'Up' and I can ping the interface-IPs as mentioned before. In shell 'set interface IF_NAME state on' or 'ifconfig IF_NAME up' did not help.

Thanks for any ideas 🙂

0 Kudos
2 Solutions

Accepted Solutions
_Val_
Admin
Admin

Are you sure you configured VLAN for this interface correctly on the adjacent switches? If the answer is yes, please open a TAC case. This should work out of the box, with the steps above.


View solution in original post

the_rock
Legend
Legend

Actually @snf , @_Val_ brings up very good point about the switch. Im just making an educated guess here obviously, since I know nothing about your network, but I had customer with similar issue and after weeks of checking and TAC case, it actually turned out to be their switch that was the problem. I checked the email they sent about this to me back few months ago, but all it said was that there was VLAN misconfiguration on the switch and once that was fixed, all worked fine.

Happy to do remote and check this for you...NOT saying it is the switch, but definitely worth verifying everything.

View solution in original post

8 Replies
_Val_
Admin
Admin

Make sure you have defined this interface in the cluster objects and pushed the policy.

0 Kudos
snf
Participant

Hi!

Thanks for you reply.

Just for completeness of information - I am running on R81.10.

Yes, I also definded the interface and published the policy as it is described in article sk57100

  1. Perform these steps in SmartConsole:

    1. Open Cluster object properties.

    2. Go to 'Network Management' pane - click on 'Get Interfaces' and select 'Get Interfaces Without Topology'

    3. Configure the Network Objective for the new interface, as well as the security zone and address spoofing settings.

    4. Configure the Virtual IP address the new interface, if needed.

    5. Click on 'OK' to apply the changes.

    6. Install relevant policy onto the cluster object.

 

Actually, this is the moment where the error starts. So, just adding the interfaces on the boxes - no error, but as soon as I define the interface in the cluster, the behaviour starts.

BR

0 Kudos
_Val_
Admin
Admin

Are you sure you configured VLAN for this interface correctly on the adjacent switches? If the answer is yes, please open a TAC case. This should work out of the box, with the steps above.


snf
Participant

Thanks for leading me in the right direction. Indeed I missed to add the new VLAN to one of the interfaces.

0 Kudos
_Val_
Admin
Admin

Happy to hear it is resolved for you

0 Kudos
_Val_
Admin
Admin

Also, did you reboot your FWs after adding a VLAN?

0 Kudos
the_rock
Legend
Legend

Actually @snf , @_Val_ brings up very good point about the switch. Im just making an educated guess here obviously, since I know nothing about your network, but I had customer with similar issue and after weeks of checking and TAC case, it actually turned out to be their switch that was the problem. I checked the email they sent about this to me back few months ago, but all it said was that there was VLAN misconfiguration on the switch and once that was fixed, all worked fine.

Happy to do remote and check this for you...NOT saying it is the switch, but definitely worth verifying everything.

snf
Participant

Thanks for leading me in the right direction. Indeed I missed to add the new VLAN to one of the interfaces.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events