CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > Clustering (Security Gateway HA and ClusterXL)
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-04-18
Junior Member
 
Join Date: 2007-05-03
Posts: 3
Rep Power: 0
jdickson has an average reputation (10+)
Default HA Cluster problem - cluster members can't be active at same time

Hello,

I've got a strange problem with one of our Splat clusters, and I can't fathom why it's acting so weirdly.

The situation is this, we've got 2 Splat R62 servers running in HA in Broadcast New mode, and when the cluster members are up only one of them appears to be active at any one time.

When I do a cphaprob list on the cluster member that's down, it reads :

Built-in Devices:

Device Name: Interface Active Check
Current state: problem

whereas the active one will say OK (all other entries report OK on both), when I do a cphaprob -a if, on the one that's down:

Required interfaces: 3
Required secured interfaces: 1

eth2 UP sync(secured), broadcast
eth1 UP non sync(non secured), broadcast (eth1.11)

On the one that's active:

eth0 UP non sync(non secured), broadcast
eth2 UP sync(secured), broadcast
eth1 UP non sync(non secured), broadcast (eth1.11)

Where eth0 is the external interface, eth2 the cross-over sync and eth1 the internal trunk interface.

If I reboot the one that's down, the situation will then reverse and the one that was up will revert to the state that the previous one was in (down, with the same cphaprob list entries), and the newly rebooted one will become the active member.

I've checked the fwd.elg and message logs and neither indicate any issues or why the status is changing from down to up.

I've checked the interfaces to make that there are no addresses configured the same, that they're all in the correct subnets and correspond with the topology in the firewall cluster object (a few times to make sure I've not done something stupid!).

The obvious indication is that there's a problem with the eth0 interface, the only other thing that could potentially be an issue is that there's another cluster on the same subnet that eth0, which is running in broadcast mode as well, which appears to have no problems.

Previously this was all working correctly until a recent upgrade from R60 to R62, where there were problems with one of the cluster members, and it had to be rebuilt, ever since then this has been a problem.

Any help would be appreciated.

Regards,

John
Reply With Quote
  #2 (permalink)  
Old 2008-04-30
Senior Member
 
Join Date: 2006-05-24
Location: India
Posts: 151
Rep Power: 3
vijayant has an average reputation (10+)
Default Re: HA Cluster problem - cluster members can't be active at same time

please check if it gets resolved by implimenting latest HFA for R62
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 11:20.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0