Testing and Troubleshooting

Use these commands on each Cluster Member to confirm that the cluster operates correctly:

Run these commands in the Expert mode:

cphaprob state

cphaprob -a if

Example:

[Expert@HostName:0]# cphaprob state

Cluster Mode: High Availability (Active Up) with IGMP Membership

Number Unique Address Assigned Load State

1 (local) 10.0.1.10 0% Active

2 10.0.1.20 100% Standby

Use the cluster configuration test script on each Cluster Member to confirm it is configured correctly:

The script verifies:

The configuration is defined in the $FWDIR/conf/azure-ha.json file, which is created by the ARM Microsoft® Azure Resource Manager. Technology to administer assets using Resource Group. template.
A Primary DNS server is configured and works.
The machine is set up as a Cluster Member Security Gateway that is part of a cluster..
IP forwarding is enabled on all network interfaces of the Cluster Member.
It is possible to use the APIs to retrieve information about the cluster's resource group.
It is possible to log in to Azure with the Azure credentials in the $FWDIR/conf/azure-ha.json file.
Calibration of ClusterXL configuration for Azure. cluster

To get the latest version of the test script:

Important - In a Cluster, you must configure all the Cluster Members in the same way.

Download the latest version of the test script.

Note - To get the image version, see sk116585.

Back up the current $FWDIR/scripts/azure_ha_test.py script:

cp -v $FWDIR/scripts/azure_ha_test.py{,_backup}

Copy the latest script to the $FWDIR/scripts/ directory:

cp -v /<path to the downloaded script package>/azure_ha_test.py $FWDIR/scripts/

Assign the required permissions:

chmod -v 755 $FWDIR/scripts/azure_ha_test.py

To run the script on each Cluster Member:

Run the script with this command (do not change the syntax):

$FWDIR/scripts/azure_ha_test.py

If all tests were successful, this message appears:

All tests were successful!

Otherwise, an error message appears with information to troubleshoot the problem.

A list of common configuration errors:

Message	Recommendation
`The attribute (ATTRIBUTE) is missing in the configuration`
`Primary DNS server is not configured` `Failed to resolve (host)`	The Cluster Member is not configured with a DNS server.
`Failed in DNS resolving test`	Confirm that DNS resolution on the Cluster Member works.
`You do not seem to have a valid cluster configuration`	Make sure that the Cluster Member configuration on the Check Point Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. is complete and that the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. is installed.
`IP forwarding is not enabled on Interface (Interface-name)`	Use PowerShell to enable IP forwarding on all the network interfaces of the Cluster Member.
`failed to read configuration file: /opt/CPsuite-R80/fw1/conf/azure-ha.json`	The Azure Cluster Member configuration is not up-to-date or written correctly.
`Testing credentials`	Failed to log in with the credentials provided. See the exception text to understand why.
`Testing authorization` `(Exception)`	Make sure the Azure Active Directory service account you created is designated as a Virtual Machine Contributor to the cluster resource group.

Simulate a cluster failover:

For example, shut down the internal interface of the Active Cluster Member.

On the current Active Cluster Member, run in the Expert mode:

clusterXL_admin down

In a few seconds, the second Cluster Member has to report itself as the Active Cluster Member.

Examine the cluster state on each Cluster Member in the Expert mode:

cphaprob state

On the former Active Cluster Member, run in the Expert mode:

clusterXL_admin up

If you experience issues:

Make sure you have a configured Azure Active Directory Service Account.

The service has to have:
- Virtual Machine Contributor privileges to the resource group
- At least minimum privileges on the Cluster Member deployment resources. See Changing Template Components.
To make the networking changes automatically, the Cluster Members have to communicate with Azure. This requires HTTPS connections over TCP port 443 to the Azure end points. Make sure the Security Policy that is installed on the Cluster Members allows this type of communication.