Testing and Troubleshooting the High Availability Cluster Configuration

You can use the APIs to retrieve information about the clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. resource group.

Note - Run these commands from Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)., or the Expert ModeClosed The name of the elevated command line shell that gives full system root permissions in the Check Point Gaia operating system..

cphaprob state

cphaprob -a if

Example:

[Expert@HostName:0]# cphaprob state

Cluster Mode:   High Availability (Active Up) with IGMP Membership

ID         Unique Address  Assigned Load   State

1 (local)  11.22.33.245    0%              Active
2          11.22.33.246    10%             Standby

Use the cluster configuration test script on each Cluster Member to confirm that it is configured correctly.

The script verifies:

To check the configuration, run the following script on each Cluster Member:

  1. Connect to the command line.

  2. Log in to the Expert mode.

  3. Run the script with this command (do not change the syntax):

    $FWDIR/scripts/google_ha_test.py

    If all tests were successful, this message opens: All tests were successful! Otherwise, an error message is displayed with information about how to troubleshoot the problem.

Common configuration errors:

Message Recommended Action

The attribute (ATTRIBUTE) is missing in the configuration

Make sure the configuration file is correct.

Primary DNS server is not configuredFailed to resolve (host)

The Cluster Member is not configured with a DNS server.

Failed in DNS resolving test

Confirm that DNS resolution on the Cluster Member works.

You do not seem to have a valid cluster configuration

Make sure the Cluster Member configuration on the Check Point Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. is complete, and that the Security PolicyClosed Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. is installed.

IP forwarding is not enabled on Interface (Interface-name)

Use PowerShell to enable IP forwarding on all the network interfaces of the Cluster Member.

Failed to read configuration file: $FWDIR/conf/gcp-ha.json

The GCP Cluster Member configuration is not up-to-date, or is written incorrectly.

Testing credentials

Failed to login with the credentials provided. See the exception text to understand why.

Testing authorization

(Exception)

Make sure the GCP daemon has access to GCP.

For example, shut downClosed State of a Cluster Member during a failure when one of the Critical Devices reports its state as "problem": In ClusterXL, applies to the state of the Security Gateway component; in 3rd-party / OPSEC cluster, applies to the state of the State Synchronization mechanism. A Cluster Member in this state does not process any traffic passing through cluster. the internal interface of the ActiveClosed State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. Cluster Member.

  1. On the current Active Cluster Member, run in the Expert Mode:

    clusterXL_admin down

  2. After a few seconds, the second Cluster Member has to report itself as the Active Cluster Member.

    Examine the cluster state on each Cluster Member. Run in the Expert Mode:

    cphaprob state

  3. On the former Active Cluster Member, run from the Expert Mode:

    clusterXL_admin up

If you experience issues:

To make the networking changes automatically, the Cluster Members have to communicate with GCP. This requires HTTPS connections over TCP port 443 to the GCP end points. Make sure that the Security Policy that is installed on the Cluster Members allows for this type of communication.

Using the GCP High Availability Daemon

The cluster solution in GCP uses the daemon to make API calls to GCP when a cluster failoverClosed Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over. takes place. This daemon uses a configuration file, $FWDIR/conf/gcp-ha.json, on each Cluster Member.

When you deploy the above solution from the supplied template , a configuration file is automatically created .

The configuration file is in JSON format and contains these attributes:

Attribute's Name Type Value

debug

Boolean

True or False

public ip

String

Name of the cluster's external, primary public IP address

secondary public ip

String

Name of the cluster's external, secondary public IP address

dest ranges

String

IP range for updating

You can confirm that the daemon in charge of communicating with GCP runs on each Cluster Member.

From Expert Mode, run:

cpwd_admin list | grep -E "PID|GCP_HAD"

The output should be similar to this example:

The script appears in the output.

The STAT column should show E (executing).

The #START column should show 1 (the number of times this script was started by the Check Point Watchdog).

From Expert Mode, run:

vi $FWDIR/conf/gcp-ha.json 

#{
    "debug": true,
    "public_ip": "XXX-primary-cluster-address",
    "secondary_public_ip": "XXX-secondary-cluster-address",
    "dest_ranges": ["0.0.0.0/0"]
}

#{
    "debug": false,
    "public_ip": "XXX-primary-cluster-address",
    "secondary_public_ip": "XXX-secondary-cluster-address",
    "dest_ranges": ["0.0.0.0/0"]
}

#{
    "debug": false,
    "public_ip": "XXX-primary-cluster-address",
    "secondary_public_ip": "XXX-secondary-cluster-address",
    "dest_ranges": ["<NEW CIDR>"]
}

#{
    "debug": false,
    "public_ip": "XXX-primary-cluster-address",
    "secondary_public_ip": "XXX-secondary-cluster-address",
    "dest_ranges": ["<NEW CIDR1>", "<NEW CIDR2>", "<NEW CIDR3>"]
}

  1. Kill the GCP daemon. Run in the Expert mode:

    ps aux | grep had

    killall had

  2. Make sure the process is running.

    ps aux | grep had

  3. In the Expert mode, run:

    cpwd_admin list | grep -E "PID|GCP_HAD"

The debug output is written to $FWDIR/log/gcp_had.elg* files.