In the SmartConsole connected to the Primary server, create a network object to show the Secondary Security Management Server. After you publish, synchronize starts between the primary and secondary servers.

To configure the secondary server in SmartConsole:

1. Open SmartConsole.
2. In Object Categories, click New > More > Network Object > Gateways and Servers > Check Point Host.
3. On the General Properties page, enter a unique name and IP address for the server.
4. In the Software Blades section, select the Management tab.
5. Select Network Policy Management.

   This automatically selects the Secondary Server, Logging and Status, and Provisioning.

6. Create SIC trust between the Secondary Security Management Server and the Primary:
   1. Click Communication.
   2. Enter the SIC Activation Key of the secondary server.
   3. Click Initialize.
   4. Click Close.
7. Click OK.
8. Click Publish to save these session changes to the database.

   On publish, the initialization and synchronization between the servers start.

9. Monitor these tasks in the Task List, in the SmartConsole System Information area. Wait for the Task List to show that a full sync has completed.
10. Open the High Availability Status window and make sure there is one active server, and one standby.

At intervals, the Active server synchronizes with the standby server or servers, and when you publish the session. Sessions that are not published are not synchronized.

When changes made in private sessions are published on the active server (made public) the changes are copied to the standby servers. During failover, all public and private sessions are copied from the active to the standby before the standby becomes active.

The High Availability Status window shows the status of each Security Management Server in the High Availability configuration.

To see the server status in your High Availability environment:

1. Open SmartConsole and connect to a primary or secondary server.
2. On the Menu, click High Availability.

The High Availability Status window opens.

For the management server and its peer or peers in the High Availability configuration, the High Availability Status window shows:

• A Warning or Error message – The message shows if there is a problem between the High Availability peers.
• Connected To - The server that SmartConsole is connected to. Also, the High Availability mode of the server (Active or Standby), and the synchronization status and actions of the server.
• Peers - The servers that the connected server sees. Also, the High Availability mode of each server (Active or Standby), and the synchronization status and actions of each server.

Status messages can be general, meaning that they apply to the full system, or they can apply to a specified active or standby server. General messages show in the yellow overview banner.

General Status messages in overview banner	Description
	The database of the primary Security Management Server is identical with the database of the secondary.
Some servers could not be synchronized	A communication issue prevents synchronization, or some other synchronization issue exists.
	The active and standby servers are not communicating.
Communication Problem	Some services are down or cannot be reached.
Collision or HA conflict	More than one management server configured as active. Two active servers cannot sync with each other.

When connected to a specified active management server:

Status window area:	Peer Status	Additional Information
Connected to:	Active	SmartConsole is connected to the active management server.
Peers	Standby	The peer is in standby. The message can also show: Sync problem, last time sync Synchronized successfully. Last sync time: <time> No communication
	Not communicating, last sync time
	Active	A state of collision exists between two servers both defined as active.

When connected to a specified standby management server:

Status window area:	Peer Status	Description
Connected to:	Standby	Also shows: last sync time.
Peers	Active	The peer is in standby. The message can also show: No communication, last sync time OK., last sync time: <time> Sync problem, last sync time (in any direction)
	Standby or Unknown	Can also show: no communication.

Changeover between the primary (active) and secondary (standby) management server is not automatic. If the Active fails or it is necessary to change the Active to a Standby, you must do this manually. When the management server becomes Standby it becomes Read Only, and gets all changes from the new Active server.

The Active server synchronizes with the Standby server or servers at intervals, and when you publish the session. Sessions that are not published are not synchronized.

When the administrator initiates changeover, all public data is synchronized from the new Active to the new Standby server after the Standby becomes Active. Data from the new Active overrides the data on the new Standby. Unpublished changes are not synchronized.

Best Practice - We recommend that you publish changes before initiating a changeover to the Standby.

To Interchange the Active and Standby:

1. Open SmartConsole.
2. Connect to the Standby server.
3. On the Menu button, select High Availability.

   The High Availability Status window opens.

4. Use the Action buttons to change the Standby server to Active.

This changes the previous Active server to Standby.

These error messages show in the High Availability Status window when synchronization fails:

Not communicating

Solution:

1. Check connectivity between the servers.
2. Test SIC.

Collision or HA Conflict

More than one management server is configured as active.

Solution:

1. From the main SmartConsole menu, select Management High Availability.

   The High Availability Status window opens.

2. Use the Actions button to set one of the active servers to standby.

   Warning - When this server becomes the Standby, all its data is overwritten by the active server.

Sync Error

Solution:

Do a manual sync.

In a multi-domain environment, the Multi-Domain Servers work in active-active mode. All Multi-Domain Servers are active and synchronize each other.

The Domains managed by the Multi-Domain Server work in active-standby mode, where the Active Domain Server synchronizes all the standby Domain Servers.

The system automatically synchronizes periodically and when an administrator publishes changes to the configuration.

When you create a new secondary Multi-Domain Server, the Internal Certificate Authority (ICA) on the Primary Multi-Domain Server generates a certificate when you establish SIC trust. The ICA can generate a certificate for a new administrator, if required by the authentication method. In a High Availability deployment with more than one Multi-Domain Server, the system synchronizes the ICA databases as necessary.