How to Initiate Cluster Failover

For more information on initiating manual cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. failovers, see sk55081.

Method 1 (recommended)

Change in the State of the Cluster Member	Command in Gaia Clish	Command in the Expert Mode	Notes
Change the state of the Cluster Member Security Gateway that is part of a cluster. to DOWN State of a Cluster Member during a failure when one of the Critical Devices reports its state as "problem": In ClusterXL, applies to the state of the Security Gateway component; in 3rd-party / OPSEC cluster, applies to the state of the State Synchronization mechanism. A Cluster Member in this state does not process any traffic passing through cluster.	`set cluster member admin down`	`clusterXL_admin down`	Does not disable Delta Sync Synchronization of kernel tables between all working Cluster Members - exchange of CCP packets that carry pieces of information about different connections and operations that should be performed on these connections in relevant kernel tables. This Delta Sync process is performed directly by Check Point kernel. While performing Full Sync, the Delta Sync updates are not processed and saved in kernel memory. After Full Sync is complete, the Delta Sync packets stored during the Full Sync phase are applied by order of arrival..
Change the state of the Cluster Member to UP	`set cluster member admin up`	`clusterXL_admin up`	Does not initiate Full Sync Process of full synchronization of applicable kernel tables by a Cluster Member from the working Cluster Member(s) when it tries to join the existing cluster. This process is meant to fetch a ‎"snapshot" of the applicable kernel tables of already Active Cluster Member(s). Full Sync is performed during the initialization of Check Point software (during boot process, the first time the Cluster Member runs policy installation, during 'cpstart', during 'cphastart'). Until the Full Sync process completes successfully, this Cluster Member remains in the Down state, because until it is fully synchronized with other Cluster Members, it cannot function as a Cluster Member. Meanwhile, the Delta Sync packets continue to arrive, and the Cluster Member that tries to join the existing cluster, stores them in the kernel memory until the Full Sync completes. The whole Full Sync process is performed by fwd daemons on TCP port 256 over the Sync network (if it fails over the Sync network, it tries the other cluster interfaces). The information is sent by fwd daemons in chunks, while making sure they confirm getting the information before sending the next chunk. Also see "Delta Sync"..

See:

Method 2 (not recommended)

Change in the State of the Cluster Member	Command in the Expert mode	Notes
Change the state of the Cluster Member to DOWN	`cphaconf set_pnote -d <Name of Critical Device> -t 0 -s ok register` `cphaconf set_pnote -d <Name of Critical Device> -s problem report`	Does not disable Delta Sync.
Change the state of the Cluster Member to UP	`cphaconf set_pnote -d <Name of Critical Device> -s ok report` `cphaconf set_pnote -d <Name of Critical Device> unregister`	Does not initiate Full Sync.

See:

Notes:

In Load Sharing A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. mode, the cluster distributes the traffic load between the remaining Active State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. members.
In High Availability A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. mode, the cluster fails over to a Standby State of a Cluster Member that is ready to be promoted to Active state (if the current Active Cluster Member fails). Applies only to ClusterXL High Availability Mode. Cluster Member with the highest priority.