Viewing Cluster Interfaces

Description

This command shows the state of the Cluster Member Check Point Firewall that is part of a cluster. interfaces and the virtual cluster Two or more Check Point Firewalls that work together in a redundant configuration - High Availability, or Load Sharing. interfaces.

ClusterXL Cluster of Check Point Firewalls that work together in a redundant configuration. The ClusterXL both handles the traffic and performs State Synchronization. These Check Point Firewalls are installed on Gaia OS: (1) ClusterXL supports up to 5 Cluster Members, (2) VRRP Cluster supports up to 2 Cluster Members, (3) Traditional VSX VSLS Cluster supports up to 13 Cluster Members. Note: In the ClusterXL Load Sharing mode, configuring more than 4 Cluster Members significantly decreases the cluster performance due to amount of Delta Sync traffic. treats the interfaces as Critical Devices. ClusterXL makes sure that interfaces can send and receive CCP packets.

ClusterXL also sets the required minimum number of functional interfaces to the largest number of functional interfaces ClusterXL detected since the last reboot. If the number of functional interfaces is less than the required number, ClusterXL declares the Cluster Member as failed and starts a failover Transferring of a control over traffic (packet filtering) from a Cluster Member that suffered a failure to another Cluster Member (based on internal cluster algorithms). Synonym: Fail-over.. The same applies to the synchronization interfaces, where only good synchronization interfaces are counted.

When an interface is DOWN State of a Cluster Member during a failure when one of the Critical Devices reports its state as "problem": In ClusterXL, applies to the state of the Check Point Firewall; in 3rd-party / OPSEC cluster, applies to the state of the State Synchronization mechanism. A Cluster Member in this state does not process any traffic passing through cluster., it means that the interface cannot receive or send CCP packets, or both. An interface may also be able to receive, but not send CCP packets. The time you see in the command's output is the number of seconds that elapsed since the interface was last able to receive or send a CCP packet.

Network Objective

In the Cluster object in the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. database, you assign the Network Objective Defines how the cluster will configure and monitor an interface - Cluster, Sync, Cluster+Sync, Monitored Private, Non-Monitored Private. Configured in SmartConsole > cluster object > 'Topology' pane > 'Network Objective'. to each interface.

This Network Objective determines a network type (network role) for the interface:

Network Objective	Description
Cluster Interface	Configures a cluster interface An interface on a Cluster Member, whose Network Type was set as Cluster in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. that connects to an internal or external network. Cluster Members monitor this interface. A Cluster Member fails over to its peers if the cluster state of this interface changes to "DOWN".
Cluster Sync Interface	Configures a cluster Synchronization interface. Cluster Members monitor this interface. A Cluster Member fails over to its peers if the cluster state of this interface changes to "DOWN".
Private	Configures an interface that is not part of the cluster. Cluster Members do not monitor this interface. A Cluster Member does not fail over to its peers if a fault occurs on this interface. This option is recommended for the dedicated management interface.

Network Objective

Description

Cluster Interface

Configures a cluster interface An interface on a Cluster Member, whose Network Type was set as Cluster in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. that connects to an internal or external network.

Cluster Members monitor this interface.

A Cluster Member fails over to its peers if the cluster state of this interface changes to "DOWN".

Cluster Sync Interface

Configures a cluster Synchronization interface.

Cluster Members monitor this interface.

A Cluster Member fails over to its peers if the cluster state of this interface changes to "DOWN".

Private

Configures an interface that is not part of the cluster.

Cluster Members do not monitor this interface.

A Cluster Member does not fail over to its peers if a fault occurs on this interface.

This option is recommended for the dedicated management interface.

For more details, see Configuring the Cluster Object and Members.

Syntax

Shell	Command
Gaia Clish The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell).	`set virtual-system <VSID>` `show cluster members interfaces {all \| secured \| virtual \| vlans}`
Expert mode	`cphaprob [-vs all] [-a] [-m] if [<Name of Interface>]`

Where:

Command	Description
`show cluster members interfaces all`	Shows a full list of all cluster interfaces that the cluster monitors: including the number of required interfaces including the Network Objective including the VLAN monitoring mode, or a list of monitored VLAN interfaces
`show cluster members interfaces secured`	Shows only cluster interfaces (Cluster and Sync) that the cluster monitors and their states: without the Network Objective without the VLAN monitoring mode without monitored VLAN interfaces
`show cluster members interfaces virtual`	Shows a full list of cluster virtual interfaces that the cluster monitors and their states: including the number of required interfaces including the Network Objective without the VLAN monitoring mode without monitored VLAN interfaces
`show cluster members interfaces vlans`	Shows only monitored VLAN interfaces
`cphaprob if`	Shows only cluster interfaces (Cluster and Sync) that the cluster monitors and their states: without the Network Objective without the VLAN monitoring mode without monitored VLAN interfaces
`cphaprob -a if`	Shows a full list of cluster interfaces that the cluster monitors and their states: including the number of required interfaces including the Network Objective including the cluster Virtual IP addresses without the VLAN monitoring mode without monitored VLAN interfaces
`cphaprob -m if`	Shows only the cluster interfaces that the cluster monitors and their states: without the Network Objective including the VLAN monitoring mode, or a list of monitored VLAN interfaces
`cphaprob -a -m if`	Shows full list of all cluster interfaces that the cluster monitors and their states: including the number of required interfaces including the Network Objective including the cluster Virtual IP addresses including the VLAN monitoring mode, or list of monitored VLAN interfaces
`cphaprob -a -m if <Name of Interface>`	Shows detailed information about the specified interface: Note - Only this command shows information about an interface that the cluster does not monitor. The output includes these details: the interface's IPv4 and IPv6 addresses the cluster Virtual IP address the interface's MAC and Virtual MAC addresses the physical link state the cluster interface state the CCP mode the unique IP and MAC addresses of the peer cluster members for this interface the cluster monitoring flags for this interface bond details (for a bond interface)

Output

The output of these commands must be identical to the configuration in the cluster object's Network Management page in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

Example 1: cphaprob -a -m if

[Expert@Member1:0]# cphaprob -a -m if
 
CCP mode: Manual (Unicast)
Required interfaces: 4
Required secured interfaces: 1
 
 
Interface Name:      Status:
 
eth0                 UP
eth1 (S)             UP
eth2 (LM)            UP
bond1 (LS)           UP
 
S - sync, LM - link monitor, HA/LS - bond type
 
Virtual cluster interfaces: 3
 
eth0            192.168.3.247
eth2            44.55.66.247
bond1           77.88.99.247
 
 
No VLANs are monitored on the member
 
[Expert@Member1:0]#

Description of the "cphaprob -a -m if" command output fields:

Field, or Text	Description
CCP mode	Shows the CCP mode - "`Unicast`" (default), "`Broadcast`", or "`Multicast`".
Required interfaces	Shows the total number of monitored cluster interfaces, including the Sync interface An interface on a Cluster Member, whose Network Type was set as Sync or Cluster+Sync in SmartConsole in cluster object. This interface is monitored by cluster, and failure on this interface will cause cluster failover. This interface is used for State Synchronization between Cluster Members. The use of more than one Sync Interfaces for redundancy is not supported because the CPU load will increase significantly due to duplicate tasks performed by all configured Synchronization Networks. Synonyms: Secured Interface, Trusted Interface.. This number is based on the configuration of the cluster object > Network Management page.
Required secured interfaces	Shows the total number of the required Sync interfaces. This number is based on the configuration of the cluster object > Network Management page.
Non-Monitored	This means that Cluster Member does not monitor the state of this interface. In SmartConsole, in the cluster object > Network Management page, administrator configured the Network Type Private for this interface.
UP	This means that Cluster Member monitors the state of this interface. The current cluster state of this interface is UP, which means this interface can send and receive CCP packets. In SmartConsole, in the cluster object > Network Management page, administrator configured one of these Network Types for this interface: Cluster, Sync, or Cluster + Sync.
DOWN	This means that Cluster Members monitors the state of this interface. The current cluster state of this interface is DOWN, which means this interface cannot send CCP packets, receive CCP packets, or both. In SmartConsole, in the cluster object > Network Management page, administrator configured one of these Network Types for this interface: Cluster, Sync, or Cluster + Sync.
(S)	This interface is a Sync interface. In SmartConsole, in the cluster object > Network Management page, administrator configured one of these Network Types for this interface: Sync, or Cluster + Sync.
(LM)	This interface is configured in the `$FWDIR/conf/cpha_link_monitoring.conf` file. Cluster Member monitors only the link on this interface (does not monitor the received or sent CCP packets). See Configuring Link Monitoring on the Cluster Interfaces.
(HA)	This interface is a Bond interface in High Availability A redundant cluster mode, where only one Cluster Member (Active member) processes all the traffic, while other Cluster Members (Standby members) are ready to be promoted to Active state if the current Active member fails. In the High Availability mode, the Cluster Virtual IP address (that represents the cluster on that network) is associated: (1) With physical MAC Address of Active member (2) With virtual MAC Address. Synonym: Active/Standby. Acronym: HA. mode.
(LS)	This interface is a Bond interface in Load Sharing A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. mode.
Virtual cluster interfaces	Shows the total number of the configured virtual cluster interfaces. This number is based on the configuration of the cluster object > Network Management page.
No VLANs are monitored on the member	Shows the VLAN monitoring mode - there are no VLAN interfaces configured on the cluster interfaces.
Monitoring mode is Monitor all VLANs: All VLANs are monitored	Shows the VLAN monitoring mode - there are some VLAN interfaces configured on the cluster interfaces, and Cluster Member monitors all VLAN IDs.
Monitoring mode is Monitor specific VLAN: Only specified VLANs are monitored	Shows the VLAN monitoring mode - there are some VLAN interfaces configured on the cluster interfaces, and Cluster Member monitors only specific VLAN IDs.

Example 2: cphaprob -a if eth1 (for a monitored cluster interface)

[Expert@Member1:0]# cphaprob -a if eth1

Interface name:           eth1
FW ifn:                   2
IPv4 Address:             192.168.10.21/24
VIP:                      192.168.10.20/24
MAC Address:              00:50:56:91:E1:2B
Link status:              Connected
Cluster interface status: UP
CCP mode:                 Unicast
 
----   Unique IP's Table ----
Member          IP-Address              MAC-Address
-------------------------------------------------------------------------
1               192.168.10.22           00:50:56:91:AA:BB
-------------------------------------------------------------------------
 
Flags:
Link Monitored:           YES
Used:                     YES
Sync:                     NO
In Topology:              YES

[Expert@Member1:0]#

Example 3: cphaprob -a if eth3 (for a non-monitored cluster interface)

[Expert@Member1:0]# cphaprob -a if eth3

Interface name:           eth3
FW ifn:                   4
IPv4 Address:             10.20.30.40/24
VIP:                      No Virtual IP for this interface.
MAC Address:              00:50:56:91:E1:2D
Link status:              Connected
Cluster interface status: DOWN
CCP mode:                 Unicast
 
----   Unique IP's Table ---- 
Member          IP-Address              MAC-Address
-------------------------------------------------------------------------
-------------------------------------------------------------------------
 
Flags: 
Link Monitored:           NO
Used:                     NO
Sync:                     NO
In Topology:              NO

[Expert@Member1:0]#

Description of the "cphaprob -a if ethX" command output fields:

Field, or Text	Description
Interface name	Shows the name of the interface as assigned in the operating system.
FW ifn	Shows the internal interface number that ClusterXL assigned to this interface.
IPv4 Address	Shows the IPv4 address and the subnet mask configured on this interface. This field is empty if no IPv4 address is configured.
VIP	Shows the IPv4 Cluster Virtual IP address and the subnet mask configured on this interface. This field is empty if no VIP address is configured.
IPv6 Link Local	Shows the IPv6 link-local address configured on this interface. This field appears only when IPv6 is enabled in the Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. operating system and such an IPv6 address is configured.
IPv6 VIP	Shows the IPv6 Cluster Virtual IP address and prefix length configured on this interface. This field appears only when IPv6 is enabled in the Gaia operating system and an IPv6 Virtual IP address is configured.
MAC Address	Shows the physical MAC address of this interface.
VMAC Address	Shows the Virtual MAC address of this interface, if Virtual MAC is enabled.
Link status	Shows the physical link state of the interface - "`Connected`" or "`Not-Connected`".
Cluster interface status	Shows the cluster state of this interface - "`UP`" or "`DOWN`". Also shows the probing If a Cluster Member fails to receive status for another member (does not receive CCP packets from that member) on a given segment, Cluster Member will probe that segment in an attempt to illicit a response. The purpose of such probes is to detect the nature of possible interface failures, and to determine which module has the problem. The outcome of this probe will determine what action is taken next (change the state of an interface, or of a Cluster Member). status while ClusterXL probes the network to determine the state of this interface.
CCP mode	Shows the CCP mode - "`Unicast`" (default), "`Manual (Broadcast)`", or "`Manual (Multicast)`". The value "`multi-ver`" means this is a Multi-Version Cluster The Multi-Version Cluster mechanism lets you synchronize connections between Cluster Members that run different versions. This lets you upgrade to a newer version without a loss in connectivity and lets you test the new version on some of the Cluster Members before you decide to upgrade the rest of the Cluster Members. Acronym: MVC. (MVC).
Unique IP's Table	Shows the unique IP address and MAC address of each peer interface on other Cluster Members. The output does not show the local cluster member. The "`Member`" column shows the internal index of the Cluster Member (the count starts from 0). This table is empty when the cluster does not monitor the specified interface.
Link Monitored	Shows whether ClusterXL monitors the physical link state of this interface - "`YES`" or "`NO`".
VLAN Monitored	Shows whether ClusterXL monitors this VLAN interface - "`YES`" or "`NO`". This field appears only for a VLAN interface.
Bridge	Shows whether this is a Bridge interface - "`YES`" or "`NO`". This field appears only for a Bridge interface.
Loopback	Shows whether this is a Loopback interface - "`YES`" or "`NO`". This field appears only for a Loopback interface.
Used	Shows whether ClusterXL monitors this interface - "`YES`" or "`NO`". If this field shows "`NO`", then the output of the "`cphaprob [-a] [-m] if`" commands does not show this interface.
Sync	Shows whether this is a Sync interface - "`YES`" or "`NO`".
In Topology	Shows whether this interface is part of the cluster topology Set of interfaces on all members of a cluster and their settings (Network Objective, IP address / Net Mask, Topology, Anti-Spoofing, and so on). in the Management Server database.