Check Point ClusterXL — HA vs Load Sharing, CCP, and the MAC Magic Number You Never Read About

The interview question that trips up L2 candidates

Interview: "Member 1 was Active. Failover triggered. Now Member 2 is Active but users complain sessions dropped. What went wrong?"
Wrong answers: "Sync interface", "CCP timeout". Right answer: "Either (a) the sync interface wasn't keeping up with sync traffic — state didn't propagate before failover, or (b) the failed-over connections were Non-Synced services (some apps are explicitly excluded from state sync via $FWDIR/conf/discntd.if), or (c) ARP didn't update at the upstream router — gratuitous ARP from Member 2 was lost or arrived after the router's ARP cache TTL window. Diagnose with cphaprob syncstat + check 'Non-Synced services' table + ping upstream router MAC table."

💡 The captain-and-co-pilot analogy

Two pilots fly the same plane. The captain (Active member) handles all the radio + controls. The co-pilot (Standby) watches every action and notes it in a shared logbook (sync interface). If the captain has a heart attack mid-flight, the co-pilot takes over instantly — because they were tracking every decision. If the logbook (sync interface) was missing pages, some of the captain's flight plan is lost. CCP is the radio between them announcing "I'm still alive" every 100 ms. Miss 3 announcements → co-pilot assumes captain is dead, takes over.

① HA mode (Active/Standby) — the default

Two members. One is Active, handling all traffic. Other is Standby, idle but synced. Failure detection: CCP (UDP/8116) heartbeats every 100 ms. Miss 3 in a row → Standby promotes itself, sends gratuitous ARP for the VIP, takes over. Existing TCP sessions survive (state already synced).

② Load Sharing modes

Three LS modes — both members process traffic in parallel:

• LS Multicast — VIP maps to a multicast MAC. Both members receive every frame, each member decides which 50% to process based on a hash. Requires switch to allow multicast MAC on the L2 interface.
• LS Unicast (Pivot) — one member ("Pivot") receives all traffic, forwards 50% to the other over sync. Simpler L2 (no multicast MAC); pivot becomes single point of bottleneck.
• LS Unicast (Hashing) — newer, both members advertise unicast MACs and the switch hash-distributes via LAG.

4 things every interview asks about

③ CCP + sync interface — the cluster's nervous system

Sync interface = a dedicated physical (or VLAN) interface between members. Carries:

• CCP heartbeats — UDP/8116, every 100 ms.
• State sync — connections table, NAT table, VPN SAs. Constant trickle (high on busy gateways).
• Delta sync — periodic "what changed" updates to keep tables aligned without retransmitting everything.

Best practice: dedicated NIC, gigabit or 10G, no other traffic. On busy gateways (1M+ sessions) the sync interface gets ~200 Mbps steady-state. Skimp here = silent failover bugs.

④ cphaprob — the cluster diagnostic CLI

cphaprob stat              # current state (Active/Standby/Down) on this member
cphaprob list              # all health checks (interfaces, processes, pnotes) + reasons
cphaprob syncstat          # sync stats — bytes, delays, drops
cphaprob -a if             # all monitored interfaces + state
cphaprob -d                # admin DOWN this member (manual failover trigger)
cphaprob -d normal          # admin UP back to normal

The 5 mistakes that cost candidates the cluster question