The ticket
Users lose HR for 40 seconds every hour. Or VIP is dead and both members claim Active. Night engineer reboots member 1 and member 2 together. Cluster never agrees who owns 10.10.10.1.
ClusterXL is Check Point HA (and optional load sharing). Members exchange state on a sync/CCP network. cphaprob state must show one Active (HA) and the other Standby, both “OK.” If both Active or both Down, you have split-brain or a dead CCP path — not “Windows is slow.”
SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 (cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in. Not a live customer.
What ClusterXL is
Two Gaia boxes, one cluster object, one VIP per network. In High Availability, one member forwards. The other is ready. Sync copies connections so failover does not drop every TCP session (best effort — some flows still die).
They must see each other on the cluster interfaces. If the sync cable is unplugged, each member may decide it is Active. Two boxes ARP for the same VIP. The LAN melts.
If the middle arrow dies, both sides may paint themselves Active.
HA vs load sharing
| Mode | Who forwards | When |
|---|---|---|
| High Availability (Active/Standby) | One member | Default you will support |
| Load Sharing | Both (with restrictions) | Special designs — more CCP/pivot care |
Cluster properties
Failover runbook
Side A — do not reboot both
Pick one member. Console available.
Side B — state
cphaprob stateon both.cphaprob -a iffor cluster IPs.cphaprob syncstatif sync is the suspect.Side C — one change
Fix the down interface or CCP path. Failover with
clusterXL_admin down/upin a window — not power-off both.
cphaprob state # ID Unique Address Assigned Load State # 1 10.10.10.2 100% ACTIVE # 2 10.10.10.3 0% STANDBY cphaprob -a if # Required interfaces: ... # eth1 UP 10.10.10.2 (VIP 10.10.10.1) # Split brain looks like ACTIVE / ACTIVE on both members.
Four cluster failures
1 · Both Active
Sync/CCP down or duplicate cluster IDs. Unplug one member’s data NIC only if you must stop the ARP war — then fix the sync path.
2 · Failover dead (stuck Active)
Standby never becomes Active. Interface criticality, CCP blocked, or clusterXL_admin down left on the good member.
3 · Failover flaps
Bad cable, duplex, or monitored interface bouncing. Find the interface in -a if, do not raise grace timers blindly.
4 · Reboot both
No member left to own the VIP. Double outage you invented.
How to prove it
1) One Active, one Standby, both OK. 2) VIP ARP is one MAC. 3) A planned clusterXL_admin down on Active moves VIP. 4) You did not leave admin-down in place.
Traps
| Symptom | Cluster story | Wrong fix |
|---|---|---|
| Both Active | CCP/sync | Reboot both |
| VIP dead | Nobody Active | New policy Any-Any |
| Flap hourly | Monitored NIC | Disable ClusterXL |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview
Sources
- Check Point ClusterXL Administration Guide (R81 / R81.20) — HA, cphaprob, sync network.
- CLI:
cphaprob state,cphaprob -a if,clusterXL_admin.
Related: Check Point evidence desk · session factory · next lesson in the series above.