# ClusterXL: when failover is dead Source: https://ai.techclick.in/blog_checkpoint_clusterxl_failover_dead Markdown: https://ai.techclick.in/blog_checkpoint_clusterxl_failover_dead.md Publisher: Techclick Infosec Pvt Ltd cphaprob state when both members lie. Active/Standby, CCP, sync, pivot. Dummy cp-gw-01/02 VIP 10.10.10.1. ## The ticket Users lose HR for 40 seconds every hour. Or VIP is dead and both members claim Active. Night engineer reboots member 1 and member 2 together. Cluster never agrees who owns 10.10.10.1 . Quick interview answer ClusterXL is Check Point HA (and optional load sharing). Members exchange state on a sync/CCP network. cphaprob state must show one Active (HA) and the other Standby, both “OK.” If both Active or both Down, you have split-brain or a dead CCP path — not “Windows is slow.” Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## What ClusterXL is Two Gaia boxes, one cluster object, one VIP per network. In High Availability, one member forwards. The other is ready. Sync copies connections so failover does not drop every TCP session (best effort — some flows still die). They must see each other on the cluster interfaces. If the sync cable is unplugged, each member may decide it is Active. Two boxes ARP for the same VIP. The LAN melts. Healthy HA Active and Standby cp-gw-01 Active owns VIP 10.10.10.1 CCP / sync cp-gw-02 Standby ready If the middle arrow dies, both sides may paint themselves Active. ## HA vs load sharing Mode Who forwards When High Availability (Active/Standby) One member Default you will support Load Sharing Both (with restrictions) Special designs — more CCP/pivot care smartconsole://sms-lab/gateways/cp-cluster Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Gateways & Servers → cp-cluster → ClusterXL ### Cluster properties Cluster mode High Availability Member 1 cp-gw-01 10.10.10.2 Member 2 cp-gw-02 10.10.10.3 VIP internal 10.10.10.1 Cancel OK ClusterXL Administration Guide — HA mode, VIP, sync network. Training mock. ## Failover runbook - #### Side A — do not reboot both Pick one member. Console available. - #### Side B — state cphaprob state on both. cphaprob -a if for cluster IPs. cphaprob syncstat if sync is the suspect. - #### Side C — one change Fix the down interface or CCP path. Failover with clusterXL_admin down / up in a window — not power-off both. dummy healthy cphaprob state # ID Unique Address Assigned Load State # 1 10.10.10.2 100% ACTIVE # 2 10.10.10.3 0% STANDBY cphaprob -a if # Required interfaces: ... # eth1 UP 10.10.10.2 (VIP 10.10.10.1) # Split brain looks like ACTIVE / ACTIVE on both members. ## Four cluster failures ### 1 · Both Active Sync/CCP down or duplicate cluster IDs. Unplug one member’s data NIC only if you must stop the ARP war — then fix the sync path. ### 2 · Failover dead (stuck Active) Standby never becomes Active. Interface criticality, CCP blocked, or clusterXL_admin down left on the good member. ### 3 · Failover flaps Bad cable, duplex, or monitored interface bouncing. Find the interface in -a if , do not raise grace timers blindly. ### 4 · Reboot both No member left to own the VIP. Double outage you invented. ## How to prove it Close the ticket only when 1) One Active, one Standby, both OK. 2) VIP ARP is one MAC. 3) A planned clusterXL_admin down on Active moves VIP. 4) You did not leave admin-down in place. ## Traps Symptom Cluster story Wrong fix Both Active CCP/sync Reboot both VIP dead Nobody Active New policy Any-Any Flap hourly Monitored NIC Disable ClusterXL ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Healthy HA cphaprob state shows… One ACTIVE and one STANDBY, both OK Both ACTIVE always Both DOWN Only SMS Correct: a . Concept. Q2 Both members Active usually means… Split-brain / they cannot see each other Perfect load sharing SIC is great Hide NAT is off Correct: a . Failure 1. Q3 First command? cphaprob state on both members cpstop on both fwaccel off forever Delete the cluster object Correct: a . Runbook. Q4 Why not reboot both members together? Nobody left to own the VIP Gaia forbids reboot Logs delete NAT requires one reboot Correct: a . Failure 4. Q5 Cluster private conversation rides… CCP / sync network HTTPS Inspection CA Hide NAT ports only SmartConsole PC Correct: a . Concept. Q6 CoreXL is… Not the same as ClusterXL The HA protocol The VIP AD Query Correct: a . Do not mix names. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - Check Point ClusterXL Administration Guide (R81 / R81.20) — HA, cphaprob, sync network. - CLI: cphaprob state , cphaprob -a if , clusterXL_admin . Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt