[solved] Finally CPHA configuration resolved

Finally, problem that I’ve encountered a month ago has been resolved. I would like to express my gratitude and appreciation especially to David Rodriguez from SysAdminTutorials.com for your effort in helping me to resolve CPHA configuration issue.

BEFORE [PROBLEM]

AFTER [RESOLVED]

You can find David’s tutorial here. It’s the most helpful document I’ve ever read in configuring Check Point Cluster.

David has also setup a discussion forum where you can post any question regarding Check Point firewall. Should you have any questions, please feel free to post it there.

There were a few mistakes in my configuration especially on the “Edit Topology” part. I didn’t configure outside interface of the Cluster. Once it has been configured, I pushed the policy again and it works!

REFERENCE
http://www.sysadmintutorials.com/tutorials/check-point/check-point-r75-cluster-setup/
http://www.sysadmintutorials.com/forums/showthread.php?800-How-to-configure-Check-Point-SPLAT-R60-R65-High-Availability-Configuration&p=843#post843

[problem] There is only one interface defined for object [CLUSTER NAME]. At least one more interface must be configured for this object in order to use the Anti-Spoofing feature.

PROBLEM

The following error message occurs when pushing firewall policy to clusters.

There is only one interface defined for object . At least one more interface must be configured for this object in order to use the Anti-Spoofing feature.

The Gateway Cluster Properties is as follows:

Check Point R75 Cluster Setup tutorial by sysadmintutorials.com

Thanks to David Rodriguez who has created Check Point R75 Cluster Setup tutorial here.
http://www.sysadmintutorials.com/tutorials/check-point/check-point-r75-cluster-setup/

Even though my lab in VirtualBox is based on Check Point R65, it shouldn’t be any problem since most of the setup in Check Point series is quite similar.

I’ve followed his tutorial step by step. However, I was experiencing the following issues;

Issue 1: There is a discrepancy in R65 & 75 cluster menu (should not be a big issue)

R60/R65 Check Point Menu

R75 Check Point Menu

Problem 2: Can’t change the topology to External (Not sure if Topology name is important for CPHA)

R75 Edit Topology

R65 Edit Topology

Problem 3: “Installation failed. Reason: Load on Module failed – no memory” during installation (Problem since I can’t push the policy)

https://firewallengineer.wordpress.com/2012/04/23/problem-installation-failed-reason-load-on-module-failed-no-memory/

[solved] How to start Check Point High Availability (CPHA) Module?

PROBLEM

HA module not started
HA state:            ClusterXL inactive or machine is down
HA started:   no

cphaprob stat
will display the status of the cluster

[Expert@R65-FW-254]# cphaprob state
HA module not started.
[Expert@R65-FW-254]#

cphaprob -a if
will display the monitoring interfaces, the fwd, cphd dameon states, look for any interface down alerts if the cluster is down.

[R65-FW-254]# cphaprob -a if
HA module not started.
[R65-FW-254]#

cphaprob list
will display the overall health status of the cluster / Shows a status in list form

[R65-FW-254]# cphaprob list

Built-in Devices:

Device Name: Interface Active Check

Registered Devices:

Device Name: Synchronization
Registration number: 0
Timeout: none

Device Name: Filter
Registration number: 1
Timeout: none

Device Name: fwd
Registration number: 2
Timeout: 2 sec

[R65-FW-254]#

cpstat ha
high availability state

[Expert@R65-FW-254]# cpstat ha
Product name: High Availability
Version:      N/A
Status:       problem
HA installed: 1
Working mode:
HA started:   no
[Expert@R65-FW-254]#

[Expert@R65-FW-254]# cpstat -f all ha
Product name:        High Availability
Major version:       6
Minor version:       0
Service pack:        1
Version string:      N/A
Status code:         2
Status short:        problem
Status long:
HA installed:        1
Working mode:
HA protocol version: 2
HA started:          no
HA state:            ClusterXL inactive or machine is down
HA identifier:       0

Interface table
————————————————
|Name|IP|Status|Verified|Trusted|Shared|Netmask|
————————————————

Problem Notification table
————————————————-
|Name           |Status |Priority|Verified|Descr|
————————————————-
|Synchronization|problem|       0|     730|     |
|Filter         |OK     |       0|     730|     |
|fwd            |OK     |       0|     731|     |
————————————————-

Cluster IPs table
———————————————–
|Name|IP|Netmask|Member Network|Member Netmask|
———————————————–

Sync table
—————–
|Name|IP|Netmask|
—————–
[Expert@R65-FW-254]#
[Expert@R65-FW-254]# fw hastat
HOST      NUMBER     HIGH AVAILABILITY STATE          MACHINE STATUS
localhost ??         module disabled
[Expert@R65-FW-254]#

[R65-FW-254]# cpstart
SVN Foundation: cpWatchDog already running
SVN Foundation: cpd already running
SVN Foundation started
FireWall-1: starting external VPN module — OK
Note: This machine is not defined as a part of any Cluster.
It is possible that the IP of this machine as it appears in your hosts
file differs from the general IP of this machine in the Management server.
Alternatively, Check your Cluster configuration in the Management server.
If this machine is no longer part of a Cluster, please disable Check Point ClusterXL
or State Synchronization on it.
FireWall-1: Starting fwd

Installing Security Policy InitialPolicy on all.all@R65-FW-254
Fetching Security Policy from localhost succeeded
Failed to read database.
Probably module was never installed
Failed to fetch policy from masters in masters file
FireWall-1: enabling bridge forwarding
FireWall-1 started
FloodGate-1 is disabled. If you wish to start the service, please run ‘etmstart enable’.
SmartView Monitor: Not active
cpstart: Power-Up self tests passed successfully
cpstart: Starting product – SVN Foundation
cpstart: Starting product – VPN-1
cpstart: Starting product – FloodGate-1
cpstart: Starting product – SmartView Monitor
cpstart: Starting product – Advanced Routing
[R65-FW-254]#

[Expert@R65-FW-254]# cpconfig
This program will let you re-configure
your Check Point products configuration.

Configuration Options:
———————-
(1)  Licenses
(2)  SNMP Extension
(3)  PKCS#11 Token
(4)  Random Pool
(5)  Secure Internal Communication
(6)  Disable Advanced Routing
(7)  Disable cluster membership for this gateway
(8)  Automatic start of Check Point Products

(9) Exit
Enter your choice (1-9) :

REFERENCE

https://www.cpug.org/forums/installing-upgrading/9786-how-do-i-start-my-ha-module.html

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk36247

SOLUTION [May 20, 2012]

You can read the solution here 🙂

https://firewallengineer.wordpress.com/2012/05/20/solved-finally-cpha-configuration-resolved/

Check Point Cluster Configuration: High Availability vs Load Sharing

Basically, there are two main options in configuring Check Point Cluster.

1. High Availability (HA)
2. Load Sharing

In order to configure Check Point with High Availability (HA) solution, we need to have two identical Check Point machine. Since everything is created in VirtualBox, creating another identical machine is so easy. Just right click on the machine that you wish to copy, and click Clone. You can also use the combination of Ctrl+O to clone it.

Now you already have two identical Check Point machine. Everything is copied exactly as a parent machine including IP Address. Therefore, the first thing you need to do is to change IP Address as it will cause IP conflict issue if both of them are located in the same network. Use sysconfig menu to change IP Address of the Check Point box. Please refer to the link below how to do it.

UPDATE – APRIL 20, 2012  How to change IP Address in Check Point firewall

Once everything is ready, follow the following steps in configuring Check Point Cluster with High Availability solution:

1. Right click on Check Point
2. Choose New Check Point
3. Choose VPN-1 Pro/Express Cluster…

STATUS – April 18, 2012

Currently, I’m still reading the User Guide in figuring out what to do next. :).

I also discussed this matter in CPUG forum to get help from Check Point expert there.

I’ll update this post once I’ve knew what to do in completing HA setup in Check Point cluster

SIMILAR ISSUE

https://www.cpug.org/forums/check-point-secureplatform-splat/11602-how-setup-clusterxl-splat-r65.html

https://www.cpug.org/forums/installing-upgrading/938-clusterxl-win2003-splat.html

Configuring High Availability on a Gateway

Sample HA Implementation on Two Gateways